Free · Takes 2 minutes · Australian businesses
Does your Privacy Policy include how you use AI?
From 10 December 2026, Australian privacy law requires many businesses to describe the automated decisions they make about people. It is a disclosure obligation, not a ban — nobody has to stop using anything. Answer seven questions and we will check what your published policy currently says.
Counting down to 10 December 2026.
Your result includes:
Built around your answers and your actual published policy — not a generic checklist.
A straight answer on whether this reaches you
Including the honest one. A lot of Australian businesses are not covered yet, and we say so rather than manufacturing a warning.
The exact sentences in your policy
Where your policy does say something about automated decisions, we quote it back to you so you can judge the wording yourself.
The three things APP 1.8 asks for
Set out as a checklist against your situation. Most existing wording covers one of them at best.
The employee records distinction
Where it applies to you, we flag the line between job applicants and current employees — and are clear that it's a question for your lawyer, not one we answer.
Policy wording to start from
In the emailed version: a plain-language starting point for what a disclosure would need to cover, structured against all three limbs. A drafting aid for your legal review, not a policy.
Links to the actual law
The Act and the OAIC guidance, so you can check anything we've told you. Citing the source costs us nothing.
3 things we check
Based on the new sub-principles added to Australian Privacy Principle 1 by the Privacy and Other Legislation Amendment Act 2024.
01
Whether the obligation reaches you
The small business exemption is real and still stands. We ask about turnover and industry, because some industries are covered no matter how small they are — and for a lot of Australian businesses the honest answer is 'not yet'.
02
What decisions your software actually makes
Applicant screening, credit and pricing, who gets a service and on what terms. We ask what your business does, not whether you think you're compliant — and rules-based systems count as much as AI does.
03
What your published policy says today
We find your privacy policy, read it, and look for language describing automated decisions. We show you the exact sentences we matched, so you can judge them rather than take our word for it.
How it works
Give us your website
We look for your privacy policy at the usual addresses, then your sitemap, then the links on your homepage — and show you what we found before you answer anything.
Answer seven questions
About two minutes. Plain questions about what your business does, with 'Not sure' as a real answer that we handle honestly rather than treating as a no.
Get your result on screen
No email required to see it. Email it to yourself if you want the written version, which includes a starting point for what your policy would need to cover.
Built for Australian businesses
Particularly the ones using software to make decisions about people without thinking of it as AI.
- ✓Recruiters and HR teams using applicant tracking or screening tools
- ✓Lenders, brokers and insurers scoring, pricing or setting limits
- ✓Accountants, lawyers, conveyancers and agents coming under AML rules from 1 July 2026
- ✓Anyone whose 'simple scoring spreadsheet' quietly decides outcomes for people
- ✓Business owners who want to know whether this applies before paying someone to tell them
Common questions about the new obligation
Information only. This is not legal advice, and none of it tells you whether your business is compliant.
What is changing for privacy policies on 10 December 2026?
The Privacy and Other Legislation Amendment Act 2024 adds three sub-principles to Australian Privacy Principle 1. From 10 December 2026, an organisation covered by the Australian Privacy Principles must describe in its privacy policy the kinds of personal information used by computer programs that make or substantially shape decisions about people, and the kinds of decisions involved. It is a disclosure obligation, not a prohibition — nobody has to stop using anything, they have to say that they use it.
Does this only apply to AI?
No. The OAIC's guidance treats a computer program as covering pre-programmed rule-based processes, artificial intelligence and machine learning, ordinary software and apps, and generative AI including chatbots. Its first worked example is a spreadsheet with a scoring formula that ranks people for aged care contact, which is squarely in scope. If a spreadsheet decides who gets called, it counts.
Does having a human approve the decision take us outside the rules?
Not on its own. The OAIC says a decision can be in scope even where the program's output does not replace the whole decision-making process or is subject to human review, and whether the output is advisory or determinative. 'Substantially' means the program is a key factor in the person's decision-making. What does point the other way is genuine interrogation of the output: reviewing the underlying information, bringing other evidence, narrowing the program's parameters, and documenting why you departed from what it suggested.
Does my small business have to do this?
Generally not, if your annual turnover is $3 million or less — the small business exemption means most such organisations are not APP entities at all, and the second-tranche exposure draft does not remove it. There are exceptions that do not depend on turnover: health service providers holding health information, and reporting entities under anti-money-laundering law. From 1 July 2026 that takes in accountants, lawyers, conveyancers, real estate professionals, and trust and company service providers.
What exactly has to be in the privacy policy?
Three things, under APP 1.8: the kinds of personal information used by the computer program; the kinds of decisions made solely by automated means; and the kinds of decisions where an automated system plays a substantial and direct role. Most existing wording, where it exists at all, covers one of these at best.
Do beneficial decisions count, or only refusals?
Both. APP 1.9 makes clear that effects can be beneficial as well as adverse, and that refusing or failing to make a decision is itself making one. A system that automatically grants something is as much in scope as one that declines it.
What happens if a privacy policy does not comply?
A privacy policy that does not meet the APP 1 requirements is an administrative failure, and it sits in a much lower penalty tier than a serious or repeated interference with privacy. The two are often conflated, and the very large figures reported in the media belong to the serious-interference tier, not this one. The amounts in the lower tier are set in penalty units and are indexed, so we have deliberately not quoted a dollar figure here that could be out of date by the time you read it — the OAIC publishes the current amounts.
Does this cover decisions about our own employees?
Worth getting advice on, because there is real tension here. The employee records exemption has not been removed, and the second-tranche exposure draft does not remove it either. But the OAIC's list of decisions it considers in scope includes reports created by AI used to rank employee performance, determine promotions, or decide bonus and remuneration outcomes, and its worked example on this point is an employer using generative AI to set staff bonuses. Decisions about job applicants are a cleaner case, since an applicant is not yet an employee. Where the line falls for your own processes is a question for your lawyer.
Has the OAIC published guidance on this?
Yes. On 30 September 2026 the OAIC published a fact sheet on the APP 1.7-1.9 transparency obligation, a flowchart, a supplementary fact sheet for government agencies, and an updated Chapter 1 of its APP Guidelines. The guidance is not binding, but it sets out how the regulator reads the new rules, including what 'substantially and directly related' and 'significantly affect the rights or interests of an individual' mean in practice.
We use a third-party system. Isn't this the vendor's responsibility?
No. The OAIC's guidance says an entity has 'arranged for' a computer program where it uses in-house software, procures a third-party program, configures or customises off-the-shelf software, authorises a program to make a decision, or relies on a program's advisory output. The transparency obligation generally stays with the business using personal information to make the decision. The OAIC does say vendors should give their customers clear, high-level information about how their software makes decisions, so the practical step is to ask your supplier for that in writing.
Do we have to publish how our system actually works?
No. Commercially sensitive information and trade secrets are explicitly outside the obligation. The OAIC's own example is a lender that does not have to publish how its fraud model weights data points, but does have to say that it uses personal information to detect fraud and to approve or decline credit. The test is whether the information is unique to you and carries real commercial value, not whether publishing it would be awkward.
How much detail does a privacy policy need?
Enough to be meaningful to a reasonable person, and no more. The OAIC says to avoid overwhelming people with granular technical detail, and that organisations may group decisions and information into kinds. Its own worked examples run to about fifteen lines: a list of the kinds of personal information used, and a list of the kinds of decisions made with it. Where more sensitive information is involved, such as health information or biometric templates, that should be clear.
Does this tool tell me whether my privacy policy is compliant?
No, and it is not built to. It reports two things: whether the obligation is likely to reach a business that does what you say you do, and what your published policy currently says about automated decisions — quoting the sentences back to you so you can judge them yourself. Whether that wording is adequate for your circumstances is a question for your lawyer.
Sources
Intuitive IT is a Melbourne-based Managed IT Services Provider helping Australian businesses get more from their technology. We’re a Silver Microsoft Partner specialising in AI enablement, cybersecurity, and IT support — with all staff based in Melbourne.
Take the AI Readiness Assessment →