Broad, all roles
Privacy Act & AI
8 min read
Privacy Act 1988 and AI: what the reforms mean for your organisation
GP
Guru Prasad, Founder, AAAI. Published 29 September 2026.
From 10 December 2026, new Privacy Act 1988 provisions require organisations to disclose in their privacy policy when a computer program, including AI or machine learning, makes or substantially contributes to a decision that could significantly affect a person's rights or interests, and what personal information that decision used. The obligation was legislated in the Privacy and Other Legislation Amendment Act 2024 but only takes effect from that date, giving organisations using AI for hiring, credit, insurance or service eligibility decisions a fixed deadline to check what their privacy policy currently says, and fix it if it falls short.
In brief
- From 10 December 2026, amended Australian Privacy Principle 1 requires privacy policies to disclose the kinds of personal information used, and the kinds of decisions made, by computer programs, including AI and machine learning, where those decisions could significantly affect a person's rights or interests.
- This sits alongside, not instead of, Australia's AI Ethics Principles: the ethics principles' privacy protection principle is a voluntary standard, this new Privacy Act obligation is a legislated one with the OAIC behind it.
- The OAIC consulted on detailed guidance in 2026 and final guidance was still pending as this was written. The legislated deadline itself is fixed regardless of when that guidance lands.
Plain English
"Computer program" in this reform is defined broadly. It is not limited to AI or machine learning: the OAIC's own consultation materials describe it as covering pre-programmed rule-based systems, spreadsheet-based tools and generative AI alike. What matters for triggering the obligation is not the technology but the decision, does it use personal information, and could it significantly affect someone's rights or interests, for example a hiring outcome, a credit decision, an insurance premium or eligibility for a service.
"Solely automated" versus "substantially and directly related" is the other distinction worth knowing. The obligation covers both a decision made entirely by a computer program and one where a computer program does something substantially and directly related to a human's decision, for example generating the recommendation a manager then approves without real scrutiny.
Australian context
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Most of its changes, including a new statutory tort for serious invasions of privacy and new doxxing offences, took effect within their first year. The automated decision-making transparency amendments to Australian Privacy Principle 1 were deliberately given a two-year delayed start to give organisations time to prepare, and commence on 10 December 2026.
From that date, an APP entity that has arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information, must say so in its privacy policy: what kinds of personal information the program uses, and what kinds of decisions it makes. The OAIC opened a consultation on detailed guidance in 2026, which closed 15 June 2026, and has signalled it is reading the trigger broadly. Final guidance was still pending as this was written, but the 10 December 2026 deadline in the legislation itself is fixed regardless.
Sources: Privacy and Other Legislation Amendment Act 2024 (Cth); OAIC, Automated Decision-Making Transparency Obligation Issues Paper, 2026; OAIC, Chapter 1: APP 1, Australian Privacy Principles Guidelines.
The risk and the opportunity
The organisations most exposed here are the ones who assume "we don't use AI" settles the question. The obligation is written around computer programs and decisions, not around the word AI, and it explicitly captures generative AI tools, scoring models and even sufficiently automated rule-based software. An organisation using an AI screening tool in recruitment, an automated credit scoring model, or a claims triage system has very likely already triggered the obligation, whether or not anyone internally has called it an AI system. A privacy policy that says nothing about any of this past 10 December 2026 is not a grey area, it is a straightforward compliance gap.
The organisations in the best position are the ones already building toward Australia's AI Ethics Principles and the Guidance for AI Adoption's six essential practices, because the work overlaps almost exactly. An AI register that already names each system and who is accountable for it, the first essential practice, makes the privacy policy disclosure almost mechanical: you already know what personal information each system uses and what decisions it makes. Organisations starting from nothing in December 2026 will be doing under deadline pressure what organisations with a register did months earlier as a matter of course.
Getting ready before 10 December 2026
Inventory every computer program that touches a decision about a personNot just the ones your team already calls AI. Include scoring models, screening tools, chatbots that triage requests, and generative AI drafting recommendations a human then approves.
Test each one against the triggerDoes it use personal information, and could its decision significantly affect someone's rights or interests, employment, credit, insurance, or access to a service? Flag anything that clears both bars.
Draft the two required disclosures for each flagged systemThe kinds of personal information it uses, and the kinds of decisions it makes, in plain language a person affected by the decision could actually understand.
Update the privacy policy and set a review date before 10 December 2026Then repeat the inventory step whenever a new system goes live. This is not a once-off exercise.
What this means for you
Practitioners: HR, finance and consulting professionals working with AI day to day
If you run or oversee a screening tool, scoring model or AI-assisted recommendation that touches a real decision about a person, you are the one who can actually answer what personal information it uses, before December 2026 makes that answer mandatory.
Do this: list every AI or automated tool you personally use that feeds into a decision about a candidate, customer or client, and check whether it has been logged anywhere yet.
Directors and delivery leads
Your job is making sure the inventory step above actually happens across every team, not just the one that raised its hand first.
Do this: set 10 December 2026 as an internal deadline at least a month before the legal one, so there's still time to fix whatever the inventory finds.
CIOs and CEOs
This is now a fixed, legislated date with the OAIC's enforcement powers behind it, not a voluntary principle you can defer.
Do this: ask for a one page status update on the four-step inventory above, and treat "we don't think we use AI in decisions" as a claim to verify, not accept.
Frequently asked
When does the automated decision-making transparency obligation start?
10 December 2026. It was legislated in the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024, but this particular amendment to Australian Privacy Principle 1 was given a two-year delayed start to give organisations time to prepare.
Does this only apply to AI systems?
No. The obligation is written around computer programs generally, which the OAIC's consultation materials describe as covering pre-programmed rule-based systems and even spreadsheet-based tools, not only AI and machine learning. In practice, AI-driven scoring, screening and recommendation tools are exactly the kind of system this obligation was designed to catch.
How does this relate to Australia's AI Ethics Principles?
The AI Ethics Principles' privacy protection and security principle is a voluntary standard with no penalty for ignoring it. This Privacy Act amendment is a legislated disclosure obligation enforced by the OAIC. An organisation already working toward the ethics principles and the Guidance for AI Adoption's six essential practices will find most of the groundwork for this obligation already done.
Getting ahead of the 10 December 2026 deadline is exactly the kind of applied privacy and AI governance judgement AAAI's certifications are built to develop. If your organisation is only starting to map where AI touches decisions about people, AI Core is the place to start. If you're the person who needs to lead this work formally, CAIS: Certified AI Strategist goes deeper.
Explore AI Core
Explore CAIS
