- Live from
- 10 December 2026
- Instrument
- Privacy and Other Legislation Amendment Act 2024 (Cth), inserting APP 1.7-1.9 into the Privacy Act 1988
- Who it captures
- Every APP entity (generally organisations turning over more than $3 million, plus health providers and other prescribed entities) that arranges for a computer program to use personal information to make, or do something substantially and directly related to making, a decision reasonably expected to significantly affect an individual’s rights or interests. Hiring, credit, tenancy, pricing and eligibility decisions are the common ones.
- Penalty
- Serious or repeated interference with privacy: the greater of $50 million, three times the benefit, or 30% of adjusted turnover.
Every one of these has a due date. Missing one is not a judgement call — it is a diary problem.
- On every system changePrivacy policy review
- Quarterly, in practiceSystem inventory refresh
What has to happen, repeatedly
- Identify every system that uses personal information in a significant decision
- Keep the privacy policy accurate as those systems change
- Disclose the kinds of personal information used
- Disclose the kinds of decisions made solely by a program
- Disclose where a program does something substantially related to a decision
- Review whenever a system, a data input or a decision use changes
What you would have to produce
- A defensible inventory of automated systems
- The significance assessment for each
- A data map showing what personal information each uses
- Vendor documentation
- Privacy policy version history and change control
Start with these, and they’re free
- List every tool that scores, ranks, sorts or filters people. That list is most of the obligation
- Turn on version history for the privacy policy wherever it is drafted, so change control exists without extra work
- Add a step to your software procurement checklist asking whether the tool makes or assists decisions about people
This is general information about an obligation, not legal advice. Whether it applies to your firm, and how, is a question for your lawyer or your professional body.
Last reviewed 2026-09-09