Automated decision-making disclosure checklist

From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy where computer programs use personal information to make decisions, or to do things substantially and directly related to making decisions, that could reasonably be expected to significantly affect an individual’s rights or interests.

Find the decisions

• List every system that makes, recommends, scores, ranks or screens decisions about people, including supplier software.
• Include common hidden cases: credit and payment terms, recruitment screening, rostering, fraud flags, eligibility and pricing.
• Ask each key supplier, in writing, whether their product makes or substantially assists decisions about individuals.

Assess each one

• Record the personal information each system uses.
• Record what the decision is, and who it affects.
• Decide whether it could reasonably be expected to significantly affect someone’s rights or interests, and note why.
• Note whether a person reviews the output before it takes effect.

Prepare the disclosure

• Draft plain-English wording for the privacy policy describing the kinds of decisions and the kinds of personal information used.
• Ask your legal adviser to confirm the wording before 10 December 2026.
• Name an owner who keeps the inventory current as systems and suppliers change.

General information only, not legal advice.