Australia’s New AI Privacy Rules: A Practical Compliance Guide for Businesses

Australian organisations using AI and automated systems to make decisions about individuals have a new privacy obligation to prepare for. From 10 December 2026, changes to the Australian Privacy Principles (APPs) will require certain organisations to disclose specific information about automated decision-making in their privacy policies.

The requirement, introduced through the Privacy and Other Legislation Amendment Act 2024, is particularly relevant to businesses using personal information to assess applications, determine eligibility, manage accounts or influence access to services.

For organisations investing in AI, the challenge is understanding which systems fall within scope, what information must be disclosed and how to update existing privacy practices before the deadline.

This is not a requirement to stop using AI. It is a requirement to be more transparent about certain decisions involving personal information. Preparing now can help organisations identify relevant systems, review their data practices and make the necessary changes before the new rules commence.

What Are Australia’s Automated Decision-Making Privacy Rules?

The new requirements sit within APP 1, which covers the open and transparent management of personal information under the Privacy Act 1988.

From 10 December 2026, APP 1.7–1.9 will require APP entities to include additional information in their APP privacy policies when three conditions are met:

• The organisation has arranged for a computer program to make a decision, or perform an action substantially and directly related to making one.
• The decision could reasonably be expected to significantly affect an individual’s rights or interests.
• Personal information about the individual is used by the program in making the decision or performing the related action.

All three conditions must be considered together. The obligation is not limited to decisions made entirely by AI, and it is not triggered by every use of automation.

For example, using software to format a report is different from using a computer program to assess an insurance application or determine whether someone can access a significant service.

The new rules focus on transparency about qualifying decision-making processes, rather than introducing a blanket approval requirement for AI systems.

Which Automated Decisions Could Be Covered?

Organisations should look beyond tools explicitly labelled as AI. The rules refer to a computer program, so relevant systems may include conventional automated decision engines, rules-based workflows and AI-powered applications.

Examples worth reviewing include:

• Customer eligibility: Systems that assess applications for products, services or benefits.
• Insurance and financial services: Automated assessments that influence eligibility, coverage or contractual rights.
• Account management: Systems that suspend, restrict or terminate customer accounts.
• Recruitment and employment: Tools that assess applications or inform decisions affecting an individual’s employment interests.
• Service access: Automated processes that influence access to significant services or support.

These examples are not automatically covered in every situation. The organisation must assess the decision’s likely significance, the role of the computer program and whether personal information is used in the relevant process.

What Must APP Entities Disclose in Their Privacy Policies?

Where the conditions apply, APP 1.8 requires an organisation’s privacy policy to describe three categories of information.

1. The kinds of personal information used

Explain the categories of personal information used by the relevant computer programs. Depending on the system, this could include customer details, financial information, employment history or information about service usage.

2. The kinds of decisions made solely by computer programs

Identify the categories of decisions made entirely through automated operation, where these meet the relevant conditions.

3. The kinds of decisions informed by related computer-program activity

Describe the categories of decisions for which a computer program performs an action substantially and directly related to making the decision.

The objective is to provide meaningful information about how personal information is used in qualifying decision-making processes. A vague statement that an organisation uses AI or automated tools may not adequately describe the relevant practices.

How to Prepare Before 10 December 2026

Meeting the new transparency obligation starts with understanding where automated decision-making occurs across the organisation.

1. Build an Inventory of Automated Systems

• Identify applications, AI tools, business workflows and third-party platforms that use personal information to make or inform decisions.
• Involve business teams as well as IT. Some systems may have been introduced through individual departments or embedded within existing business applications without being formally classified as AI projects.
• Record each system’s purpose, the personal information involved, the decisions it supports and the relevant business owner.

2. Assess Which Systems Fall Within Scope

• Evaluate each use case against the three APP 1.7 conditions. Focus on the significance of the decision, the computer program’s role and whether personal information is used in the process.
• Document the rationale for including or excluding systems from the assessment. This will help establish a defensible record of the organisation’s review.

3. Map Data Flows and Responsibilities

• Understand where personal information originates, how it moves between applications and which vendors or service providers process it.
• For organisations using cloud platforms and AI services, clarify responsibilities for configuring systems, managing access, protecting data and maintaining accurate information about how applications operate.
• This assessment can also highlight existing data governance gaps that need to be addressed.

4. Review and Update the Privacy Policy

• Work with the organisation’s privacy officer and legal advisers to update the APP privacy policy where required.
• Ensure the disclosures accurately describe the categories of personal information used and the relevant types of automated and computer-program-assisted decisions. Review the policy alongside existing privacy notices and data-handling practices to identify inconsistencies.

5. Establish Ongoing Governance

• Treat the December deadline as part of a continuing privacy and AI governance programme, not a one-off documentation exercise.
• Assign responsibility for maintaining the system inventory, reviewing new AI use cases and updating disclosures when business processes change. Establish approval and review processes for new automated decision-making initiatives.

This helps ensure that future technology deployments are assessed before they introduce new privacy risks.

Why Choose Exigo Tech as Your Managed Intelligence Partner

Preparing for automated decision-making transparency requires coordination between data, technology, security and governance teams. Exigo Tech helps organisations assess their technology environments and establish practical foundations for responsible AI adoption.

Our relevant capabilities include:

• AI Governance and Readiness: Identify AI use cases, establish governance processes and clarify accountability for automated systems.
• Data Governance: Improve data visibility, classification and management using appropriate tools and processes.
• Microsoft Cloud and Security: Support secure configuration, access management and information protection across relevant business applications.
• Consulting and Managed Services: Help maintain technology environments, review changing requirements and improve operational practices over time.

As your Managed Intelligence Partner, Exigo Tech connects AI adoption with data readiness, security and ongoing governance, helping businesses build a more informed and sustainable approach to intelligent technology.