Privacy policies must explain automated decisions (APPs 1.7 to 1.9)
BuildAIPolicy Research · Added 27 October 2026 · Last checked 27 October 2026
What it is
Organisations covered by the Privacy Act must describe in their privacy policy when computer programs, including AI, make or help make decisions that could significantly affect people, using their personal information.
Who it affects
APP entities: Australian Government agencies, businesses and not-for-profits with an annual turnover above A$3 million, and some smaller businesses covered whatever their turnover, such as health service providers.
What to consider
- List the AI tools and other programs that make or help make decisions about people.
- Note the kinds of personal information they use and the kinds of decisions involved.
- Update your privacy policy before 10 December 2026.
Sources
Put rules like this into practice
The AI Policy & Risk Pack gives your organisation an AI use policy, a risk register, an AI tool inventory and notice wording, written from how you use AI. Preview every section free before you pay. It isn't legal advice.
A general summary of public information, checked against the sources listed on the date shown. It isn't legal advice and may not cover every rule that applies to you. Check the sources, and get professional advice for your situation.