New Australian privacy requirements start 10 December
Your business may already be using automated decision-making software without realising it.
From 10 December 2026, businesses covered by Australia’s Privacy Act 1988 (Cth) may need to disclose more information about how computer programs make or influence decisions affecting individuals. This isn’t just about artificial intelligence. Everyday systems used to screen job applicants, assess credit applications, rank candidates or recommend outcomes can fall within the new requirements.
The changes don’t mean businesses must stop using automation. Where the statutory conditions are met, however, businesses must explain certain uses of automated decision-making in their privacy policy (OAIC). For employers, recruitment agencies and other businesses that rely on software to process personal information, now is the time to review existing systems.
This guide explains who is affected, what types of decisions are relevant and the practical steps to take before the deadline.
Using applicant tracking or recruitment software? It’s not just AI tools. Ordinary applicant tracking and recruitment software that screens, ranks or filters candidates can potentially be covered by the new rules.
The key points in 30 seconds
The new obligations sit in APP 1.7 to 1.9 of Australian Privacy Principle 1, added by the Privacy and Other Legislation Amendment Act 2024. They apply to decisions made from 10 December 2026, including decisions made by software already in use, as there is no general grandfathering for existing systems. They cover ordinary software as well as AI. The new provisions primarily introduce privacy-policy transparency requirements rather than generally prohibiting automated decisions or prescribing how those decisions must be made. Existing privacy and other legal obligations continue to apply. The rules apply only when all three conditions in APP 1.7 are met. The OAIC published its guidance, a fact sheet and a decision flowchart on 30 September 2026.
Does your business need to comply?
These four questions are a screening guide based on APP 1.7, not a legal determination.
- Is your business covered by the Privacy Act? Businesses with annual turnover above $3 million generally are. Smaller businesses are generally exempt, but exceptions apply, including health service providers, certain businesses that deal in personal information, related bodies corporate of a covered business and Commonwealth contractors.
- Do you use software to make or materially assist decisions about individuals? Include rule-based software, third-party platforms, spreadsheets and AI.
- Does that software use personal information about the affected individual? Identify the information it actually processes.
- Could the decision significantly affect that individual’s rights or interests? Consider consequences for employment, housing, access to finance and similar outcomes.
If the answer to all four is yes, the disclosure obligation is likely to apply. A “no” or uncertain answer still needs checking against the legislation and any exemptions.
If you’re unsure whether your software is covered, the OAIC’s fact sheet recommends taking a cautious approach and including the APP 1.8 information in your privacy policy.
What is automated decision-making?
Under APP 1.7, the obligation applies when all three conditions are met:
- Arrangement. You have arranged for a computer program to make a decision, or to do something “substantially and directly related” to making it.
- Significance. The decision could reasonably be expected to significantly affect an individual’s rights or interests.
- Personal information. The program uses personal information about that individual.
In plain English, “arranged for” covers software you built, bought, configured or simply rely on. A program is “substantially and directly related” to a decision when it is a key factor in the outcome and has a direct connection to it (OAIC APP 1 Guidelines). A trivial preparatory step, such as working out someone’s age from their date of birth, may not be enough on its own. Under APP 1.9, the rules also cover a refusal or failure to make a decision, and decisions that may benefit or disadvantage the person.
The OAIC reads “computer program” broadly. It includes rule-based processes, spreadsheets, ordinary software, machine learning and generative AI tools such as chatbots.
Buying software from another company doesn’t transfer your privacy obligations to that supplier. The OAIC’s fact sheet says it generally expects the transparency obligation to stay with the business using the software. That matters for SMEs that outsource HR, payroll, finance and recruitment systems. Software providers are expected to give their customers enough information about how their products make decisions for those customers to meet their own obligations.
Five practical Australian business examples
These are illustrative scenarios, not OAIC determinations. Whether a particular system is covered depends on the actual software, the personal information it uses and the effect of the decision.
Recruitment: automated application ranking
A recruitment agency uses software that scores applications against a role’s requirements and automatically rejects those below a set score. Consultants only see the top-ranked applicants. The software either makes the decision itself or substantially determines the shortlist, it uses candidates’ personal information, and missing out on a job is a significant effect. This is a strong potential example.
This is consistent with the OAIC’s own guidance. Its fact sheet identifies recruitment software used to sort candidate profiles and make hiring decisions as a type of activity generally considered within scope.
Recruitment: human review where the software is incidental
An employer uses software that flags whether applicants have listed a forklift licence. A recruiter reads every application in full, checks the licence, speaks to referees and builds the shortlist on all of the evidence, often overriding the flag. The software’s contribution may not be substantial, so this decision may fall outside APP 1.7, depending on how the process works in practice.
Property: rental applicant scoring
Rental applicant scoring can be relevant where the score materially determines access to housing, for example where low-scoring applicants are never passed on to the landlord.
Finance: credit approvals and refusals
Automated credit approvals or refusals, including buy now, pay later checks at checkout, are strong potential examples because access to finance is a significant interest.
Marketing: ad targeting and lead scoring
Routine advertising targeting or CRM lead scoring is more fact-dependent and shouldn’t be treated as automatically reportable. It turns on whether identifiable individuals are affected and whether the outcome significantly affects them.
Recruitment, HR and employee information
Many businesses assume all recruitment-related information is covered by the employee records exemption. It isn’t. The exemption applies to some acts and practices of private-sector employers that relate directly to a current or former employment relationship and an employee record the employer holds. It plays out differently in three common situations.
For unsuccessful job applicants, the exemption does not apply simply because someone applied for a job, so software that screens or ranks applicants who are never employed is not covered by it.
For successful applicants who become employees, some records collected before employment may become exempt once the employment relationship exists.
For recruitment and HR providers handling another employer’s candidate or employee information, the provider cannot generally rely on that employer’s exemption.
Contractors need case-by-case consideration, depending on the actual working relationship and who holds the record. For labour hire and recruitment businesses, this is where the new transparency rules are most likely to matter.
What must your privacy policy disclose?
Where all three conditions are met, APP 1.8 requires your privacy policy to describe three things (OAIC fact sheet):
- The kinds of personal information used in the operation of those programs.
- The kinds of decisions made solely by a computer program.
- The kinds of decisions where a program does something substantially and directly related to the decision, such as scoring, ranking or recommending.
You describe categories in plain English, not individual algorithms, and you can group similar decisions together. Businesses do not need to publish their source code, confidential algorithms or trade secrets, and the law includes an exclusion for commercial-in-confidence information (OAIC APP 1 Guidelines). However, businesses should not assume that using commercially valuable software makes it confidential. The policy must still give meaningful descriptions of the relevant kinds of automated decisions and personal information.
The following is an illustrative example only. Businesses must ensure that any statement in their privacy policy accurately reflects the software they use, the decisions it makes or influences, and the personal information actually processed.
A hypothetical recruitment agency’s disclosure might read:
We use software to help assess job applications. It uses information you provide, such as your work history, qualifications, licences, location and availability, and compares it with the requirements of the role. For some roles, the software automatically declines applications that do not meet essential requirements, such as holding a required licence. For other roles, it ranks applications, and our consultants use those rankings when deciding who to shortlist. If you have questions about how your application was assessed, please contact our privacy officer.
Check that your APP 5 collection notices line up with the updated policy.
What if a human makes the final decision?
Having a person sign off on an automated recommendation doesn’t necessarily take the decision out of scope. The question is how substantially and directly the program influences the outcome. Genuine independent review can be relevant, including whether reviewers examine the underlying evidence and can realistically depart from a recommendation, but no particular checklist automatically creates an exemption (OAIC APP 1 Guidelines).
Compare a manager who approves every software-generated shortlist within minutes with the recruiter in the forklift licence example, who reviews each application in full. The first is unlikely to take the decision outside the rules. The second may. Keeping records of how reviews happen, and of when staff depart from a recommendation, helps show which situation applies.
Six steps to prepare before 10 December
These are recommended actions, not new legal requirements.
- List the systems that make or materially influence decisions about identifiable individuals, including software built into HR, finance, marketing and customer service platforms.
- Record the decisions, the kinds of personal information used and the people affected.
- Apply the three APP 1.7 conditions to each system and check any exemptions, including employee records.
- Note whether the software makes the decision alone or substantially assists a person who makes it.
- Draft the categories APP 1.8 requires and align them with your APP 5 collection notices.
- Publish the updated policy before 10 December 2026 and set up a review process for new or changed systems.
Frequently asked questions
Do I need to disclose ChatGPT or other generative AI tools in my privacy policy?
Only if the tool uses personal information to make, or substantially and directly contribute to, a decision that could significantly affect someone. Using AI to draft a newsletter is unlikely to qualify. Using it to rank job applicants could well be covered, depending on how much weight the ranking carries.
Does software we bought years ago count?
Yes. The rules apply to decisions made from 10 December 2026, regardless of when the software was bought or set up.
What happens if our privacy policy isn’t updated?
Failure to comply with applicable privacy requirements may result in regulatory scrutiny or enforcement action by the Office of the Australian Information Commissioner (OAIC). The regulatory response depends on the statutory provision breached and the circumstances. There is no automatic fine specifically for failing to include automated decision-making disclosures in a privacy policy. Businesses should ensure their policies meet the new requirements before 10 December 2026.
Are these the same as the other proposed privacy reforms?
No. Further Australian privacy reforms have been proposed, but they are separate from the automated decision-making transparency obligations that start on 10 December 2026.
Official sources and further reading
What should your business do next?
The new privacy requirements are a reminder that businesses need to understand not just what information they collect, but how that information is used to make decisions. For recruitment agencies, employers and HR teams, that means looking closely at applicant screening, candidate ranking, employee information and third-party software.
At SMS Personnel, we recognise the importance of responsible information handling throughout the recruitment and employment process. Businesses should review their systems and privacy policies before 10 December 2026 and obtain specialist privacy advice where required.
For more information about our recruitment and labour-hire services, contact SMS Personnel.
This article is general information only and is not legal advice. Information is current as at 20 October 2026.
