15 October 2026
4 min read
#Data & Privacy, #Corporate & Commercial Law
Published by:
The Office of the Australian Information Commissioner (OAIC) has published guidance on the new automated decision-making (ADM) transparency requirements under the Privacy Act. This includes a practical framework for determining when disclosures are required in privacy policies. The new requirements commence on 10 December, leaving organisations little time to assess their systems and prepare for compliance.
In our previous article, we explored what the OAIC’s guidance means for government agencies. For agencies, the focus is often on administrative decision-making, transparency and accountability in exercising public functions.
For private sector organisations, however, the compliance challenge is somewhat different.
Businesses are more likely to encounter the new requirements through AI-enabled products, automated decision-support tools, analytics platforms, customer profiling, recruitment technologies, fraud detection tools, pricing algorithms and other data-driven technologies. The legal test is the same, but the practical focus for business is governance, vendor management, privacy disclosures and understanding where automated systems already influence decisions.
The new Australian Privacy Principle (APP) 1 transparency obligations require APP entities to disclose certain ADM practices in their privacy policies.
The obligation arises where:
The OAIC's flowchart highlights that a decision is only captured where the computer program is substantially and directly related to it and the decision significantly affects an individual's rights or interests. The OAIC also notes that organisations may remain responsible even where they rely on a third-party system. Entities that procure, configure, authorise, integrate or rely on third-party computer programs may still fall within scope.
Many organisations may assume these requirements apply only to sophisticated AI systems that make decisions without human involvement.
The OAIC's guidance suggests a broader approach.
A computer program may be ‘substantially’ related to a decision where it is a key factor in human decision-making, and ‘directly’ related where there is a direct connection between the technology and the decision.
As a result, organisations should not limit their review to fully automated decision-making systems.
Potentially relevant use cases may include:
The guidance also notes that decisions affecting an individual's access to goods, services or opportunities may affect their rights or interests, and that practices such as differential pricing can have significant effects on individuals.
For many organisations, updating the privacy policy may be the simplest part of the exercise.
The more difficult task is identifying where automated decision-making already occurs across the organisation.
Many businesses have adopted AI and automated technologies incrementally over several years. For example, HR teams may use recruitment platforms with automated filtering, marketing teams may use customer segmentation and profiling, finance teams may rely on risk scoring tools and customer service functions increasingly use AI-enabled recommendations and triage.
In some cases, there may be limited visibility across the organisation of how these technologies use personal information or influence decision-making.
The relatively short period before commencement means organisations should begin this review sooner rather than later.
Private sector organisations should consider the following priority actions:
1. Identify automated decision-making systems
Prepare an inventory of AI, algorithmic and decision-support tools that use personal information
2. Map out the decision-making processes
Assess whether outputs are used to make or materially influence decisions affecting individuals
3. Review third-party vendor arrangements
Seek sufficient information from suppliers to understand how personal information is used and how outcomes or recommendations are generated
4. Assess whether the new requirements apply
Consider whether the technology is substantially and directly related to decisions that significantly affect individuals' rights or interests
5. Update privacy policies
Review existing privacy policies and collection notices to ensure they accurately address any in-scope automated decision-making activities
6. Strengthen governance processes
Integrate automated decision-making assessments into AI governance frameworks, privacy impact assessments, procurement reviews and technology change management processes
7. Document your analysis
Maintain records of assessments and decision-making so that compliance positions can be demonstrated if required.
Although the new obligation results in a privacy policy disclosure requirement, the OAIC's broader message is that organisations should understand how automated systems are used to make or inform decisions affecting individuals.
For many organisations, this will be the first structured review of AI and automated decision-making technologies across the enterprise. Businesses that use the next few weeks to identify relevant systems, assess risks and strengthen governance are likely to be better positioned not only for 10 December, but for future privacy and AI regulatory developments.
Organisations using AI, algorithms or automated analytics to help decide who gets a job, product, service, opportunity, price or risk rating, should assess now whether the new ADM transparency requirements apply. With commencement on 10 December, the runway for compliance is short.
If you have any questions regarding your organisation’s requirements, please contact us here.
Disclaimer
The information in this article is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavour to provide accurate and timely information, we do not guarantee that the information in this article is accurate at the date it is received or that it will continue to be accurate in the future.
Published by:
