Lexora Regulatory Intelligence
Automated decision-making disclosures start on 10 December 2026
Privacy policies must soon explain certain decisions that computer programs make, or substantially help make, about individuals. Most organisations have not yet mapped where those decisions happen.
- Published
- Jurisdiction
- Australia
- Subject
- Privacy Act 1988, APP 1 (automated decision-making transparency)
- Status
- Status: Law, commencing later
Summary of the development
The first tranche of Privacy Act reforms, the Privacy and Other Legislation Amendment Act 2024, became law in December 2024. Most of its changes started straight away. One significant change was given a two-year runway: new transparency requirements in Australian Privacy Principle 1 for automated decision-making, which commence on 10 December 2026.
From that date, an organisation’s privacy policy must explain where it uses computer programs to make decisions, or to do things substantially and directly related to making decisions, that could reasonably be expected to significantly affect an individual’s rights or interests, and the kinds of personal information those programs use.
The OAIC published an issues paper on the obligation in May 2026 as it prepares guidance. Organisations should watch for that guidance, but the commencement date is set in the legislation and does not depend on it.
The practical challenge is not the drafting. It is finding the decisions. Many sit inside software bought for another purpose, and are not obvious until someone asks the right questions of the people who use it.
This article is general information, not legal advice. Confirm how the obligation applies to your organisation with your legal adviser.
Key dates
- 10 December 2024Privacy and Other Legislation Amendment Act 2024 receives Royal Assent
- 10 December 2026Automated decision-making disclosure requirements in APP 1 commence
Practical implications
- Organisations covered by the Privacy Act will need to identify decisions that are made, or substantially and directly assisted, by computer programs using personal information.
- Where those decisions could reasonably be expected to significantly affect an individual's rights or interests, the privacy policy must describe them, including the kinds of personal information used.
- The obligation is about transparency. It does not ban automated decisions, but it exposes them to scrutiny by customers, staff and the regulator.
- Many relevant decisions sit inside purchased software, such as credit, recruitment, rostering, fraud and eligibility tools, so supplier questions will be part of the work.
Recommended actions
- Build an inventory of systems that make or substantially assist decisions about individuals, including supplier tools.
- For each, record what personal information it uses and whether its decisions could significantly affect people.
- Ask key suppliers to describe any automated decision-making in their products.
- Draft the privacy policy wording early and have your lawyer confirm it before 10 December 2026.
- Assign an owner to keep the inventory current as systems change.