On 10 December 2026, APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals' rights or interests.
This transparency obligation was introduced by the Privacy and Other Legislation Amendment Act 2024 within APP 1 of the Australian Privacy Principles (APPs) to include information about computer program usage in an APP entities' privacy policy.
APP 1.7 requires APP entities to include the information outlined in APP 1.8 in their APP Privacy Policy if:
- the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making a decision (APP 1.7(a)); and
- the decision could reasonably be expected to significantly affect the rights or interests of an individual (APP 1.7(b)); and
- personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision (APP 1.7(c)).
APP 1.8 outlines the information which must be included in an entity's APP privacy policy if the conditions in APP 1.7 are met. This includes:
- the kinds of personal information used in the operation of such computer programs; and
- the kinds of such decisions made solely by the operation of such computer programs; and
- the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.
To assist entities, the Office of the Australian Information Commissioner has created targeted resources to support compliance and published an update to the APP 1 Guidelines. These resources are:
- APP 1.7-1.9 Transparency Obligation - Fact Sheet (PDF, 179 KB)
- Supplementary fact sheet for government agencies (PDF, 143 KB)
- APP 1.7-1.9 Transparency Obligation Flowchart (PDF, 246 KB)
The published resources reflect the feedback received from 90 written submissions during our consultation, from a diverse range of stakeholders including academia, civil society, government, industry, industry bodies, and other interested parties.
