The date is right, and the obligation is narrower than it is often described
From 10 December 2026 the Privacy Act 1988 (Cth) gains three new subclauses, APP 1.7, APP 1.8 and APP 1.9. They were inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth) and they change what an APP entity has to put in its privacy policy.
The obligation is a privacy policy obligation. The Office of the Australian Information Commissioner states it in these terms:
From 10 December 2026, an APP entity must include additional information in its APP Privacy Policy if it arranges for a computer program to use personal information to make decisions that could reasonably be expected to significantly affect the rights or interests of an individual.
When it applies at all
Three things have to be true before APP 1.7 is engaged:
- the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision;
- that decision could reasonably be expected to significantly affect the rights or interests of an individual; and
- personal information about the individual is used in the operation of the program.
What has to go in the policy
Under APP 1.8 the privacy policy has to set out the kinds of personal information used in the operation of the computer programs, the kinds of decisions made solely by the operation of computer programs, and the kinds of decisions where a thing substantially and directly related to making the decision is done by such a program.
APP 1.9 adds that making a decision includes refusing or failing to make one, and that the obligation applies whether the decision is beneficial or adverse to the individual.
The OAIC gives three examples of decisions that may affect rights or interests: a decision under an Act or legislative instrument to grant or refuse a benefit, such as admission to a country or a housing benefit; a decision affecting rights under a contract, such as a life insurance policy; and a decision affecting access to a significant service or support, such as healthcare.
What the obligation is not
It is not a requirement to tell an individual, at the time, that a decision about them was made by a computer. Nothing in APP 1.7, APP 1.8 or APP 1.9 requires a notice to the person affected. The information goes in the published privacy policy.
It is not a requirement to explain how a particular decision was reached, to give reasons for it, or to offer a human review.
It does not reach every decision a computer makes. The significance test in APP 1.7 is part of the obligation rather than a footnote to it.
Who it applies to
It applies to APP entities, and not every Australian business is one. The OAIC's position is:
Most small businesses are not covered by the Privacy Act, but some are. A small business is one with an annual turnover of $3 million or less.
A small business is covered regardless of turnover if it is, among other things, a health service provider, a credit reporting body, trading in personal information, a contractor providing services under a Commonwealth contract, or related to a business the Act covers. The OAIC publishes a 15 question checklist for working out which side of the line a business sits on.
What happens if a policy does not comply
The OAIC's stated position is that its powers to issue infringement notices and compliance notices, which commenced on 11 December 2024, will apply to a failure to have a privacy policy meeting the APP 1.7 requirements.
The Privacy Act also carries a maximum civil penalty for a serious interference with privacy of the greater of $50 million, 3 times the value of the benefit obtained, or 30% of adjusted turnover for the relevant period. That is the top of the scale for a serious interference with privacy. It is not the stated consequence of a non-compliant privacy policy, and the two are worth keeping apart when reading vendor material about this change.
Where the detail will be
The OAIC has said it will publish detailed guidance on these obligations during 2026 and has run a consultation on that guidance. Until it lands, the OAIC points readers to Part 15 of the Privacy and Other Legislation Amendment Act 2024 (Cth) and the explanatory memoranda.
Sources
- OAIC, APP Guidelines Chapter 1: APP 1 Open and transparent management of personal information
- OAIC, Small business
- OAIC, Consultation on guidance for transparency in automated decision making
- Privacy and Other Legislation Amendment Act 2024 (Cth), as made
This article states the law as at 25 August 2026. It is general information and it is not legal advice.