Who must comply with Automated decision-making transparency in your privacy policy (APP 1.7–1.9)?

From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.

The Privacy and Other Legislation Amendment Act 2024 inserted APP 1.7–1.9. From 10 December 2026, APP 1.7 requires an APP entity to include the information in APP 1.8 in its APP privacy policy if (a) it has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision, (b) the decision could reasonably be expected to significantly affect the rights or interests of an individual, and (c) personal information about the individual is used in the program's operation. APP 1.8 requires the policy to describe the kinds of personal information used and the kinds of decisions made solely by the program or substantially assisted by it. The OAIC's APP 1 guidelines (version 2.0, updated 30 September 2026) give examples such as differential pricing and limits on access to employment, and note that commercially sensitive information about the system need not be disclosed. The obligation applies only to APP entities — removal of the small business exemption is a separate, proposed reform and not law.

Applies when the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and automated decisions about people.

How the regulator frames it: APP entities (turnover over $3M, or within a s 6D(4) carve-out) whose computer programs make or substantially assist decisions that could significantly affect individuals.

What triggers it: Using personal information in a computer program that makes, or substantially and directly assists, a significant decision about an individual (credit, insurance, pricing, hiring, access to services).

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out) and automated decisions about people.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business uses AI or automated decision-making about individuals: it then applies (annual turnover over $3M — an APP entity under the Privacy Act (s 6D) · Uses AI / automated decisions about people).

When due

Privacy policy updated by 10 December 2026, then kept current whenever an automated decision process is added or changed.

Frequency

Ongoing

Evidence to keep

Register of automated decision processes (what decision, which personal information, solely automated or assisted, significance assessment); updated APP privacy policy with the APP 1.8 statements; owner and review date for each process.

In force from

10 December 2026

Status

Upcoming (not yet in force)

Priority

Critical

Maximum penalty: A breach of an APP is an interference with privacy, enforceable by the OAIC under the Privacy Act's general enforcement and civil penalty regime.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• ADM transparency obligation in force: 10 December 2026 (one-off). APP entities must disclose significant ADM use in privacy policy.

• APP 3 collection of sensitive information: APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
• Notifiable Data Breach (NDB) scheme: Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
• APP 12 & APP 13 access and correction requests: Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.
• APP 8 cross-border disclosure: Before disclosing personal information overseas, APP 8 requires reasonable steps so the recipient meets the APPs — unless an exception applies. Steps and exceptions.

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated critical priority, and is an ongoing duty.

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

• Privacy Act 1988

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)