Automated decision disclosure checker
From 10 December 2026, privacy policies must describe software that makes or informs significant decisions about people. Check whether your hiring, rostering or pay tools are caught, and get draft wording.
Figures checked 5 November 2026. Free to use, no sign-in.
APP 1.7 check
Privacy policy disclosure
In scope from 10 December 2026
The three conditions in APP 1.7
- (a) Software makes the decision or does something substantially and directly related to it: Met
- (b) The decision could significantly affect someone’s rights or interests: Met
- (c) Personal information about the person is used: Met
Draft privacy policy wording
Decisions made or informed by computer programs
We use computer programs, including [describe the type, e.g. applicant screening software or rostering software], that use the following kinds of personal information: résumés, work history, qualifications and application answers.
Our staff use the output of these programs as a key factor when screening, ranking, shortlisting or rejecting job applicants. A person makes the final decision.
[Optional, only if you offer it; APP 1.7 does not require it:] You can ask how a decision about you was made and ask for a person to review it. Contact [privacy contact].
Edit the bracketed parts to match your software and process.
- From 10 December 2026, APP 1.8 requires the privacy policy to describe the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions they substantially and directly inform. It describes kinds of information and decisions, not each individual decision.
- This is a transparency rule. It doesn’t give people a right to have a decision reviewed or require you to notify each person. Discrimination, Fair Work and WHS law still apply to the decision itself.
General information, not legal advice.
How this works
APP 1.7 applies when (a) your business has arranged for a computer program to make a decision, or do something substantially and directly related to making it; (b) the decision could reasonably be expected to significantly affect a person’s rights or interests; and (c) personal information about the person is used in the program. The tool checks each condition from your answers.
It then applies two exemptions in the Privacy Act: the small business exemption (turnover of $3 million or less, s 6D) and the employee records exemption (s 7B(3)), which can cover decisions about current staff but never job applicants.
“Not sure” answers never produce an “in scope” result on their own; the tool tells you what to find out instead.
Legal basis
- Privacy Act 1988 (Cth) Sch 1, APP 1.7–1.9 (inserted by the Privacy and Other Legislation Amendment Act 2024)
- Privacy Act 1988 (Cth) s 6D (small business) and s 7B(3) (employee records)
- OAIC: APP guidelines chapter 1
Checked against these sources on 5 November 2026. Spotted a figure that looks wrong? Tell us.
Questions
When does the automated decision rule start?
10 December 2026. From then, an organisation covered by the Privacy Act must describe in its privacy policy the software it has arranged to make, or substantially and directly inform, decisions that could significantly affect people, where that software uses their personal information.
Does a human in the loop take us outside the rule?
Not necessarily. The OAIC says a decision can be in scope even when the software’s output is advisory or a person reviews it. What matters is whether the output is a key factor in the decision and directly connected to it. Using software only to write up a decision a person made is not captured.
Does it apply to small businesses?
Generally not. A business with annual turnover of $3 million or less is usually outside the Privacy Act, unless an exception applies, such as providing a health service and holding health information, or disclosing personal information for a benefit.
What about decisions about current employees?
A private sector employer’s handling of employee records, directly related to a current or former employment relationship, is exempt from the Australian Privacy Principles. That may take rostering, performance or bonus decisions about existing staff outside the rule. Job applicants are not employees, so decisions about them are not covered by that exemption.
What does the privacy policy have to say?
The kinds of personal information the software uses, the kinds of decisions it makes on its own, and the kinds of decisions it substantially and directly informs. These are described in general terms, as kinds of information and decisions.
Related tools
All toolsQuestions the calculator can’t answer?
Workfloor answers pay, award, leave and termination questions for your team, with the Fair Work Act section or award clause behind each answer.