Automated decisions and your privacy policy: a checklist for law firms before 10 December

From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policy when software makes, or substantially shapes, decisions that significantly affect people. It isn’t only about AI, and a human sign-off may not take a tool out of scope. Here’s what’s changing, and five steps to check before the deadline.

What changes on 10 December 2026

New Australian Privacy Principles 1.7 to 1.9 start on 10 December 2026. In the OAIC’s words, from that date “APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals’ rights or interests.”

The obligation is triggered when three things are true:

• the organisation has arranged for a computer program to make a decision, or to do something “substantially and directly related to” making it;
• the decision could reasonably be expected to significantly affect an individual’s rights or interests; and
• personal information about that individual is used by the program to make the decision or do that thing.

The OAIC released its final guidance on 30 September 2026, including updated APP 1 guidelines, fact sheets and a flowchart.

What your privacy policy has to say

If the test is met, the privacy policy must describe three things:

1. the kinds of personal information used by those computer programs;
2. the kinds of decisions made solely by a computer program; and
3. the kinds of decisions where a program does something substantially and directly related to making the decision.

The guidance isn’t prescriptive. Commentators read it as allowing categories rather than technical detail, but expecting sensitive information, such as health or biometric data, to be called out more clearly.

Automated decision-making isn’t just AI

The test is “computer program”, not “artificial intelligence”. Allens reads the OAIC guidance as covering “rule-based tools, AI/ML, everyday software (including spreadsheets), and generative AI/chatbots”, and notes that simple, long-standing tools can be caught.

There is a limit. Gilbert + Tobin points out that using a word processor to record a decision, or a spreadsheet to do arithmetic, isn’t enough on its own. The question is whether the software produces something, such as a score, a ranking, a recommendation or a summary about a person, that feeds the decision.

A human in the loop may not be enough

Many firms will assume that because a person signs off, the software isn’t making the decision. That assumption is risky.

According to Allens, the guidance looks at factors such as how much the decision-maker relies on the output, how likely they are to override it, whether the output is advisory or determinative, and whether it can be explained. Allens’s reading is that where a program’s output is a material input into a decision, it should be captured “regardless of human oversight”.

What counts as a “significant” decision

The new principles give examples, including decisions that affect a person’s rights under a contract, agreement or arrangement, and decisions that affect their access to a significant service or support. The effect must be more than trivial, and it can be beneficial as well as adverse.

A five-step checklist for law firms

1. Confirm you’re covered. The obligation applies to APP entities. If your firm relies on the small business exemption, check whether it still applies to you.
2. List the software that touches decisions about people. Start with client intake and screening, matter acceptance, fee estimates, payment-plan or credit decisions, and recruitment tools. Include spreadsheets and rules built into your practice management system.
3. Run the three-part test on each. Does it use personal information? Does it make, or substantially shape, the decision? Could the decision significantly affect the person?
4. Describe kinds, not code. Update your privacy policy to set out the kinds of personal information used and the kinds of decisions involved, in plain words.
5. Keep the list alive. The obligation applies to decisions made after 10 December, even if the information was collected earlier. New tools, and new uses of old ones, need to be added as they arrive.

Why this matters beyond compliance

This is the first time Australian privacy law asks organisations to write down where software shapes decisions about people. It’s a transparency duty, not a right of appeal: it doesn’t give individuals a right to contest decisions or require you to notify them directly. But it moves the profession towards a principle lawyers already know well. If a decision matters, you should be able to explain how it was reached.

We think software that shapes outcomes should be able to show its working. That’s how we build JurisTechne: a glass box, not a black box, with every insight in a Strategy Intelligence Report traced to legislation, precedent and court reasoning. Read more about Algorithmic Law and who we help.

This article is general information, not legal advice. Check the OAIC’s APP 1 guidelines and get advice on your firm’s own position.