Automated decisions in Australia series – Part 1: a quick guide to Australia's new privacy rules
What you need to know
- New automated decision-making (ADM) transparency requirements come into effect in Australia in December 2026, impacting your use of AI and other automated systems.
- The regulator is likely to issue guidance in September, but you need to prepare for transparency and its consequences now.
- In a dedicated series of articles, we will share practical lessons on taking a risk-based approach to automated decision transparency, exploring areas of regulator focus revealed in recent consultations, discussing what you need to do to comply with the new rules, and how you can prepare for greater scrutiny.
- Part 1 is a quick guide to help you understand the new automated decision transparency requirements.
What you need to do
- Prepare for scrutiny: Transparency brings internal processes into the clear view of customers, regulators, and competitors. You need to health-check underlying data privacy practices, and stress test higher risk business processes against a range of technology neutral laws and legal risks.
- More than AI, more than automated decisions: New requirements apply to a broad range of computer programs that might make, or might do things that support, decisions. Treating the rules in a silo or just as an AI-related requirement may mean you miss key business processes.
- Take a risk-based approach: A "gold plated" solution will not be practical – you will need a risk-based approach to ongoing compliance.
- Expect more reforms: Automated decision transparency is one of the final parts of 2024's first tranche of privacy reforms. The Government is working on more changes to the Privacy Act, but no timetable has been set.
New ADM transparency rules in a nutshell
1. Set out in privacy policies:
a. the kinds of decisions; and
b. the kinds of personal information used to make decisions,
where…
2. … the entity has arranged for …
3. … a computer program …
4. … to make a decision … or to do a thing substantially and directly related to making a decision …
5. … that significantly affects rights or interests of an individual …
6. … using personal information.
Read together, these elements set out the trigger for including automated decisions in a privacy policy: where an entity has arranged for a computer program to make a decision (or to do a thing substantially and directly related to making a decision) that significantly affects the rights or interests of an individual, using personal information, the entity must set out in its privacy policies the kinds of decisions involved and the kinds of personal information used to make them.
1. What you need to put in your privacy policy
From 10 December 2026, entities will need to update their privacy policy to disclose how they use automated and computer-assisted decision making. The new Australian Privacy Principles 1.7 to 1.9 will require entities to identify decisions that significantly affect the rights or interests of an individual, and set out in privacy policies:
- the kinds of decisions made solely by a computer operation;
- the kinds of decisions where computer operation is substantially and directly related to making the decision; and
- the kinds of personal information used to make those decisions.
The level of detail should be sufficient to enable individuals to understand how their personal information is used and the potential impact on their rights or interests, while remaining accessible and avoiding unnecessary technicality. The privacy policy does not need to include any confidential commercial information about automated decision-making systems.
This is not just about AI. The requirements capture a broad range of computer programs that make or support decisions affecting individuals – including rules-based systems, spreadsheet automation, scoring tools, and other commonly-used software products.
2. Arranged for
An entity has arranged for a computer program to make or support the decision.
This extends to third party systems used on your behalf or as part of a service provided to you by outsourcing partners or other service providers. This may require a more detailed understanding of the systems and processes used in your supply chain.
3. A computer program
"Computer program" is broadly interpreted.
It captures a wide range of technologies, including commonly used software, apps and tools, extending to pre-programmed rules-based processes, artificial intelligence, machine learning, spreadsheet automation, scoring or ratings, etc.
4. Decision, or steps supporting a decision
The program makes a decision OR does a thing substantially and directly related to making a decision.
Identifying the "decision" is key to understanding what computer programs might make, or substantially and directly relate to, the decision.
This applies to both wholly and partially automated decisions. For partial automation or computer assisted decisions:
a. The thing done by the computer program must be substantially and directly related to the decision – a key factor in the decision, directly connected with making the decision.
b. It must meaningfully influence the decision (the decision would be significantly different or not made at all without the program’s contribution).
c. This can happen even if there is a human in the loop actually making the decision.
5. Significantly affects rights or interests
The decision significantly affects rights or interests of an individual.
This concept is impacted by circumstances. For example, a child or person experiencing vulnerability may face more significant impacts from the same conduct.
It extends beyond legal rights (eg under contract or statute) to material stakes individuals may hold that, while not necessarily protected by law, may have meaningful impact on individuals’ lives.
6. Using personal information
The decision uses personal information about that individual.
This is an important limitation on what systems are relevant for these requirements – and a concept that may expand further in future reforms.
Recent privacy determinations have seen the Privacy Commissioner explore "novel" applications of the Privacy Act to address a changed digital environment, including to expand what has traditionally been seen as personal information regulated under the Privacy Act. For example, recent determinations have found that information collected using pixel tracking technology used by health provider websites was personal information even though customers might not have been uniquely identified.
More than AI, and more than automated decisions
It is easy to underestimate the scope of the new transparency rules by focusing on fully automated processes or AI systems. However, Australia's framework extends much further than that.
While the General Data Protection Regulation (GDPR) (and the previous Data Protection Directive, dating back to 1995) have had requirements relating to automated decision-making and profiling for many years, Australia's formulation is not a “lift and shift” from the EU requirements.
In comparison to the GDPR, the Privacy Act formulation does not include some of the more restrictive provisions (in Article 22 of the GDPR) such as the right “not to be subject to” automated processing and profiling, the implementation of measures including human intervention, and the exception for special category data (although similar protections do arise in the Western Australian Privacy and Responsible Information Sharing Act 2024 (WA) that took effect on 1 July 2026, these are only applicable to WA public entities and their contracted service providers).
That said, in one sense, the scope could still be broader than the GDPR given that:
- the Privacy Act focuses on making a decision, or doing a thing "substantially and directly related” to making a decision, that “significantly affect[s] the rights or interests” of individuals, and
- the GDPR refers to a decision “based solely on automated processing, including profiling”, which “produces legal effects concerning him or her or similarly significantly affects him or her”.
In both cases, the trigger is not the technology – it is the impact on individuals. This means the rules may well capture a lot of "business-as-usual" data-based business processes that have been in place in organisations for many years.
More reform to come
Automated decision transparency is one of the final pieces of 2024's first tranche of privacy reforms. The Government deferred a second tranche of reforms including reforms directly and indirectly impacting automated decisions.
The second tranche of privacy reforms was expected to bring further requirements impacting AI and automated decisions, including privacy impact assessments for high-risk activities (including automated decisions), the need to explain automated decisions, a requirement that data activities be "fair and reasonable" (regardless of consent), and changes to protect more data as "personal information" (impacting the training and use of AI models).
At Senate Estimates hearings, the Attorney-General's Department confirmed there is still a commitment to further reforms, that work is underway, and that consultation will follow – but no timelines have been set.
Want to know more?
- What's Ahead 2026 ‒ Technology industry in Australia
- A generational change in privacy regulation in Australia
- The kids are online – what Australia's Children's Online Privacy Code means for you
- A new privacy right of action – how to avoid unexpected consequences
- Australia's first tranche of privacy reforms – a deep dive and why they matter
Other authors: Olivia Carmody, Lawyer; Cindy Nguyen, Graduate; Lauren Spence, Graduate and Joanne Lee, Paralegal.
