From 10 December 2026, APP entities are required to update their privacy policies to provide certain information where they use automated decision making. This is intended to provide individuals with greater transparency in relation to how their personal information is handled by organisations.
The Office of the Australian Information Commissioner (the OAIC) is currently undertaking a consultation process as part of its process for preparing guidance about the new automated decision making requirements.
New requirements
APP entities must disclose their use of automated decision making where it meets the following criteria:
- the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making a decision;
- the decision could reasonably be excepted to significantly affect the rights or interests of an individual; and
- personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.
Where an APP entity uses automated decision making as outlined above, they are required to include information into their privacy policy about the:
- kinds of personal information used;
- types of decisions made by the operation of the computer program; and
- types of decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of the computer program.
The kinds of automated decision making that will fall under the new requirements will be those that significantly impact individuals, such as determining whether an individual is eligible for a home loan, insurance policy, making decisions in relation to jobs/housing or where a decision impacts the individual's access to healthcare services or other significant services/supports. The OAIC's guidance note, once developed, will provide further examples of the OAIC's expectations on disclosure and the uses of automated decision making that will be captured under the new requirement.
Consultation
The consultation paper seeks feedback on several aspects of the requirements and how they might apply in practice, including the extent of disclosure expected from organisations and the scope and meaning of the following terms:
- 'computer program';
- 'substantially and directly related', which includes assessing whether a computer program substantially facilities and is directly connected to a decision;
- 'significantly affect rights or interests', which includes considering the factors increasing the likelihood of a decision impacting an individual's rights or interests, the classes of persons that may be vulnerable and what types of services or supports are significant;
- 'making a decision'; and
- 'arranged for'.
Next steps
Submissions to the OAIC's consultation have closed, and the OAIC intends to issue its guidance in relation to automated decision making requirements by September 2026.
Changes to any privacy policies or notices to address the new automated decision making requirements need to be implemented by 10 December 2026. Organisations should be assessing their current practices and systems now to identify possible instances of automated decision making and can factor in the OAIC guidance when it becomes available – the limited time between the expected release of the OAIC guidance and the compliance deadline means that delaying taking action until after the guidance will put meeting the deadline at risk.
Please contact a member of our team if you would like to discuss the new automated decision making transparency requirements further.
White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities.
This article is prepared for the general information of interested persons. It is not, and does not attempt to be, comprehensive in nature. Due to the general nature of its content, it should not be regarded as legal advice.
© 2026 White & Case LLP
