What changes for Australian privacy policies on 10 December 2026

From 10 December 2026, APP 1.7 and APP 1.8 require an Australian privacy policy to describe the automated and computer-assisted decisions an organisation makes about people. What the OAIC's September 2026 guidance says. General information, not legal advice.

The short answer

On 10 December 2026, two new paragraphs of Australian Privacy Principle 1 commence. From that date an APP entity's privacy policy must describe the automated decisions it makes about people — and not only the decisions a computer makes on its own. The obligation also reaches decisions where a computer program does something substantially and directly related to the decision that a human then signs.

The paragraphs were inserted by the Privacy and Other Legislation Amendment Act 2024. The Office of the Australian Information Commissioner published its guidance on 30 September 2026: an update to the APP 1 Guidelines, a fact sheet titled "APP 1.7-1.9 Transparency Obligation" dated September 2026, a supplementary fact sheet for government agencies, and a flowchart.

There is no transition period and no grandfathering. The obligation attaches to decisions made on or after 10 December 2026, including decisions made by a program that has been running for years using personal information collected long before.

What the rule says

It is short enough to read in full, and worth reading in full, because almost every summary of it drops the second limb.

Australian Privacy Principle 1.7: "Without limiting subclause 1.3, the APP privacy policy of an APP entity must contain the information covered by subclause 1.8 if: (a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and (b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and (c) personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision."

Australian Privacy Principle 1.8: "The information covered by this subclause is: (a) the kinds of personal information used in the operation of such computer programs; and (b) the kinds of such decisions made solely by the operation of such computer programs; and (c) the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs."

Where all three are true, the policy must set out three things: the kinds of personal information those programs use, the kinds of decisions made solely by them, and the kinds of decisions for which they do something substantially and directly related to the decision.

Whether it applies to you

The obligation falls on APP entities. The OAIC describes its regulatory remit as covering Australian Government agencies and organisations with an annual turnover of more than $3 million, and some other organisations. Whether your organisation is an APP entity is a question about your own turnover and activities measured against the Privacy Act's definitions, and it is not one a page on a consultancy website can settle for you.

Two things about the scope are commonly misread, and both are worth stating plainly.

The words in the principle are "computer program". A scoring spreadsheet, a rules engine inside a line-of-business application, an eligibility filter configured in a CRM and a machine-learning model are all computer programs. Nothing in the drafting turns on whether the vendor markets the thing as AI, and an organisation that has deployed no AI at all can still be squarely within scope.

The OAIC's fact sheet asks vendors of third-party software to give their users clear, high-level information about how the software can make decisions, so that those users can prepare their privacy policies. The disclosure obligation sits with the entity that arranged for the program to be used, not with the vendor that wrote it. If a platform you licence ranks, scores or filters people, the paragraph describing it belongs in your policy.

What "significantly affect" means

The threshold in APP 1.7(b) is that the decision "could reasonably be expected to significantly affect the rights or interests of an individual". The OAIC's fact sheet states that the impact must be more than trivial and must have the potential to considerably influence the circumstances or outcomes for the individual concerned.

Read that list for its shape rather than for your own industry. Every item is a decision about access — to money, to work, to a home, to a service, to a country. If a program you run decides who gets something that matters to the person on the other side of it, the absence of your sector from the list is not an answer to the question.

Human review does not exempt you

This is the limb that summaries drop, and it is the one most likely to produce a privacy policy that is wrong.

The tempting reading is that because a person signs the decision, the computer did not make it, so the paragraph does not bite. The drafting anticipates that reading and closes it. The obligation reaches a program that does a thing "substantially and directly related to making" the decision, whether or not a human makes the final call.

The Explanatory Memorandum, as quoted by the OAIC, glosses both words: "substantially" means where the thing is a key factor in facilitating the human's decision making, and "directly" means where the thing has a direct connection with making the decision.

The OAIC's fact sheet adds that a program can meet the test by advising on an appropriate outcome, determining one, or otherwise influencing one, and that this holds whether the output is advisory or determinative. It states that a decision may be within scope even where a computer program output does not replace the entire decision-making process. On machine learning and generative AI used in significant decisions, its position is that these would generally fall within scope unless subject to extensive human oversight and control.

The difference between those two cards is mostly a documentation difference, and that is the uncomfortable part. An organisation that reviews its automated outputs carefully but writes nothing down will struggle to show which side of the line it sits on.

What goes in the policy

APP 1.8 asks for kinds, three times over. Not system names, not vendor names, not model architectures — kinds.

Grouping is permitted — the fact sheet accepts that entities may group decision categories and data types rather than itemise every sub-decision. Where the information used is more sensitive, and the fact sheet names health information and biometric templates, that should be made clear rather than folded quietly into a general category.

It also meets the commercial objection head-on. Information about how a program weights data can be commercial-in-confidence and left out. Information about the use of personal information in decisions generally is not, unless it is itself commercially sensitive or a trade secret.

For an entity that cannot work out whether it is in scope at all, the fact sheet gives a direct steer: take a cautious approach and include the information in the privacy policy.

Two further points shape the drafting and are easy to miss. The information should be structured so that an individual can ask for more detail than the policy itself gives. And it should be framed so that both the information and the decision can be reviewed.

The inventory comes first

You cannot write the three kinds until you know what they are, and most organisations do not have that list in any one place. Nothing about building it is technically difficult. It is tedious, and it crosses teams that do not usually talk to each other.

That document has a second life beyond the privacy policy. The same list is what you would reach for to answer a question about how a particular decision was made, to brief an insurer, or to respond if the regulator asks. It is worth building once, properly, rather than assembling twice under time pressure.

A recruitment platform that ranks applicants, a credit or fraud tool that returns a score, a customer platform with eligibility logic your team configured but nobody wrote — these do not surface when you ask your own engineers what the organisation automates, because nobody there built them. The OAIC's fact sheet places the disclosure obligation on the entity using the product and asks vendors to supply the high-level information needed to describe it. Where a vendor has not sent you that, asking for it is a reasonable request with a date attached to it.

Frequently asked questions

What changes for Australian privacy policies on 10 December 2026?

APP 1.7 and APP 1.8, inserted by the Privacy and Other Legislation Amendment Act 2024, commence. From that date an APP entity's privacy policy must set out the kinds of personal information used in the operation of computer programs that make decisions about people or do a thing substantially and directly related to making them, the kinds of decisions made solely by those programs, and the kinds of decisions for which those programs do such a thing. The obligation applies to decisions made on or after that date, including by programs already in use.

Does the obligation apply if a human makes the final decision?

Yes, in many cases. The obligation reaches a computer program that does a thing substantially and directly related to making the decision, not only one that makes it outright. The OAIC's September 2026 fact sheet states that a decision may be within scope even where the program's output does not replace the entire decision-making process, and that this holds whether the output is advisory or determinative.

Is this only about artificial intelligence?

No. The statutory words are "computer program". A scoring spreadsheet, a rules engine inside a business application and an eligibility filter configured in a CRM are all computer programs, and an organisation that has deployed no AI at all can still be within scope.

What exactly has to go in the privacy policy?

Three things, each expressed as kinds rather than as named systems: the kinds of personal information used in operating the programs, the kinds of decisions made solely by them, and the kinds of decisions for which they do a thing substantially and directly related to the decision.

Does it apply to software we bought rather than built?

Yes. The disclosure obligation sits with the entity that arranged for the program to be used, not with the vendor that wrote it. The OAIC's fact sheet asks software vendors to give their users clear, high-level information about how the product can make decisions, so that those users can prepare their own privacy policies.

How much detail does the OAIC expect?

The fact sheet asks entities to avoid overwhelming individuals with unnecessary amounts of granular technical detail, while requiring that the detail given be meaningful to a reasonable person. Grouping decision categories and data types is accepted. Where more sensitive information such as health information or biometric templates is used, that should be made clear. Information about how a program weights data may be withheld as commercial-in-confidence.

SWAGARISTS INC

Enterprise IT solutions and digital transformation — AI automation, cybersecurity, cloud services, custom development and digital marketing. Offices in Vadodara, Gujarat (India) and Brisbane, Queensland (Australia). Email business@swagaristsinc.in · India +91 90235 06204 · Australia +61 452 270 475.