Automated decisions and your privacy policy

APP 1.7The three conditions

From 10 December 2026, the duty applies when all three of these hold. The words are the Act’s.

1. (a) The program“the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision”
2. (b) The effect“the decision could reasonably be expected to significantly affect the rights or interests of an individual”
3. (c) The information“personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision”

Clause 1.8What the policy must then say

Once the three conditions are met, the policy must cover three things, again in the Act’s words:

1. Information used“the kinds of personal information used in the operation of such computer programs”
2. Decisions the program makes alone“the kinds of such decisions made solely by the operation of such computer programs”
3. Decisions the program helps make“the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs”

The OAIC asks for balance: enough meaningful information for people to understand the program’s use, without detail that obscures the point. Its guidelines say the obligation does not require commercially sensitive information or trade secrets in the policy.

APP 1.9What counts as a decision

APP 1.9 makes the idea wide. Making a decision includes refusing or failing to make one, doing a thing includes refusing or failing to do it, and a decision can affect someone whether the effect is adverse or beneficial. The Act’s examples include a decision that affects a person’s rights under a contract, agreement or arrangement, and one that affects their access to a significant service or support.

Human review does not take a decision outside the duty. The OAIC’s guidelines say a decision may be in scope “even where a computer program output does not replace the entire decision-making process or is subject to human review”. A program that recommends or guides a person’s decision is caught where it is “substantially and directly related” to making it: in the guidelines, substantially means a key factor in the human’s decision, and directly means a direct connection with it. Using a word processor to write up a decision a person has made is not captured.

“Computer program” takes its ordinary meaning and is read broadly, covering pre-programmed rule-based processes as well as artificial intelligence and machine learning. A simple rule in a customer system can be a computer program for this purpose as much as a model can.

“Arranged for”When the software belongs to someone else

The duty follows the entity that arranged for the program to decide, even where another entity operates it. The OAIC generally expects that the duty “typically remains with the APP entity who is using personal information to make a decision or do a thing that significantly affects the rights or interests of an individual”, and notes that an entity may still need to comply where another entity supplies the program under contract.

Its list of things that would generally count as “arranged for” includes several that sit close to everyday customer systems:

• “an entity contracts a third-party software company to automatically approve or decline refunds on its behalf”
• “an entity has a case management system that automatically escalates particular types of complaints”
• “an entity procures another entity’s AI system to screen and rank job applications leading to a decision being made on who to employ”

Being on that list generally settles only the “arranged for” limb. Whether the policy must say anything still depends on the other two conditions, especially the effect.

APP 1.7(b)When an effect is significant

In the guidelines, “significantly” means an impact that is more than trivial and capable of considerably influencing a person’s circumstances or outcomes. The person’s own circumstances count, such as being a child or a vulnerable person. The OAIC’s non-exhaustive list of rights or interests that would generally be in scope includes access to essential banking and credit services, telecommunications, essential utilities, employment opportunities and housing.

The guidelines’ own example is a rideshare company whose program can suspend a customer’s account: minor for some customers, but for a customer experiencing vulnerability who relies on the service to attend medical appointments, reach essential services or keep a job, the decision could significantly affect their rights or interests.

ResourcesWhat the OAIC has published

To help entities comply, the OAIC has published targeted resources and an update to its APP 1 guidelines. They include a fact sheet and a flowchart on the APP 1.7 to 1.9 transparency obligation, and a supplementary fact sheet for government agencies.