Australia’s December 10 privacy changes: can you explain how your systems make decisions?

A customer applies for insurance. A candidate is shortlisted for a role. A person’s eligibility for a government service is assessed.

Behind each interaction, software may influence the outcome. But could the organisation explain where automation enters the process, what personal information it uses and which decisions it helps make?

From 10 December 2026, new requirements under Australian Privacy Principle 1.7–1.9 will require covered entities to include information about certain uses of automated decision-making (ADM) in their privacy policies. Introduced through the Privacy and Other Legislation Amendment Act 2024, the changes make transparency about these systems an explicit privacy obligation.

What changes?

The requirement applies to entities covered by the Australian Privacy Principles where three conditions are met:

• They have arranged for a computer program to make a decision, or perform something substantially and directly related to making it.
• The decision could reasonably be expected to significantly affect an individual’s rights or interests.
• The program uses personal information about that individual in doing so.

Where these conditions apply, the privacy policy must describe the kinds of personal information used, the kinds of decisions made entirely by computer programs, and the kinds of decisions for which programs perform a substantially and directly related task.

These requirements concern categories of information and decisions. They do not, by themselves, require an explanation of every individual outcome.

Existing systems also need attention. The changes apply to relevant decisions made after commencement, even where the software arrangement, information collection or processing occurred earlier.

A person making the final decision does not automatically remove the obligation

ADM extends beyond AI. Established software using predefined rules can also fall within scope.

Human involvement does not automatically exclude a process. The question is whether the program performs a task substantially and directly related to making the significant decision.

The Office of the Australian Information Commissioner (OAIC) describes this as a key factor in facilitating the human decision, with a direct connection to it. A system that ranks applications may meet that test. A word processor used only to record a decision already made would not.

Using a third-party platform also requires attention. The OAIC generally expects the transparency obligation to remain with the entity arranging for the relevant use, even where another organisation operates the software.

Everyday tools deserve attention too

Consider a spreadsheet that uses personal information to score people’s need for health services and rank who receives support. The OAIC includes this as an example of a process within scope.

The implication is practical: organisations should examine everyday operational tools alongside their newer AI platforms. The purpose of the tool, the information it uses and its role in the decision matter more than whether it carries an AI label.

Preparation starts inside the organisation

A privacy policy update should follow a clear understanding of how systems actually work. Here are 5 practical steps we recommend:

1. Map the decisions. Identify processes where software assesses, ranks, recommends, approves or rejects outcomes affecting people. Include existing business applications alongside newer AI tools.

2. Trace the information. Record which categories of personal information each process uses, where they originate and which suppliers handle them.

3. Assess each use case. Bring privacy, legal, technology and operational teams together to determine whether the statutory conditions apply. Examine how people use the system’s output and document the assessment.

4. Check supplier arrangements. Ask vendors what their systems do, how outputs influence decisions and how customers are notified of changes. Assign an internal owner for each relevant process.

5. Publish and maintain accurate disclosures. Use clear language grounded in verified practices, and revisit the policy when systems or workflows change.

These are practical preparation measures; the specific new legal obligation concerns the required privacy-policy disclosures.

For Australian Government agencies subject to the Freedom of Information Act, preparation should also account for existing Information Publication Scheme obligations. The OAIC suggests cross-linking relevant ADM disclosures with the privacy policy to help people find the information.

Transparency supports better modernisation

The deadline creates an opportunity to examine a broader operational question: how well does your organisation understand the technology influencing people’s lives?

Clear ownership, documented information flows and accurate public explanations give leaders a stronger foundation for deploying automation with confidence.

Teratek works with government and enterprise teams on secure digital modernisation. To prepare for December, bring your privacy, technology and operational teams around the same table, and map the decisions your systems influence.

Further Reading

• Privacy and Other Legislation Amendment Act 2024
• OAIC: Australian Privacy Principle 1 guidelines
• OAIC: ADM transparency obligation fact sheet
• OAIC: New resources on transparency for AI and automated decision-making