Image: Pexels, used under the Pexels License.
This is for businesses covered by Australia's Privacy Act (the Act calls them APP entities) whose software scores, ranks, approves or rejects people. From December 10, 2026, your privacy policy has to say so. The rule is APP 1.7, added to the Australian Privacy Principles by the Privacy and Other Legislation Amendment Act 2024 (No. 128, 2024).
Evergreen template, not a news item. Checked against the Act and the OAIC's September 2026 guidance on October 26, 2026.
The rule is short. The OAIC's 11-page fact sheet that explains it is not, and its examples reach a long way: a spreadsheet formula that ranks clients counts, and so does a generative AI tool whose bonus suggestions a director signs off. Below is the test, the tools that usually trip it, and a section you can paste into your policy today.
First: are you an APP entity at all?
Skip the rest if you aren't. The OAIC says most small businesses are not covered by the Privacy Act, and "a small business is one with an annual turnover of $3 million or less." Two catches:
- The test is whether turnover went over $3,000,000 in any financial year since 2002, not just last year.
- Some businesses are covered regardless of turnover. The OAIC's list includes health service providers, businesses trading in personal information, contractors providing services under a Commonwealth contract, businesses related to a covered business, and businesses that have opted in.
If you're under the line and on none of those lists, we'd still keep the inventory below. It costs an afternoon, and you'll want it the day your turnover or your customer list changes.
The three-part test in APP 1.7
All three have to be true. The text is in Schedule 1, Part 15 of the Act:
Screenshot: Privacy and Other Legislation Amendment Act 2024, Schedule 1, Part 15, page 60 (Federal Register of Legislation, authorised version C2024A00128). Captured October 26, 2026.
| Limb | What the Act says | The question to ask | What trips people up |
|---|---|---|---|
| (a) | You "arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision" | Does software decide, or produce something a person relies on to decide? | Buying a SaaS tool counts as arranging. So does a spreadsheet formula. Only using a word processor to write up a human decision doesn't. |
| (b) | The decision "could reasonably be expected to significantly affect the rights or interests of an individual" | Could the outcome change someone's job, money, access to a service or contract? | It counts whether the effect is good or bad, and refusing or failing to decide counts as a decision. |
| (c) | Personal information about that person is used in the operation of the program | Does the program run on data about the person it's deciding about? | Names, addresses, CVs, video interviews and purchase history all qualify. |
Don't count on human sign-off as a way out. The OAIC says a decision can be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review." In its fact sheet it goes further: machine learning or generative AI outputs used in significant decisions "would generally fall within scope of the transparency obligation unless subject to extensive human oversight and control."
Which of your tools are probably in scope
The rows below come from the OAIC's own list of in-scope decisions and the worked examples in its fact sheet and APP 1 Guidelines. The right-hand column is our read for a small team.
| Tool or practice | OAIC position | Our verdict |
|---|---|---|
| Applicant tracking or screening tool that ranks or shortlists candidates | Listed: "recruitment software used to sort through candidate profiles and make hiring decisions". The Manscon example puts an AI video-interview screener in the policy. | In scope. This is the first row most teams will need. |
| AI that drafts performance reviews or suggests bonuses | Listed. In the Esperance example, a generative AI tool's bonus suggestions are in scope even though a director approves every decision in writing. | Probably in scope, but see the employee records exemption under "What we could not confirm". |
| Personalised or differential pricing | Listed for online retailers selling significant goods. | In scope if prices for essentials move with data about the buyer. |
| Credit, buy-now-pay-later or loan approval; fraud rules that block transactions | Listed (loan or credit). The Banksia example covers fraud tools that grant or deny transactions. | In scope. Fraud detection isn't confidential just because it's fraud detection. |
| Rules that suspend customer accounts | APP 1 Guidelines Example A: a rideshare program that can suspend a user's account. | In scope when a suspension cuts off a service people rely on. |
| Spreadsheet that scores and ranks clients for a service | The Wombat example: the ranking formula is in scope. | In scope. "It's only Excel" isn't a defence. |
| Ranking a human panel can ignore (scholarships, grants) | APP 1 Guidelines Example G: still in scope because the panel considers it. | In scope. |
| Insurance eligibility, health or disability service triage, facial recognition watchlists | All listed. | In scope. |
| Word processor used to document a human decision | Not captured (APP 1 Guidelines, paragraph 1.40). | Out. |
Not on the OAIC's lists: a support chatbot that only answers questions, spam filters, coding assistants. Run limb (b) on each. A chatbot that can refuse a refund is a different animal from one that links to the FAQ.
The template: "Decisions made by computer programs"
The OAIC's own samples use the heading "Decisions made by computer programs" and list kinds of information and kinds of decisions. APP 1.8 asks for three things, (a) to (c), and the Act lists decisions made solely by a program separately from decisions a program helps make. The OAIC samples don't split them. We'd split them anyway, since that's how the Act reads. Paste this into your privacy policy and replace the square brackets.
Decisions made by computer programs
We use computer programs, including [rules-based software / machine
learning / generative AI tools], to make or help make some decisions
that can significantly affect you. This section explains the kinds of
personal information those programs use and the kinds of decisions
involved.
1. Kinds of personal information we use
- Identity and contact information (for example, name, email, address)
- [Application information: CV, work history, qualifications]
- [Recorded interview responses, including video and audio]
- [Transaction, payment and purchase history]
- [Device and location information]
- [Sensitive information, named specifically: e.g. health information,
biometric templates such as face or voice data]
2. Decisions made solely by computer programs
These decisions are made by a program without a person reviewing
each one:
- [Granting or declining a transaction flagged as possible fraud]
- [Suspending an account after [trigger, e.g. missed payment]]
- [Setting the price shown to you for [product type]]
3. Decisions where a computer program does something substantially
and directly related to the decision
A person makes the final decision, but relies on a program's output:
- [Shortlisting job applicants: a program scores and ranks
applications and interview recordings]
- [Approving or declining applications for [credit / a service]:
a program produces a risk score]
- [Prioritising [clients / service requests]: a program ranks them]
Some of these programs are provided by third-party vendors. We remain
responsible for how they are used to make decisions about you.
If you want more information about a decision that affected you, or
about how we use computer programs to make decisions, contact
[privacy contact name or role] at [email / address].
Last updated: [date]
How to fill it in
- List every tool first, then fill the template. Walk through hiring, pricing, payments, customer accounts and staff management. For each tool, write down what it decides, what data it runs on and whether a person reviews each output. Our AI register template has the columns.
- Ask each vendor for a paragraph. The OAIC says vendors "should provide clear, high-level information about how their software can be used to make decisions", but it also expects the obligation to stay with the business using the information. FinTech Australia warned the OAIC this will be hard in practice: "technology vendors are unlikely to share necessary information to customers, as this may result in disclosure of proprietary and commercially sensitive information." Put the request in writing and keep the reply. If a vendor won't answer, describe what you can see from your side.
- Put each decision in section 2 or section 3 honestly. The OAIC's guidelines say "the higher the reliance" on an output, the likelier it is to be determinative rather than advisory; their example is a loan officer who "almost always follows" the program's recommendation. In the Esperance example, what could take a tool out of scope is real review: questioning outputs, checking the underlying data and "documenting the reasoning why it diverged from the" recommendation. If you don't do that, it goes in section 3.
- Group, but name sensitive data. You may group decisions and data types, as long as the result is "meaningful to a reasonable person". Where health information or biometric templates are used, the OAIC says "this should be clear". Don't hide face scans under "identity information".
- Leave out the weights, not the use. Commercially sensitive information and trade secrets are excluded. In the OAIC's Banksia example, how a fraud model weights data points can stay confidential, but the fact that personal information feeds fraud detection cannot. And the exclusion doesn't cover information that would only cause "ridicule, embarrassment or public criticism".
- Diary a review. The Australian Chamber of Commerce and Industry told the OAIC that this "is also not a one-off activity, as it will require continuous updating of the policy based on new software applications and new business activities". Re-run step 1 whenever you buy a tool that touches customers or applicants.
What happens if you skip it
Item 87 of the Act adds APP 1.7 to section 13K, the civil penalty provision "for which infringement notices or compliance notices can be issued". The maximum penalty under 13K is 200 penalty units, and the Commissioner can issue a compliance notice telling you what to fix. The rule applies to decisions made after commencement even if you set up the software before it, so a tool you bought last year is caught from December 10.
Screenshot: Privacy and Other Legislation Amendment Act 2024, section 2 commencement table, page 2 (Federal Register of Legislation). Captured October 26, 2026.
The OAIC published the fact sheet, a flowchart and updated APP 1 Guidelines on September 30, 2026, after a consultation that closed June 15 and drew 90 written submissions. The ACCI asked for exactly this kind of document: "templates and checklists, especially for the most common types of ADM applications (e.g. CV triaging)." The OAIC's examples come close, but they don't give you a section to paste.
Screenshot: Office of the Australian Information Commissioner, news release of September 30, 2026. Captured October 26, 2026.
What this template doesn't cover
APP 1.7 to 1.9 only change what your privacy policy must say. Nothing in Part 15 gives a person a right to opt out of an automated decision or to get an explanation of one. If you also serve people in the EU, GDPR Article 22 sets its own test for solely automated decisions; our Article 22 guide covers that side. US state rules on automated decision tools, such as Colorado's, are separate again.
What we could not confirm:
- Employee records. The OAIC lists AI reports that rank employee performance as in scope. Separately, it says a private-sector employer's handling of employee records "is exempt from the Privacy Act if it is directly related to your current or former employment relationship." The fact sheet doesn't explain how the two fit together. Job applicants who aren't hired are not employees, so screening tools stay in. For current staff, get advice before you rely on the exemption.
- Dollar amounts. We give the penalty in penalty units because we didn't confirm the current dollar value of a Commonwealth penalty unit from an official source on October 26.
- The flowchart. We couldn't open the OAIC's flowchart PDF, so nothing above relies on it.
Related Reading
- GDPR Article 22 and AI Tools: Automated Decision Rules
- Free AI Register Template for EU AI Act and Colorado Records
- AI Risk Register Template: Free, Scored and Pre-Filled
- AI hiring compliance for small teams: which laws apply
- AI Regulation Deadline Calendar: 2026 and 2027 Dates
- Colorado ADMT Comment Letter Template
- AI Data Retention Policy Template: What to Keep and Delete
