Yes, if the Privacy Act covers your business and a computer program uses personal information to make, or help make, decisions that could significantly affect people. From 10 December 2026 your privacy policy must describe those kinds of decisions and the information they use. This is general information, not legal advice.
At a glance: Australia's automated-decision privacy rule
When does the automated-decisions duty start?
Your duty starts on 10 December 2026, two years after the amending Act received Royal Assent, and it covers every decision made once it has started.
Timeline
From law to deadline: the dates that matter
From Royal Assent to the day the privacy-policy duty starts. Past and next follow the date on your device.
10 Dec 2024
Act becomes law
The Privacy and Other Legislation Amendment Act 2024 receives Royal Assent. Its automated-decisions part (Schedule 1, Part 15) is set to start 24 months later.
10 Dec 2026
Privacy-policy duty starts
APP 1.7 to 1.9 apply to every decision made once this item has started, even if the program was set up or the data collected earlier (item 89). APP 1.7 is also added to section 13K, so a breach of it can draw an infringement notice or a compliance notice.
the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision
APP 1.7(a), inserted by the Privacy and Other Legislation Amendment Act 2024, item 88 (10 December 2024).
The amending Act speaks of a "computer program" and never mentions artificial intelligence, so a plain refund rule in your shop system can count.
Is your business covered?
The duty binds APP entities, so if you run a small business you are probably outside it, unless one of the exceptions below applies to you.
Who must comply, by situation
| Your business | Covered? | Where in the Act |
|---|---|---|
| Your turnover passed the threshold in any year since you started | Yes | s6C; s6D(1), (4)(a) |
| You provide a health service and hold health information | Yes | s6D(4)(b) |
| You trade personal information for a benefit, without consent | Yes | s6D(4)(c), (d), (7), (8) |
| You are a Commonwealth contractor or credit reporting body | Yes | s6D(4)(e), (f) |
| Your company is related to a company that is not small | Yes | s6D(9) |
| You are a small business that chose to be covered | Yes, while registered | s6EA |
| You are overseas and carry on business in Australia | Yes, unless a small business operator | s5B(1A), (3) |
If you run a Singapore firm that is not a small business operator, your test is whether you carry on business in Australia; section 5B does not ask where the data is held. Recheck your turnover test yearly.
Which decisions count?
Your decision counts when all three tests in APP 1.7 apply: a program acts, the effect could be significant, and personal information is used.
When a decision has to appear in your privacy policy
Each step, then what to record at that step.
APP 1.9 widens the tests: refusing or failing to decide counts, and so does a beneficial effect. The Act's examples are a benefit under a law, your customer's contract rights, and access to a significant service or support.
Does a person signing off take a decision out?
No, not by itself: if your program's score is substantially and directly related to your staff's decision, that kind of decision still goes in your policy. Our rubber-stamp guide shows why sign-off is often thinner than it looks.
| Illustrative use | Program role; effect | Our reading |
|---|---|---|
| Your refund requests approved or refused automatically | Decides alone; contract rights | Likely in scope: APP 1.8(b) |
| Your credit applications scored before staff decide | Related step; contract, access to credit | Likely in scope: APP 1.8(c) |
| Your bot cancels a subscription after missed payments | Decides alone; contract rights | Likely in scope: APP 1.8(b) |
What should your privacy policy say?
Under APP 1.8 your policy lists kinds, not cases: the kinds of personal information your programs use, and the kinds of decisions they make alone or help make.
Decision tool
Does APP 1.7 reach this decision, and what should you write?
Up to four questions from the wording of APP 1.7 to 1.9. Answer for one kind of your decisions at a time.
| Your answers | Result |
|---|---|
| You are not an APP entity; no exception applies | Out of scope; recheck each year |
| Your program decides alone; significant; personal information | In scope: APP 1.8(a) and (b) |
| Your program scores or ranks; staff decide on it; significant; personal information | Likely in scope: APP 1.8(a) and (c) |
| You use both kinds, in different processes | In scope: APP 1.8(a), (b) and (c) |
| Your decision has no program, no significant effect or no personal information | Out of scope; record why |
| You are not sure you are covered, or of significance | Check first with a lawyer |
Draft wording
Privacy policy section: automated decisions
Turn your result into a starting draft: replace our illustrative defaults with yours, delete any line that does not apply, then have a lawyer review it.
We use computer programs in some decisions that could significantly affect you.
Decisions a program makes without a person reviewing them: [SOLE].
Decisions where a program scores, ranks or recommends and a staff member then decides: [ASSISTED].
Personal information these programs use: [INFO].
Where Origin Pi stands
Score your readiness against six checks we built around APP 1.7 to 1.9. Tick only what is true for you today.
Scorecard
Automated-decision readiness: 6 checks
- 0 to 49%: Not ready. Start with the inventory.
- 50 to 84%: Partly ready. Close your 3-point gaps first.
- 85% and above: Ready for 10 December. Update it when tools change.
Illustrative weights: your four core checks count 3 points, the rest 2 (total 16); a missing 3-point check keeps you below green. Not a compliance test.
Our view: your inventory takes the time, and the wording follows from it. Origin Pi's AI governance work builds that register with an audit trail per tool; AI compliance maps it to each market's rule dates.
If your AI also serves Singapore customers, read the PDPA liability gap. To check your inventory with a second reader, talk to us.
Take the data with you
Cite this post if you reuse the data.
