Australia AI Privacy Rules: New Disclosure Requirements from December 2026

Australia is introducing a new privacy policy disclosure requirement for certain automated decisions from 10 December 2026. Covered entities under the Australian Privacy Principles (APPs) must explain specified uses of personal information in computer programs when those programs make, or substantially and directly contribute to, decisions that could significantly affect an individual’s rights or interests. Businesses using AI or other automated systems should assess whether the requirement applies to them.

What changed?

The Privacy and Other Legislation Amendment Act 2024 introduced new transparency requirements into the Australian Privacy Principles. The Office of the Australian Information Commissioner (OAIC) confirms that the relevant obligations under APP 1.7 and APP 1.8 begin on 10 December 2026.

The change concerns what covered entities must disclose in their APP privacy policies. It does not automatically apply to every business using AI, nor does it prohibit automated decision-making.

The obligation applies when three conditions are met:

• The entity has arranged for a computer program to make a decision or perform an action substantially and directly related to making a decision.
• The decision could reasonably be expected to significantly affect an individual’s rights or interests.
• Personal information about the individual is used by the program in making the decision or performing the related action.

Where these conditions are met, the privacy policy must include specified information about the personal information used and the relevant types of decisions.

Before and now

Who does this affect?

The requirement applies to entities covered by the Australian Privacy Principles. It does not apply automatically to every business in Australia.

The change may be relevant to technology companies, SaaS providers, online platforms and other businesses that use personal information in automated processes. The key question is not simply whether a company uses AI. It is whether the statutory conditions for the disclosure obligation are satisfied.

For example, a business may use software to assess applications, rank individuals or determine eligibility for a service. If personal information is used and the resulting decision could significantly affect an individual’s rights or interests, the business should assess whether APP 1.7 applies.

Example scenario, not a real client: A software provider offers a platform that helps another business assess applications using personal information. The provider should identify its role in the processing and determine which entity has the relevant privacy policy obligations. The business making the decision should assess whether the system falls within the statutory criteria and ensure its privacy disclosures describe the relevant uses of personal information where required.

This example is illustrative. The legal outcome depends on the entities involved, their roles and the actual decision-making process.

When does the requirement take effect?

The new disclosure obligation takes effect on 10 December 2026.

The OAIC published guidance to help organisations understand the requirements and assess whether their privacy policies need updating.

Businesses should use the time before the deadline to identify relevant automated systems, understand what personal information those systems use and map the types of decisions they make or materially support.

The deadline does not mean every business must introduce a new AI system review process. The required work depends on whether the entity is covered by the APPs and whether its activities meet the statutory conditions.

What should a business do?

1. Identify automated decisions. Make a list of computer programs that use personal information to make decisions or substantially and directly contribute to them.
2. Assess the likely impact. Determine whether the decisions could reasonably be expected to significantly affect individuals’ rights or interests.
3. Map personal information. Identify the kinds of personal information used in each relevant program.
4. Review privacy disclosures. If the requirements apply, update the APP privacy policy to include the information required by APP 1.8.
5. Check responsibilities. Where a business uses an external platform or service provider, determine which entity is responsible for the relevant privacy policy disclosures.

Documents that may need updating

The main document affected is the APP privacy policy. Other records may help a business identify the relevant information and keep its disclosures accurate.

The OAIC’s guidance does not say that every business must rewrite every privacy-related document. Changes should reflect the systems used and the applicable legal requirements.

Businesses reviewing privacy notices can explore My Legal Pal’s privacy policy drafting service and data processing agreement drafting service.

What is still unclear?

The requirement depends on the facts of each organisation’s activities. The use of AI alone does not establish that the new disclosure obligation applies.

Businesses must assess whether they are covered by the APPs, whether personal information is used in the relevant computer program and whether the decisions meet the statutory impact threshold.

The requirement concerns privacy policy disclosures. It should not be described as a general prohibition on automated decisions or as a blanket requirement to publish source code, algorithms or model weights.

The OAIC’s guidance and the relevant APP provisions should be checked when assessing a particular system. Businesses should also distinguish the legal disclosure obligation from broader governance practices that may be useful but are not expressly required by this specific amendment.

Frequently asked questions

When do Australia’s automated decision privacy rules start?

The new disclosure requirements under APP 1.7 and APP 1.8 start on 10 December 2026. Covered entities should assess their automated decision-making activities and update their APP privacy policies where the statutory conditions apply.

Does the new rule apply to every business using AI?

No. The requirement applies to entities covered by the Australian Privacy Principles and only when the specified conditions are met. Businesses should assess the use of personal information, the role of the computer program and the likely effect of the relevant decisions.

What must a privacy policy disclose about automated decisions?

Where the requirement applies, the policy must describe the kinds of personal information used by the relevant computer programs, the kinds of decisions made solely by those programs and the kinds of decisions for which the programs substantially and directly contribute.

Does this law ban automated decision-making?

No. This requirement concerns transparency in APP privacy policies. It does not, by itself, prohibit automated decision-making. Businesses should separately assess any other laws that may apply to their systems or decisions.

Does a business need to change its privacy policy before December 2026?

A covered entity should review its privacy policy before the effective date and update it if the new requirements apply. A business that does not meet the statutory conditions should not assume that this specific obligation requires an amendment, although other privacy obligations may still apply.

Businesses that use personal information in automated decisions can contact My Legal Pal to discuss their privacy documentation and the requirements relevant to their operations.

Last reviewed: 23 October 2026