Privacy obligations requiring disclosure on certain automated decision-making to commence
New privacy obligations requiring disclosure of certain automated decision-making processes will commence on 10 December 2026. The Office of the Australian Information Commissioner’s (OIAC) final guidance confirms the requirements extend well beyond the truly ‘automated’ or AI driven decision and may capture a broad range of software, decision support tools and embedded technologies.
Organisations will be required under the new Australian Privacy Principles (APPs) 1.7-1.9 to include mandatory disclosures in the privacy policies on the use of personal information in automated or semi-automated decisions that ‘ significantly affect the rights or interests of and individual’.
The OAIC has released its final guidance on the new requirements, updating its APP 1 guidelines and releasing and APP 1.7-1.9 Transparency Obligation Fact Sheet.
To prepare for the changes by 10 December 2026, organisation should consider the following:
- conducting an audit of all automated decision-making processes
- assess third-party arrangements to determine the use of automated decision-making processes, and identify assess and manage how a third-party product or service using these processes is used to make recess decisions, and the type of decisions it makes
- review and update policies with the required information for meeting disclosure obligations
Disclaimer: This does not purport to be comprehensive or to render legal advice. You should not act based on any information contained in this publication without first obtaining specific professional advice. Consult your legal advisor to determine if this applies to you.