Privacy Act: automated decisions
From 10 December 2026, privacy policies must explain where a computer program makes, or substantially helps make, decisions that could significantly affect people.
The changes come from the Privacy and Other Legislation Amendment Act 2024 and sit in Australian Privacy Principles 1.7 to 1.9.
Privacy policies must disclose#
- The kinds of personal information these programs use.
- The kinds of decisions made solely by a program.
- The kinds of decisions where a program does something substantially and directly related to making the decision.
The duty applies where a decision could reasonably be expected to significantly affect an individual's rights or interests, and personal information about that individual is used in operating the program.
In CognaOne#
| You need to | In CognaOne |
|---|---|
| Know which AI systems use personal information | Recorded on every system at registration |
| Know which systems make or substantially help make significant decisions | Screening questions, with a person confirming the answer |
| Describe the information used and the decisions made | Data sources, people affected and purpose in each profile |
Office of the Australian Information Commissioner (OAIC): automated decision-making transparency
This page is general information, not legal advice. Sources checked October 2026.
Last reviewed October 2026Suggest a change