Does your organisation use software to help decide who receives support, which applicants progress or how services are prioritised? New privacy requirements may mean it is time to update your privacy policy.
From 10 December 2026, organisations required to comply with the Privacy Act 1988 (Cth) (Act) and Australian Privacy Principles (APP entities) will need to include additional information in their privacy policies about certain uses of computer programs in the decision-making. These changes to the Act can apply even where a person makes the final decision.
Generally speaking, APP entities are organisations with an annual turnover of $3M or more. However, there are a number of exceptions to this rule and charities and not-for-profits will need to determine at first instance if they are an APP entity.
What is changing?
The new requirements, in Australian Privacy Principles (APPs) 1.7–1.9, focus on transparency. They require APP entities to explain certain uses of personal information in computer-assisted decision-making through their privacy policies.
The requirements apply where all three of the following conditions are met:
- The organisation has arranged for a computer program to make a decision, or do something substantially and directly related to making a decision.
- The decision could reasonably be expected to significantly affect an individual’s rights or interests.
- Personal information about that individual is used by the program to make the decision or carry out that related task.
- It is not just about AI
The Office of the Australian Information Commissioner (OAIC) takes a broad approach to what counts as a “computer program”. Its guidance includes rule-based processes, artificial intelligence, machine learning, apps, word-processing tools and generative AI.
The recently released OAIC’s fact sheet gives a particularly useful example. A health and aged care provider uses spreadsheet formulas to score and rank people’s need for services. Staff then use those rankings to decide whom to contact and support. That use falls within the transparency requirements, even though it involves a spreadsheet rather than a sophisticated AI system.
Using software supplied by another organisation does not automatically take you outside the rules. Buying, configuring or relying on third-party software can also bring your organisation within scope.
A person making the final decision is not enough
The requirements can apply where software plays a substantial and direct role in a decision, even if someone reviews the output or makes the final call. The OAIC explains that the program’s contribution must be a key factor in the human decision-making and have a direct connection with the decision.
Organisations should therefore look at what happens in practice, rather than assume that a human approval step takes the process outside the rules.
Why this matters for charities and not-for-profits
The OAIC identifies several examples of decisions that may be particularly relevant to the sector, including:
- prioritising access to health or disability services;
- assessing eligibility for housing assistance;
- deciding who receives a scholarship, grant or other financial support;
- determining admission to education or training; and
- using recruitment software to assess candidates and make hiring decisions.
A decision does not need to disadvantage someone to be caught: a significant benefit can also qualify. The individual’s circumstances matter too. The OAIC notes that a decision may have a greater impact on a person experiencing vulnerability, an important consideration for organisations supporting people in need.
What needs to go in the privacy policy?
Where the requirements apply, the privacy policy must describe:
- the kinds of personal information used by the relevant computer programs;
- the kinds of relevant decisions made solely by those programs; and
- the kinds of relevant decisions for which those programs perform a task substantially and directly related to making the decision.
The explanation should be clear, meaningful and specific to your organisation. A general statement that “we may use AI” is unlikely to give people the information they need. There must be enough detail to explain how personal information is handled, without overwhelming readers with technical material.
What should organisations do now?
Before 10 December 2026, we recommend that charities and not-for-profits that are required to comply with the Act:
- Take stock of your tools. Ask service delivery, administration, recruitment and technology teams about software that makes, ranks, recommends or helps determine decisions about individuals. Include spreadsheets and third-party platforms.
- Review the guidance. Use the OAIC’s APP 1.7–1.9 Transparency Obligation Fact Sheet, accompanying flowchart and updated APP 1 Guidelines to assess your processes. The examples help explain just how broad the requirements can be.
- Ask suppliers questions. Find out what personal information their tools use and how their outputs contribute to your decisions.
- Update your privacy policy where needed. Allow time to prepare, approve and publish changes before the requirements begin. Review the policy again when your tools or processes change.
- How we can help
Unsure whether your organisation’s software is caught, or what your privacy policy should say? Our team can help you assess whether the new requirements apply and review and update your privacy policy to reflect your organisation’s activities in clear, practical language.
This article provides general information only and is not legal advice. Organisations should obtain advice about their particular circumstances.
Recent Comments