Privacy and data
Automated decisions: what your privacy policy must disclose
From 10 December 2026, an organisation covered by the Privacy Act must say in its privacy policy when it uses personal information in a computer program that makes, or substantially and directly helps make, decisions that could significantly affect people. Software that screens, scores or ranks job applicants is squarely in scope, and the employee records exemption does not cover applicants.
Updated . General information, not legal advice.
What changes on 10 December 2026?
New Australian Privacy Principles 1.7 to 1.9 start on 10 December 2026. They add automated decision information to the matters an APP privacy policy must contain.
The rules were inserted by Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024. Part 15 starts the day after 24 months from assent: 10 December 2026.
The rules apply to decisions made after that date, even if the software was bought, or the personal information collected, earlier. There is no grace period for tools already in use.
When does the disclosure rule apply?
It applies when all three conditions in APP 1.7 are met: you have arranged for a computer program to make a decision or do something substantially and directly related to making it; the decision could reasonably be expected to significantly affect someone’s rights or interests; and their personal information is used.
The OAIC’s APP 1.7–1.9 fact sheet (September 2026) reads these terms broadly:
- A computer program includes rule-based processes, machine learning, ordinary software and spreadsheets, and AI chat tools.
- You have arranged for a program if you built it, bought it, configured off-the-shelf software or rely on its advisory output.
- A program is substantially and directly related to a decision if it advises on, determines or otherwise influences the outcome. A decision can be in scope even where a person reviews the output.
- A decision includes refusing or failing to decide, and it counts whether the effect is adverse or beneficial (APP 1.9). Decisions affecting rights under a contract or arrangement are given as an example.
The OAIC says an entity in doubt about whether a program is in scope should take a cautious approach and include the information in its privacy policy.
What must the privacy policy say?
APP 1.8 requires three things: the kinds of personal information used by such programs, the kinds of decisions made solely by them, and the kinds of decisions where they do something substantially and directly related to the decision.
You describe kinds of information and kinds of decisions; you don’t publish algorithms. The OAIC says grouping is acceptable if the result is meaningful to a reasonable person, and that sensitive inputs such as health information or biometric data should be identified clearly. Commercially sensitive information and trade secrets about the program are outside the obligation.
| Policy element | Example wording topic |
|---|---|
| Kinds of personal information | Application details, CV content, answers to screening questions, assessment results, recorded interview responses |
| Decisions made solely by a program | Removing applications that don’t meet a stated essential requirement, such as a required licence |
| Decisions a program substantially assists | Ranking applicants for shortlisting, scoring assessments, recommending who to interview |
Which hiring tools are caught?
Recruitment software that sorts candidate profiles to make hiring decisions is on the OAIC’s list of decisions generally in scope, along with tools that score or rank applicants for a shortlist.
The OAIC’s examples include a tool that scores recorded video interviews and ranks applicants into a shortlist, and job advertising that targets candidates in a way that limits who sees the role. Common tools to check:
- automatic screening questions that reject applicants (knock-out rules)
- CV parsing that scores or ranks applicants against a job description
- psychometric, aptitude or game-based assessments that produce a score used in shortlisting
- recorded interview analysis and automatic interview scheduling that skips lower-ranked applicants
- AI tools a recruiter uses to summarise or compare candidates before deciding who progresses.
Disclosure is not a defence to discrimination. The Fair Work Act protects prospective employees from adverse action, including not being hired, because of attributes such as age, sex, disability or race, as the Fair Work Ombudsman explains. Check what a tool uses as inputs and test its outcomes.
Does the employee records exemption cover hiring decisions?
No. The section 7B(3) exemption covers acts directly related to a current or former employment relationship, so it doesn’t apply to job applicants.
For current employees, the exemption can apply to acts directly related to the employment relationship and an employee record, but it depends on the facts. The OAIC fact sheet lists AI reports used to rank employee performance, decide promotions or set bonuses among decisions generally in scope. Given its advice to take a cautious approach, many employers will describe these uses too. For how the exemption works, see employee records: privacy and security.
Do small businesses have to comply?
APP 1 binds APP entities only. A business with annual turnover of $3 million or less is generally exempt, unless an exception in section 6D(4) of the Privacy Act applies or it has opted in.
The exceptions include providing a health service, trading in personal information and contracting with the Commonwealth. A recruitment agency acting for you may be an APP entity in its own right. The OAIC expects the obligation to stay with the entity using personal information to make the decision, and expects software suppliers to give customers enough information to write their policy.
What should employers do before 10 December 2026?
Inventory every program that uses personal information to make or shape significant decisions, get the details from each supplier, and publish an updated privacy policy before 10 December 2026.
- List the systems used in recruitment, rostering, performance, pay and discipline, and note what personal information each one uses.
- For each, record whether it decides on its own, recommends, or ranks, and who acts on the output.
- Ask suppliers in writing what personal information their tool uses and how it influences outcomes.
- Draft a plain-English ‘decisions made by computer programs’ section covering the three APP 1.8 items.
- Update application forms and collection notices so applicants see the same information when they apply.
- Make sure a person with authority can review and override a program’s output, and keep records of how it is used.
- Set a review date so new tools are added to the policy before they go live.
If staff use general AI assistants in HR work, see using AI assistants with HR data.
Questions
When do the automated decision rules start?
On 10 December 2026. APP 1.7 to 1.9 apply to decisions made from that date, even if the program or the personal information predates it.
Does a human reviewing the result take a tool out of scope?
Not necessarily. The OAIC says a decision can be in scope even where the program’s output is subject to human review, if the program is a key factor with a direct connection to the decision.
Do I have to publish how my hiring algorithm works?
No. You must describe the kinds of personal information used and the kinds of decisions involved. Commercially sensitive information and trade secrets are excluded.
Does this apply to job applicants if I’m a small business?
Generally not if annual turnover is $3 million or less and no section 6D(4) exception applies. Discrimination laws still apply to every employer’s hiring decisions.
Sources
- Privacy and Other Legislation Amendment Act 2024, s 2 and Schedule 1 Part 15
- OAIC: New resources on transparency for use of AI and automated decision-making (30 September 2026)
- OAIC: APP 1.7–1.9 Transparency Obligation fact sheet (September 2026)
- Privacy Act 1988 (Cth), current compilation (ss 6D, 7B(3))
- OAIC: Employee records exemption
- Fair Work Ombudsman: Protection from discrimination at work
Checked against these sources on 5 November 2026. Spotted something out of date? Tell us.