Automated Decision Making and the Privacy Act: What Changes on 10 December 2026

What changes on 10 December 2026

From 10 December 2026, Australian businesses and practices covered by the Privacy Act have a new thing to explain in their privacy policy: where a computer program uses personal information to make, or help make, decisions that significantly affect people. This is the automated decision making Privacy Act change, and it is a transparency duty. It does not ban automated decisions, and it does not require anyone to approve your systems.

The change comes from Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024, titled "Automated decisions and privacy policies". The Act received Royal Assent on 10 December 2024, and its commencement table says Part 15 starts on "the day after the end of the period of 24 months beginning on the day this Act receives the Royal Assent", with the date column showing 10 December 2026. The Office of the Australian Information Commissioner (OAIC) gives the same date in its September 2026 announcement.

The Act also says the new rules apply to decisions made after commencement, whether the arrangement for the computer program, the use of personal information, or the collection of that information happened before or after that date. In plain terms: a system you set up years ago is covered for decisions it makes or informs from 10 December.

Has the OAIC published final guidance?

Yes. On 30 September 2026 the OAIC published an updated APP 1 chapter of the APP Guidelines (version 2.0) covering the new APP 1.7 to 1.9, along with an APP 1.7 to 1.9 Transparency Obligation fact sheet, a decision flowchart and a supplementary fact sheet for government agencies. The OAIC says they reflect 90 written submissions, and none is labelled as a draft, so older articles saying guidance is still being developed are out of date.

What triggers the automated decision making obligation

The new APP 1.7 says your APP privacy policy must contain extra information if all three of these are true:

1. "the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision"
2. "the decision could reasonably be expected to significantly affect the rights or interests of an individual"
3. "personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision."

APP 1.9 then widens what counts. Making a decision "includes refusing or failing to make a decision", and a decision can affect someone's rights or interests "whether the rights or interests of the individual are adversely or beneficially affected". Its examples include "a decision that affects the individual's rights under a contract, agreement or arrangement" and "a decision that affects the individual's access to a significant service or support."

What the key words mean, according to the OAIC

• Computer program is broad. The OAIC fact sheet includes rule based processes, AI and machine learning, "software, apps or word-processing tools", and generative AI "including chatbots". A spreadsheet formula can count.
• Arranged for covers in house software, third party products you buy, off the shelf software you configure, and "reliance on advisory outputs from a computer program."
• Substantially and directly related is how recommendations get caught. Substantially "means where it is a key factor in facilitating the human's decision making", and directly means the program's output has a direct connection with the decision.
• Significantly means the effect "must be more than trivial and must have the potential to considerably influence the circumstances or outcomes for the individual concerned." The OAIC adds that vulnerability matters: the same decision can have a bigger impact on someone experiencing vulnerability.

A human signing off at the end does not automatically take a decision out of scope. What matters is how much the program's output shaped it.

The OAIC is explicit that "a decision may be within scope of the transparency obligation even where a computer program output does not replace the entire decision-making process or is subject to human review." Its guidelines list factors to weigh, including how much staff rely on the output, how often they override it, and how deeply it is built into the workflow. It also says machine learning or generative AI outputs used in significant decisions "would generally fall within scope... unless subject to extensive human oversight and control."

There is a sensible limit. The guidelines say that where a person makes the decision and only uses software for something else, "such as using a word processing program to document a decision", that is not captured. Using Copilot to tidy the wording of a letter is not the same as using it to rank job applicants.

What your privacy policy must disclose

If the three conditions are met, APP 1.8 says your privacy policy must include:

• "the kinds of personal information used in the operation of such computer programs"
• "the kinds of such decisions made solely by the operation of such computer programs"
• "the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs."

That is the full list. APP 1.7 itself does not require you to publish your algorithms, get consent or offer a human review, although your other privacy obligations still apply. The OAIC fact sheet says commercially sensitive information and trade secrets are excluded, but warns that information which might expose you to "ridicule, embarrassment or public criticism" is not commercial in confidence.

The OAIC says you can group decisions and types of information, but "the level of detail provided about these processes must be meaningful to a reasonable person", and where more sensitive information such as health information or biometric templates is used, "this should be clear." Its worked examples add a section headed "Decisions made by computer programs" that lists the kinds of personal information, then the kinds of decisions.

For a clinic that uses software to prioritise recalls, an outline might look like this. It is an illustration of the structure, not wording to copy without advice:

• Kinds of personal information: name, date of birth, contact details, appointment history, and health information such as test results and chronic disease flags.
• Kinds of decisions informed by computer programs: which patients are prioritised for recall and reminder contact, and the order in which appointment requests are offered.

Vendors don't carry this for you

The OAIC "generally expects that APP 1 transparency obligations typically remain with the APP entity" using the personal information to make the decision, even when the software comes from a third party. It says software providers should give their customers clear, high level information about how their products can be used to make decisions. So the practical step is to ask your vendors, in writing, what their products do with personal information and what they recommend you disclose.

Why it matters if you get it wrong

The Act adds APP 1.7 to the list in section 13K of the Privacy Act, a "civil penalty provision for which infringement notices or compliance notices can be issued". The same list already includes the requirements to have a privacy policy and to cover its existing contents, so missing automated decision information sits alongside those.

Who has to comply

The obligation applies to APP entities: organisations and agencies covered by the Privacy Act. The OAIC's small business guidance explains that a small business, one with "an annual turnover of $3 million or less", is generally not covered. But it lists exceptions that apply "regardless of turnover", and the first on the list is a health service provider. So a GP clinic, allied health practice or other health service provider on the Gold Coast or in Brisbane is covered by the Privacy Act whatever its size, and the new duty applies if it uses automation in the way APP 1.7 describes.

Other listed exceptions include businesses that trade in personal information and businesses that have opted in. If you are under the threshold, check your position with your legal adviser rather than assuming either way.

Where is automation making decisions in your business?

Most South East Queensland businesses don't think of themselves as running "automated decision making", but the OAIC's list of decisions that are generally in scope includes ordinary things: recruitment software that sorts candidate profiles, programs used "to prioritise the provision of health or disability services", programs that approve or reject credit applications, and AI reports used to rank staff performance or decide bonuses. One of its worked examples is a health and aged care provider whose spreadsheet formula scores and ranks people for appointments.

Work through these areas with the people who actually use the systems.

Patient and client services

• Online booking or triage tools that sort, prioritise or decline appointment requests.
• Recall and reminder systems that decide who gets contacted first, or who doesn't.
• Clinical software features that flag, score or rank patients for follow up.
• Intake forms that route people to different services based on their answers.

Billing, payments and credit

• Rules that automatically place accounts on hold, suspend services or refer debts to collection.
• Payment plan or credit approval tools, including those built into finance or practice software.
• Pricing or discount rules that change what a person is offered based on their details.

Staff and recruitment

• Applicant tracking or job board tools that screen, score or shortlist candidates.
• Rostering or performance tools that rank staff or suggest pay and bonus outcomes.

AI tools your team already uses

This is the area most often missed. Look at Microsoft 365 Copilot, ChatGPT, Claude and AI features switched on inside existing software, including practice management and clinical systems. For each one, ask a simple question: is its output a key factor in a decision about a person? Summarising a meeting is not. Asking it to rank applicants, recommend who gets an appointment first, or assess whether a customer is a credit risk probably is.

Include personal AI accounts staff use without approval. You can't describe decisions in your privacy policy if you don't know which tools are making them.

For more on F11, including AI scribes, consent and the questions to ask AI vendors, see our guide to RACGP 6th edition information security, privacy and AI.

An automated decision making checklist

There are about seven weeks until 10 December 2026, enough time for most small and medium organisations to work through these steps.

How CSG helps

We are a Gold Coast based team supporting organisations across the Gold Coast, Brisbane, Tweed Heads and South East Queensland since 1999. We are ISO/IEC 27001:2022 certified and audited annually, and we have specialist experience with general practice software such as Best Practice (Bp Premier) and MedicalDirector.

This article is general information, not legal advice, and you should get legal advice on whether APP 1.7 applies to you and what your privacy policy should say. Where we help is the technical groundwork your lawyer will need: finding the systems, automations and AI tools in use, working out what data they touch, and getting answers from vendors.

Our AI and automation services help businesses adopt AI securely and sensibly, with the governance and data controls to keep client and patient information where it belongs. If staff are already using AI in their own accounts, our Claude for business service brings that use into accounts your organisation manages, with admin controls and an acceptable use position your team can follow. Known tools, not guessed tools.

To start your inventory before 10 December, talk to our team or call us on (07) 5551 2333.