What Counts as an Automated Decision Under the Privacy Act?

From 10 December 2026, Australian privacy law asks businesses a question most of them have never thought about.

Do you use a computer program to make decisions about people?

Note that the question is not “do you use AI”.

The law is wider than that. And the answer for most businesses is probably yes, in places they haven’t counted.

This post explains what the new rule requires, what “automated decision” actually means, and how to find the ones in your own business before the date arrives.

For the rule itself, its status and its dates, see the entry on our regulation map. This post is the practical companion to it.

What the rule says

The Privacy Act was amended in December 2024. Most of the changes started in 2025. The automated-decision rule was given two years, and that period ends on 10 December 2026.

From then, if your business is covered by the Act and uses a computer program to make a decision, or to do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect a person’s rights or interests, your privacy policy has to say so.

Specifically, it has to say what kinds of personal information the program uses, which decisions it makes on its own, and which decisions it substantially informs.

This is a transparency rule. It doesn’t ban anything, and it doesn’t yet give people a right to challenge a decision. It requires you to find the decisions and describe them.

The privacy regulator published its guidance on 30 September 2026, ten weeks before the date, and it reads the rule broadly: spreadsheets and rules engines count, and a person signing off does not take a tool out of scope.

What “automated decision” actually means

There are three key terms in the rule, and each is wider than it looks:

“Computer program.” Not just AI. A rules engine, a scoring formula in your CRM, a spreadsheet macro that flags accounts, a vendor’s software that ranks applicants. If a program produces the decision or a substantial input to it, it counts.

“Substantially and directly related.” The program doesn’t have to make the final call. If a person signs off on what the program recommends without really changing it, the program is substantially involved. The test looks at what actually drives the outcome, not at who clicks the button.

“Significantly affect rights or interests.” Who gets a loan, a job interview, a tenancy, a service, a refund, a price. Who gets flagged for review. Who gets excluded. A decision includes a refusal: the order declined, the application not progressed. If a person would care about the outcome, assume it’s significant.

While the technical phrase is “automated decision-making”, the bottom line is this: if software is deciding things about people, you’ll need to clearly articulate what it’s doing in your privacy policy.

Why this may be trickier than it seems

The automated decisions businesses know about are easy to flag: a lender’s credit scoring. A recruiter’s screening tool.

The ones that may catch people out are features that arrived inside software they already use.

The applicant tracking system that ranks CVs before anyone reads them. The fraud check that declines an order. The eligibility rule in a booking system. The AI feature in a property management tool that scores rental applications.

In the conversations I’ve had with business owners, many are a bit vague about what software their businesses and staff actually use and what it’s actually doing. This change makes finding out a priority, and the date makes it an urgent one.

What this means for your business

You have to find the decisions before you can describe them. The privacy policy paragraph is the easy part. The work is the list: every place a program decides or ranks or flags something about a person. For most businesses that’s an afternoon of asking each team what their software does automatically.

Vendor features count as yours. If the software you pay for makes the decision, you’re the one using a computer program to make it. The vendor’s documentation will tell you what the feature does. Your privacy policy is where it has to be described.

The date is fixed, and it’s close enough to start. A business that lists its automated decisions now has eight weeks to write three honest sentences. A business that discovers them in December has a scramble.

One thing to do this week

Ask each team one question: “What does our software decide, rank, score or flag about a person without someone doing it by hand?”

Write the answers in one place, with the tool, the decision and the kind of personal information it uses.

If the list is empty, that’s a finding worth keeping. If it isn’t, you’ve just found the content of your December privacy policy update.

The point

Software has been making decisions about people for years. What’s new is that the law now requires you to know where, and to say so.

That’s a list you’d want anyway. A decision nobody has noticed is a decision nobody is checking.

So the register records, for each tool, whether it decides or informs decisions about people, and what personal information it uses to do it. That line is what lets you answer the regulator’s question in December, and a customer’s question any time before.

Further reading

• The automated decision-making entry on our regulation map, with the dates and what we recommend.
• The Privacy Act entry on the map, for whether the Act covers your business at all.
• The checklist post, question 5 (what happens when it’s wrong), for where the human check belongs once you’ve found the decision.
• OAIC, APP 1.7 to 1.9 Transparency Obligation fact sheet, flowchart and updated APP 1 Guidelines, published 30 September 2026.
• Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1, the amendments to Australian Privacy Principle 1.