By Louise Wolf, Principal, MST Lawyers
Estimated reading time: 8 minutes
Does your business use software to screen job applicants, assess customer credit, approve applications or suspend accounts? From 10 December 2026, privacy policies must tell people when a computer program is used to make, or substantially help make, decisions that could significantly affect them. Many businesses already use automated tools this way without realising it.
Key takeaways
- Covered businesses must prepare for the automated decision-making privacy-policy requirements commencing on 10 December 2026.
- Ordinary rule-based software can be relevant, as well as AI.
- Human involvement does not automatically remove the disclosure requirement.
- Assess each process against all three conditions: the software’s role, its use of personal information and the potential effect on the individual.
- Understand your systems before updating your policy, and seek advice where coverage, exemptions or the required wording are unclear.
What are the new privacy policy requirements from 10 December 2026?
The Privacy and Other Legislation Amendment Act 2024 (Cth) introduced new Australian Privacy Principles (APPs) 1.7 to 1.9 into the Privacy Act 1988 (Cth). They commence on 10 December 2026, two years after the amending Act received Royal Assent.
The disclosure obligation applies where the following three conditions are met:
- Your organisation has arranged for a computer program to make a decision, or do something substantially and directly related to making a decision.
- The decision could reasonably be expected to significantly affect an individual’s rights or interests.
- Personal information about that individual is used in the program’s operation for that purpose.
Where these conditions are met, your privacy policy must describe:
- the kinds of personal information used by those programs;
- the kinds of decisions made solely by computer programs; and
- the kinds of decisions where a computer program does something substantially and directly related to making the decision.
The Office of the Australian Information Commissioner (OAIC) published updated guidance and supporting resources on 30 September 2026 to help organisations prepare. https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making
Which Australian businesses must disclose automated decision-making?
The obligation applies to all APP entities: organisations and Australian Government agencies covered by the Australian Privacy Principles.
This includes businesses with annual turnover above $3 million and some smaller businesses, including health service providers and businesses that trade in personal information.
If you are unsure whether your organisation is covered, establish that before deciding which systems require disclosure. Turnover is not the only consideration.
Employment-related information also needs careful assessment. Certain handling of employee records by private sector employers is exempt from the APPs, but that exemption does not cover all employment-related information or activities. For example, it does not cover information collected about job applicants.
What counts as automated decision-making under the Privacy Act?
Automated decision-making can involve software making a decision itself or substantially and directly contributing to a person’s decision.
The OAIC interprets “computer program” broadly. It includes rule-based software, artificial intelligence, machine learning, generative AI and chatbots. A feature built into your existing software or a platform supplied by a vendor may therefore be relevant.
Does human involvement remove the disclosure requirement?
No. Having a staff member make the final decision does not automatically remove the disclosure requirement.
For example, software may produce a risk score or rank applications. If that output substantially and directly contributes to the staff member’s decision, the process may be covered even though the staff member can override it.
Consider how the system is used in practice: how much do staff rely on its output, and how does it influence their judgement?
What makes a decision significant?
The legal test concerns decisions that could reasonably be expected to significantly affect an individual’s rights or interests.
The legislation gives examples including decisions:
- granting or refusing a benefit or entitlement under legislation;
- affecting an individual’s rights under a contract, agreement or arrangement; and
- affecting access to a significant service or support.
A “decision” includes refusing or failing to make a decision. Its effect can be beneficial or adverse.
What are common examples of automated decision-making in business?
The following examples illustrate processes worth reviewing. They do not mean that every use of these systems requires disclosure: only where the software uses a person’s personal information to make, or substantially and directly contributes to, a decision that could significantly affect them.
| Business activity | Illustrative example | What should you consider? |
| Recruitment | A platform scores applicants’ qualifications and experience, and managers use the ranking to shortlist candidates. | Does the ranking substantially influence who progresses or is rejected? |
| Customer credit | Software uses a sole trader’s payment history and credit information to recommend approving or refusing credit terms. | Is personal information used, and could the decision significantly affect that individual? |
| Account access | A platform uses customer information to identify suspected fraud and automatically suspend an account. | Could suspension affect access to a significant service? |
| Applications or claims | Software assesses an individual’s information and recommends approving or rejecting an application or claim. | How strongly does the recommendation influence the final decision? |
| Healthcare or aged care | A triage system uses health information to recommend a person’s priority for care. | Could the priority significantly affect access to care or support? |
| Customer refunds | A platform assesses customer information and automatically approves or rejects refund requests. | Could the decision significantly affect the customer’s contractual rights? |
| New Lead or job allocation | Systems that route customer leads or jobs (common in franchising) to franchisees or technicians based on ratings or performance scores. | Can significantly affect an individual franchisee’s income. |
Other processes to examine include eligibility scoring, personalised pricing and automated termination of services. These examples are hypothetical.
Does every automated task need to be disclosed?
No. Using software does not, by itself, trigger this particular disclosure requirement.
An appointment reminder or a customer list sorted alphabetically would not ordinarily, by itself, meet the three-part test.
However, avoid assuming that the software or AI tool is outside the requirement because it is simple. A spreadsheet that calculates someone’s age needs to be assessed in context: what role does that calculation play in the decision? A spreadsheet used to score applicants and determine who receives an interview warrants closer consideration.
What information must your privacy policy include?
Where the obligation applies, explain the kinds of personal information used and the kinds of decisions made or substantially and directly supported by the software.
For example, a business reviewing its recruitment platform should identify:
- which categories of applicant information the platform uses;
- whether it makes screening decisions itself; and
- whether it produces scores or rankings that substantially and directly contribute to shortlisting decisions.
Simply stating “we use AI” does not explain those matters.
The disclosure should be meaningful and written in plain language. The requirement does not demand disclosure of commercial-in-confidence information or trade secrets, but that does not remove the need to explain the relevant categories of information and decisions.
What are the penalties for failing to disclose automated decision-making?
The risks are real. From 10 December 2026, if your privacy policy does not properly explain how you use automated decision-making, the OAIC can:
- Fine you without going to court. It can issue an infringement notice of up to $21,840 per breach for most companies, or $72,800 for listed companies.
- Order you to fix it. It can issue a compliance notice requiring you to correct the problem.
- Take you to court. Penalties can reach $364,000 per breach for a company.
If the way you use automated decision-making also breaches other privacy obligations, the penalties are much higher: up to $3.64 million for a company. For serious breaches, the maximum for a company is $50 million or more, depending on its turnover and any benefit it gained.
These penalties are being used. In October 2025, the Federal Court ordered Australian Clinical Labs to pay $5.8 million following a data breach, the first penalties of their kind under the Privacy Act. The OAIC has also been checking businesses’ privacy policies for compliance.
An inaccurate privacy policy can also mislead customers, which creates separate risk under the Australian Consumer Law.
How should you prepare your privacy policy before 10 December 2026?
Start by understanding your systems, then assess what your policy needs to say.
1. Identify decisions made or influenced by software
Ask the people responsible for recruitment, finance, sales, customer service and IT which systems:
- score or rank individuals;
- recommend an outcome;
- approve or reject applications;
- prioritise access to services; or
- suspend or terminate accounts.
Review how those systems operate in practice, including how staff use their outputs.
2. Identify the personal information used
Record the categories of personal information each relevant system uses, whose information it is and which decision it contributes to.
Employment-related processes should also be checked for any applicable exemption.
3. Ask your software vendors
If you do not understand a platform’s decision-making features, ask the provider:
- Does the software use personal information to score, rank, recommend or make decisions about individuals?
- What categories of personal information does it use?
- What outputs does it produce?
- Which decisions are automatic, and where is human review involved?
4. Apply the three-part test
Assess each relevant process against all three conditions:
- What computer programs to you use to make a decision, or do something substantially and directly related to making a decision;
- Could those decisions reasonably be expected to significantly affect an individual’s rights or interests; and
- Is personal information about the individual used in the program’s operation for that purpose.
Keep a record of your reasoning, including the software’s contribution and the potential effect on the individual.
5. Update your privacy policy
Where required, add a plain-English explanation of the relevant kinds of personal information and decisions before 10 December 2026.
Check that the new wording is consistent with the rest of your policy.
6. Keep the policy accurate
Establish a process for checking new tools and changes to existing systems. Your privacy policy should continue to reflect how your business actually handles personal information.
When should you seek legal advice about automated decision-making?
Seek advice if you are unsure:
- whether your business is covered by the Australian Privacy Principles;
- whether an exemption applies;
- whether software substantially and directly contributes to a decision;
- whether a decision could significantly affect an individual’s rights or interests; or
- how to describe the process accurately in your privacy policy.
Advice may also be useful where a vendor cannot clearly explain how its platform uses personal information or generates recommendations.
How can MST Lawyers help update your privacy policy?
MST Lawyers can prepare a new automated decision-making section for your existing privacy policy to address the requirements commencing on 10 December 2026.
We start with a short questionnaire about how your business uses automated tools. Based on your answers, we will provide advise a fixed fee before any work begins.
We will then provide the new section, together with any changes needed elsewhere in your policy to keep it consistent, ready to publish before 10 December 2026.
This service covers the new automated decision-making requirements only. If you would also like a full privacy-policy review or broader privacy compliance advice, we can provide a separate costs estimate.
Find out more about our privacy policies and advice services or contact Louise Wolf at louise.wolf@mst.com.au.
Frequently asked questions
Does my business need to disclose every use of AI?
No. This disclosure requirement applies where all three conditions are met. Review whether the tool uses personal information to make, or substantially and directly contribute to, a decision that could reasonably be expected to significantly affect an individual’s rights or interests.
Do the requirements apply to software supplied by a third party?
They can. Using a vendor’s platform or a feature within existing software does not automatically place the process outside the requirement. Assess your organisation’s arrangement and how the software uses personal information to make or contribute to relevant decisions.
Do the requirements apply to systems installed before December 2026?
Yes, where the conditions are met for decisions made from commencement. The legislation covers relevant decisions even where the arrangement, use of personal information or acquisition of that information occurred earlier.
This article is general information only and is not legal advice. You should obtain advice specific to your circumstances.
