Automated Decision-Making transparency under Privacy Act (phased)
From a phased commencement, APP entities using ADM must disclose in Privacy Policy.
Who must comply
APP entities using substantially-automated decisions affecting individuals.
What triggers it
Using ADM.
When due
Phased from 10 December 2026.
Evidence required
ADM register; Privacy Policy update; review pathway documentation.
Max penalty
Same penalty regime as other Privacy Act breaches
Effective from
10 December 2026
Summary
The 2024 Privacy + Other Legislation Amendment Act introduces ADM transparency requirements. If a substantially-automated decision affects an individual, the entity must disclose use of ADM + provide certain information about how the system operates. Commencement is 10 December 2026 (two years after the Act's assent). Removal of the small business exemption is a separate, proposed reform — not yet law.
Enforced by
Source legislation
Topics
Related obligations
- CWLTHAutomated Decision-Making transparency (Privacy Act 2024 reforms)APP entities making decisions about individuals using ADM must disclose this in privacy policy from December 2026.
- CWLTHNotifiable Data Breach (NDB) schemeUnder the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
- CWLTHAPP 3 collection of sensitive informationAPP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
- CWLTHPrepare for the proposed removal of the small business exemptionRemoving the Privacy Act small business exemption (<$3M turnover) is proposed for a future reform tranche — agreed in principle, not yet law.
- CWLTHPrivacy Act Reform — information controllers regime (proposed Tranche 2)Tranche 2 reforms in scoping — information controllers + processors regime.
- CWLTHPublish a Privacy Policy compliant with APP 1Every APP entity needs a clearly-expressed Privacy Policy covering APP 1.4 requirements.
Frequently asked questions
- Who must comply with Automated Decision-Making transparency under Privacy Act (phased)?
- APP entities using substantially-automated decisions affecting individuals.
- What triggers Automated Decision-Making transparency under Privacy Act (phased)?
- Using ADM.
- When is Automated Decision-Making transparency under Privacy Act (phased) due?
- Phased from 10 December 2026.
- What is the maximum penalty for Automated Decision-Making transparency under Privacy Act (phased)?
- Same penalty regime as other Privacy Act breaches
- What evidence is required for Automated Decision-Making transparency under Privacy Act (phased)?
- ADM register; Privacy Policy update; review pathway documentation.
Source: https://oaic.gov.au/privacy/privacy-legislation/the-privacy-act/privacy-reforms. Rules Mate is not a law firm. Always verify against the live regulator source before acting.