Where APP 1.7 comes from
The Privacy and Other Legislation Amendment Act 2024 added new transparency requirements to Australian Privacy Principle 1 (APPs 1.7 to 1.9). They were given a two-year lead time and commence on 10 December 2026. They sit alongside your existing obligation to have a clearly expressed, up-to-date privacy policy.
When does it apply?
In broad terms, an organisation covered by the Privacy Act needs to address automated decisions in its privacy policy where all three of these are true:
- A computer program is involved. It either makes the decision, or does something substantially and directly related to making it (for example, generating a risk score that a staff member relies on).
- The decision could reasonably be expected to significantly affect an individual’s rights or interests. Examples include decisions about benefits or entitlements, rights under a contract or agreement, or access to significant services or support.
- Personal information about the individual is used in the operation of the program.
Not sure whether a particular decision qualifies? Try our free automated decision scope check.
What your privacy policy needs to cover
Where the requirement applies, your privacy policy will need to include information about:
| Requirement | What it means in practice |
|---|---|
| The kinds of personal information used | Categories of data the programs use, such as identity details, financial information, transaction history, location or inferred attributes. |
| The kinds of decisions made solely by computer programs | Fully automated decisions with no meaningful human involvement, such as automatic declines or account suspensions. |
| The kinds of decisions where a program does something substantially and directly related to making the decision | Decisions a person makes but that rely heavily on automated scoring, ranking or recommendations. |
An illustrative example
Wording will depend entirely on your organisation and should be reviewed by legal counsel. As an illustration only:
“We use automated systems to help assess applications for our products. For some applications, these systems decide automatically whether to approve or decline. For others, they produce an assessment that our staff use when making a decision. These systems use information such as your identity and contact details, the financial information you provide, your account and transaction history with us, and information from credit reporting bodies.”
How to prepare: five practical steps
- Inventory your automated decisions. Start with an AI register and include rules engines and vendor tools, not just “AI”.
- Classify each decision. Is it solely automated, substantially supported, or only minor admin help? Could it significantly affect someone?
- Map the personal information. Record the categories each program uses, including data inferred or bought from third parties.
- Draft clear wording. Describe kinds of information and kinds of decisions clearly, then have it reviewed by an Australian-qualified lawyer.
- Keep it current. Add a check to your change process so new or changed systems trigger a review of your privacy policy.
Common pitfalls
- Assuming a “human in the loop” automatically takes a decision out of scope.
- Overlooking vendor tools such as fraud screening, HR platforms or credit decisioning services.
- Writing vague catch-all wording that doesn’t help people understand what happens.
- Treating the policy update as a one-off rather than part of ongoing AI governance.
Questions people ask
When do the APP 1.7 automated decision requirements start?
They commence on 10 December 2026, under amendments made to the Privacy Act 1988 by the Privacy and Other Legislation Amendment Act 2024.
Do we have to explain how our algorithm works?
The requirement is about describing the kinds of personal information used and the kinds of decisions involved, not publishing your model or source code. Other obligations, such as fairness, consumer protection or sector rules, may require more.
Does a human reviewing the output take a decision out of scope?
Not necessarily. The requirement also covers decisions where a computer program does something substantially and directly related to making the decision, such as producing a score or recommendation a person relies on.
Where to find authoritative guidance
Refer to the OAIC, the Federal Register of Legislation, and the Australian Department of Industry. New to the terminology? See our AI governance glossary. This article is general information, not legal advice.