From 10 December 2026, APP entities that use (or arrange for) computer programs to make, or help make, significant decisions about individuals using the individual’s personal information will need to explain this in their privacy policies. This is likely to capture many commercial decisions affecting individuals – for example, which products and services are advertised and made available (and to whom), the terms (including pricing) that apply and various types of compliance, credit, financial crime or other risk-based decisions.
This new transparency requirement was introduced as part of the first ‘tranche’ of privacy reforms in the Privacy and Other Legislation Amendment Act 2024 (Cth) with a two-year implementation period and so has been on the horizon for some time.
However, many organisations have been waiting for guidance from the OAIC before seriously grappling with what this will mean in practice. With the OAIC’s guidelines, supplementary fact sheet and fact sheet for government agencies now published (on 30 September 2026, a little over 2 months before the new obligations take effect), there is no excuse for putting this off any longer.
Below, we outline the legal requirements, examine some of the trickier borderline cases, and offer practical tips for building automated decision-making (ADM) disclosures into privacy policies.
The legal requirements and the OAIC’s guidance
The new ADM disclosure requirements are set out in three new Australian Privacy Principles (APPs) – APP 1.7, 1.8 and 1.9.
APP 1.7 sets the trigger and applies to an APP entity where:
- the entity has arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision;
- the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
- personal information about the individual is used in the operation of that computer program.
Where the obligation is triggered, the entity must include in its privacy policy the information set out in APP 1.8. This information includes:
- the kinds of personal information used in the operation of such computer programs;
- the kinds of decisions made solely by the operation of such programs; and
- the kinds of decisions for which such programs do a thing that is substantially and directly related to making the decision.
APP 1.9 provides further colour to this by clarifying that making a decision includes refusing or failing to make a decision, noting that a decision may have either an adverse or a beneficial effect on an individual’s rights or interests. APP 1.9 also includes non-exhaustive examples of decisions that may significantly affect the rights or interests of an individual (including a decision that affects the individual’s rights under a contract, agreement or arrangement and a decision that affects the individual’s access to a significant service or support).
Unsurprisingly, the OAIC’s guidance indicates that each of these elements will be applied broadly:
- a computer program is not limited to AI systems - it includes pre-programmed rule-based processes, machine learning, ordinary software and apps, and even a formula in an Excel spreadsheet;
- doing a thing captures anything a program does to help make a decision, including generating a score, flag, ranking or recommendation that a human decision-maker relies on. However, general productivity tools, like general word processing or task management software, which do not themselves produce an output relied on in making the decision fall outside the framework; and
- an entity will have arranged for a computer program to be used where it develops its own in-house software or deploys off-the-shelf software, permits or directs its employees to use automated tools in their work, or outsources a function to a third-party vendor that uses such tools on its behalf - even if the entity does not operate the program itself.
Practically, it will be necessary for organisations to undertake a mapping exercise to understand when the new transparency requirements apply across the automated decisions used in their business – this may be an extensive process particularly given the broad scope indicated in the OAIC’s guidance as to when the requirements should apply. The OAIC has also stated in its fact sheet that an APP entity should err on the side of caution when determining if its use of a computer program falls within the ADM transparency obligation – if in doubt, the use should be notified to comply with APP 1.8 requirements.
It is also important to note that the ADM requirements apply differently to similar requirements under other legislation, e.g. the GDPR, so mapping processes used for those purposes may not cover the field.
Difficult judgement calls
How ‘automated’ does a decision need to be?
A common question is whether the transparency obligations apply where a program generates a score or recommendation, but a human makes the final call. The short answer is that they often will.
According to the OAIC’s guidance, a program does a thing ‘substantially and directly related’ to a decision where it is a key factor in facilitating the human’s decision (substantially) and has a direct connection with the decision (directly). Both elements must be met. The OAIC is clear that a decision may be in scope even where the program’s output does not replace the whole decision-making process or is subject to human review, and regardless of whether the output is advisory or determinative.
The OAIC lists factors to consider, including the degree of reliance on the output, the ability and likelihood of human override, the nature of the output, the transparency and explainability of the output, and how deeply the program is integrated into the workflow. In examples used in the OAIC’s guidance, a program used to rank scholarship applications is in scope even though the scholarship panel may choose to disregard it, as is a program used to assess loan applications where the relevant loans officer almost always follows the risk score that is produced.
By contrast, an example provided in the OAIC’s fact sheet suggests that an AI-generated recommendation may not be substantially related to the decision where reviewers actively interrogate the outputs, re-examine the underlying criteria, narrow the program’s parameters, consider additional evidence and document why they departed from the recommendation.
This leaves a significant grey area. A nominal human in the loop is not sufficient to take a decision-making process outside the scope of the ADM framework where the human is strongly influenced by or almost always follows the computer output. However, in some cases, where the human exercises their own independent influence over the process, the framework will not apply. Organisations will need to carefully work through how their processes actually work in practice, where both humans and automated systems are involved, to determine whether or not a particular type of decision is within scope.
What does it take to significantly affect an individual’s rights or interests?
Whether a particular kind of decision significantly affects the rights or interests of an individual will also require careful (and contextual) consideration.
The OAIC’s guidance says an effect will be significant where it is more than trivial and has the potential to considerably influence the individual’s circumstances or outcomes. The OAIC provides a non-exhaustive list of rights or interests that will generally be in scope that includes access to essential food and nutrition, healthcare, financial assistance, education, essential banking and credit, telecommunications, essential utilities, employment opportunities and housing. Examples used in the OAIC’s fact sheet suggest that this may extend to ‘essential goods’ that would cover everyday groceries, such as baby formula, gluten-free bread and pharmacy items. It is unclear how far this could continue and whether the relatively wide availability of such goods from different suppliers would make a difference.
This broad approach to the interpretation of ‘essential goods’ may raise challenges for retailers that deploy personalised pricing based on personal information of individuals, including through targeted content and advertising, a practice that many would not ordinarily expect to bring their everyday product ranges within scope. On top of that, the OAIC considers that differential pricing is significant regardless of whether the price difference is small or large, because even small differences can compound over time. Retailers using dynamic or personalised pricing for everyday products using any form of computer program should assume that these practices will need to be disclosed. The fact sheet also lists programmatic advertising relating to the decision to sell significant goods or services as generally in scope. This may bring into scope suppliers that seek to use digital advertising to target specific audiences using personal information in a way that could arguably limit opportunities of others to access their products.
Finally, when assessing the impact of in-scope decisions, it is worth remembering that the individual’s circumstances also matter: a decision that has a minor impact on most people, such as suspending a rideshare account, may be significant for a person experiencing vulnerability who relies on that service to attend medical appointments. Where a program produces materially different outcomes for a vulnerable cohort, the OAIC says the decision should be treated as significant. Accordingly, to fully understand the potential scope of the new transparency framework, businesses will need to consider the impact of their decisions on different potential target groups and adopt the perspective of the most vulnerable.
Turning guidance into practice
Grouping decisions
Entities that use automated tools to make large numbers of decisions may well be wondering how to fit all of this information into a privacy policy that may run to only a few pages (especially in a way which is meaningful and easy to interpret for individuals).
The good news is that the OAIC does not expect each decision to be listed individually. Entities may group information about categories of decisions and types of personal information, provided that the level of detail remains meaningful to a reasonable person. Where the same types of personal information are used across several decisions, they do not need to be separated out on a granular basis. However, sensitive categories, such as health information or biometric templates, should be called out clearly.
The OAIC’s worked examples show what this can look like in practice. A financial institution might explain that it uses a range of fraud-prevention programs that process identity information, geolocation data, biometric templates and credit information to decide whether to grant or deny account access, transactions or loan applications. However, organisations will need to carefully calibrate the level of abstraction they use in their policies, to avoid the risk of being accused of failing to adequately disclose the true nature of their ADM practices.
Using clear words
Disclosures should be in plain language, avoid overwhelming technical detail, be tailored to the entity's own activities, and be framed so that individuals can request further information and challenge the decision. This is always a challenge when communicating in relation to somewhat technical subject matter.
The examples in the OAIC’s fact sheet bear this out, with the OAIC suggesting that wording such as ‘support decision-making and administrative action, workflow automation, and service delivery’ will be adequate to describe how personal information may be used to substantially and directly automate a decision-making process. It is not hard to imagine that some consumers will struggle to comprehend what this type of language signifies in practice.
Exemptions that may be available
The OAIC’s guidance states that commercially sensitive information and trade secrets will not need to be disclosed to fulfil the ADM transparency requirements. However, the OAIC’s fact sheet indicates that the risk of embarrassment or public criticism is not a ground to withhold information. Organisations cannot avoid disclosure simply out of concern for the heightened scrutiny that may result.
However, for clarity, even where commercially sensitive information and trade secrets can be withheld from disclosure, this does not provide an absolute exemption from disclosing anything.
A number of the examples provided by the OAIC that purport to illustrate how the ADM framework will operate in practice relate to decisions about employees, including decisions that ‘rank employee performance, determine promotions, or decide bonus/remuneration outcomes’. However, this seems to overlook the employee records exemption that will by default exclude handling of employee records by private sector entities for purposes directly related to an employment relationship. While there are important limitations to this exemption – such as that it does not apply to recruitment activity, before a job applicant becomes an employee, and that it does not apply to contractors – it would seem to squarely cover decisions relating to employee performance and so in our view the ADM transparency framework should not extend to such decisions (at least for private sector entities). That said, organisations may still elect to provide visibility over how staff are assessed for other reasons.
Factoring in the wider context
Many organisations that are subject to the ADM framework will also be subject to other expectations that are highly relevant to their use of software and how decisions are made about an individual.
For example:
- financial institutions are subject to obligations such as the duty to provide services ‘efficiently, honestly and fairly’ under the Corporations Act 2001 (Cth);
- entities regulated by ASIC, APRA, AUSTRAC and other regulators are subject to thematic conduct obligations in relation to customer interactions, customer assessments, risk management, the use of technology (including AI), compliance and governance that shape the combined use of software and personal information; and
- various Australian consumer laws also have a bearing on how organisations leverage technology to make decisions about individuals and what good disclosure looks like.
A review undertaken to comply with the ADM framework can therefore provide an excellent opportunity to adopt a wider lens that takes into account other relevant requirements.
Presentation is everything
As a final note, while APP 1.7 requires that the entity’s policy must ‘contain’ relevant information, there may be some flexibility in exactly how the information may be presented.
The examples in the OAIC’s fact sheet suggest that information may be set out ‘in a new section’ of the privacy policy, which arguably implies that the information should all be set out in a single self-contained document. That may well be an ideal outcome but could be difficult to achieve where there are a lot of ADM processes to disclose.
In our view, it should be legitimate for entities to consider other ways of incorporating the information into the policy, such as by including a prominent link to a separate page or a pop-up window with further detail. The ultimate test should be whether consumers can easily access relevant information about ADM processes by consulting the entity’s privacy policy rather than whether all information can be shoehorned into a single document.
