7 Min Read
From 10 December 2026, Australian privacy policies must say which decisions about people are made or substantially supported by software, and what personal information those systems use. The requirement is in Australian Privacy Principle 1.7, added by the Privacy and Other Legislation Amendment Act 2024. It covers far more than AI: rules engines, scoring models and even spreadsheets can be in scope.
The Office of the Australian Information Commissioner (OAIC) published its guidance on 30 September 2026. That leaves about seven weeks from this article to the start date. The wording change to a privacy policy is the easy part. The hard part is knowing which of your systems make or shape decisions about customers, staff and applicants, because few organisations keep that list.
What is APP 1.7?
APP 1.7 is a transparency rule. If an organisation uses a computer program to make a decision about a person, or to do something substantially and directly related to making it, and the decision could significantly affect that person's rights or interests, the privacy policy must disclose it. APP 1.8 sets out what the disclosure must contain, and APP 1.9 explains what "significantly affect" means.
When does it start, and who does it apply to?
The obligation starts on 10 December 2026, two years after the amending Act received Royal Assent. It applies to every APP entity: Australian Government agencies, most businesses with annual turnover above $3 million, and some smaller businesses, such as health service providers and businesses that trade in personal information.
What counts as automated decision-making under APP 1.7?
All three of these conditions must be met.
- A computer program is involved.It either makes the decision itself or does something substantially and directly related to making it, such as producing a score or recommendation that a person relies on.
- The decision could significantly affect someone.It could reasonably be expected to significantly affect an individual's rights or interests, for better or worse.
- Personal information is used.The program uses personal information about that individual to make the decision or do the related thing.
Does a spreadsheet or a rules engine count?
It can. The OAIC reads "computer program" broadly. It is not limited to AI or machine learning, and it covers in-house software, third-party platforms and configured off-the-shelf tools. A spreadsheet that only calculates someone's age is unlikely to be substantially related to a decision. A spreadsheet that scores applicants and sets a cut-off is a different matter. The OAIC's guidelines also say generative AI tools, including chatbots, count, and a decision can be in scope even when a person reviews the output. Where an entity is unsure, the OAIC's advice is to take the cautious approach and disclose.
Which decisions significantly affect someone?
The test covers decisions with beneficial or adverse effects, and refusing or failing to make a decision. Typical examples in NCG's client sectors:
- Banking and lending.Credit approvals, credit limits, hardship assessments and account closures.
- Fraud and financial crime.Transaction blocks, fraud scores that hold a payment, and customer risk ratings in KYC and AML screening.
- Insurance.Claims triage, automated claim decisions and pricing that excludes a person from cover.
- Identity and access.Identity verification that refuses onboarding, and automated access decisions that remove a person's access to services.
- Employment.CV screening, rostering and performance flags that affect pay or employment.
What must the privacy policy say?
APP 1.8 requires three kinds of information. Categories can be grouped, but the groupings must be meaningful to a reasonable reader.
- The kinds of personal information usedby the computer programs that make or support these decisions.
- The kinds of decisions made solelyby computer programs.
- The kinds of decisions where a program does something substantially and directly relatedto the decision, such as a score or recommendation that a person then acts on.
What happens if the privacy policy is wrong?
The OAIC has had the power to issue infringement notices and compliance notices since 11 December 2024. A privacy policy that does not meet APP 1.7 can attract either, without the OAIC having to prove a serious interference with privacy. The bigger risk is often reputational: a privacy policy that is visibly out of step with how a business actually makes decisions invites complaints and regulator attention.
How to prepare before 10 December
- Build an inventory of decisions, not systems.Start from the decisions that affect customers, staff and applicants, then trace which programs make or shape each one. Fraud, credit, claims, onboarding and HR are the usual starting points.
- Apply the three-part test to each decision.Record why each one is in or out of scope. That record is your evidence if the OAIC asks.
- Map the personal information each program uses.Group it into categories a customer would understand, such as identity details, transaction history or device data.
- Check third-party and SaaS tools.A vendor's fraud score or identity check counts if you rely on it. Ask vendors what data their models use and add the obligation to contract reviews.
- Write the disclosure and publish it before 10 December.Plain, grouped descriptions work better than a list of product names. Have legal and the system owners review it together.
- Give the inventory an owner.New models and rule changes will bring new decisions into scope. Add an APP 1.7 check to change management and model approval so the privacy policy stays accurate.
"Most organisations can update a privacy policy in an afternoon. Few can say which of their systems decide things about customers. That inventory is the real work, and it is also the first step of any AI governance programme."
Is APP 1.7 the same as the GDPR rules on automated decisions?
No. GDPR Article 22 gives people the right not to be subject to some solely automated decisions and, where those decisions are allowed, the right to obtain human intervention. APP 1.7 is a transparency duty only: it requires disclosure in the privacy policy, but it does not give individuals a right to an explanation or a human review. Organisations already compliant with the GDPR will have useful records, but they still need an Australian disclosure.
Does APP 1.7 apply only to AI?
No. Any computer program can be in scope, including rules-based systems that have run for years. AI systems are more likely to be in scope because they are often used for scoring and recommendations, but the age or simplicity of a system does not exempt it.
Do we have to explain how our algorithms work?
No. The privacy policy must describe the kinds of decisions and the kinds of personal information used. It does not have to disclose model logic, weightings or thresholds.
How Nordic Cyber Group helps
We build decision inventories as part of our AI governance, fraud and financial crime and identity security work, so the systems that make these decisions are already on our desk. From Melbourne, our Australian practice helps APP entities find in-scope decisions, write a disclosure the business can stand behind, and keep it current. If you are also working through APRA's operational risk standard, read our comparison of CPS 230 and DORA. To check your position before 10 December, book a free 30-minute consultation.
Thank you!
