Automated decisions and the Privacy Act
From 10 December 2026, organisations covered by the Australian Privacy Principles must explain certain automated decisions in their privacy policy. The first step is knowing where your systems make them.
Most businesses do not know where decisions are automated
Automated decisions are often buried inside tools, rules and integrations nobody has documented.
Rules inside software
Scoring, approvals, eligibility checks and routing rules sit inside CRMs and platforms.
AI added quietly
New AI features in existing tools may be making or influencing decisions about people.
No documentation
Automations were built over time with no single record of what they do.
Why it matters now
The change makes transparency about automated decisions a privacy policy requirement for covered organisations.
Privacy policy updates
Covered organisations need to describe certain automated decisions that use personal information.
Customer trust
People increasingly want to know when software, not a person, made a decision about them.
Better automation anyway
Documenting automated decisions makes systems easier to maintain and fix.
Map, document, then improve
We provide the technical side: finding and documenting automated decisions. Your legal adviser confirms your obligations.
Talk to us about automated decisionsInventory your automations
We list the automations, rules and AI features that use personal information across your systems.
Identify decisions about people
We flag which ones make or substantially influence decisions that affect individuals.
Document how each works
We describe what data each uses, what it decides and where a person is involved, in plain English.
Add oversight where needed
Where it makes sense, we add human review, logging or clearer explanations to the workflow.
The result: A clear record of where your systems make decisions about people, ready for your privacy policy review.
Read more on this
Automated Decisions and Your Privacy Policy: What Changes on 10 December 2026
From 10 December 2026, APP entities must explain certain automated decisions in their privacy policy. A plain-English guide to APP 1.7 to 1.9. Not legal advice.
Read the guideAI Agent or Automated Workflow? How to Choose for Each Process, and Keep People in Control
AI agents and automated workflows suit different jobs. Use this practical test to choose for each process, plus the guardrails that keep people in control.
Read the guideFrequently asked questions
Organisations covered by the Australian Privacy Principles must include information in their privacy policy about certain decisions made by computer programs using personal information. Our guide covers APP 1.7 to 1.9 in plain English. This is general information, not legal advice.
It applies to APP entities, which generally includes businesses with annual turnover above A$3 million and some smaller businesses, such as health service providers. Check your situation with a legal adviser.
No. We handle the technical side: finding, documenting and improving automated decisions in your systems. Your lawyer or privacy adviser confirms your obligations and the wording of your policy.
Broadly, decisions made by a computer program, or where a program does something substantially and directly related to making the decision, that could significantly affect someone's rights or interests. Your adviser can confirm how this applies to you.
Yes. Knowing where your systems make decisions about people is useful for privacy, customer trust and maintenance, whether or not the new rules apply to you.
Find out where your systems decide for you
We will help you map the automations that use personal information, so your privacy review starts with facts.
Custom software and automation projects typically start from A$2,500. Final pricing depends on the systems involved, complexity and scope. For a larger or more complex project, book an initial consultation.