AI & Privacy Compliance Pack — Automated Decisions (APP 1.7)
From 10 December 2026, businesses covered by the Privacy Act must explain in their privacy policy when software or AI makes, or substantially and directly helps make, decisions that could significantly affect people. Tell us what your systems do and this pack works out whether the rule applies to you, lists every automated decision in a register, and writes the privacy-policy wording the rule asks for, plus a checklist for your vendors and staff.
From 10 December 2026, Australian Privacy Principle 1.7 asks businesses covered by the Privacy Act to say in their privacy policy when a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect a person, using that person's information. The regulator reads "computer program" broadly — rule-based software, AI and machine learning, chatbots and everyday apps — and says human review does not by itself take a decision out of scope.
This pack does the work in one sitting. You describe the systems you use and what they decide; it checks each one against the three APP 1.7 conditions, builds a register of your automated decisions, and writes the privacy-policy section covering exactly the three things APP 1.8 requires. If you give us your current privacy policy link, it reads the live page and tells you where the new section goes. Not sure if the rule touches you? Start with our free automated-decisions privacy self-check (four questions, no sign-up).
What the pack covers
Coverage first: whether the Privacy Act applies to your business, based on turnover and the categories covered regardless of turnover (such as health service providers and businesses that trade in personal information). Then a system-by-system assessment, a register you can keep up to date, the policy wording, a checklist for vendors whose software you have "arranged for" — the regulator's examples include AI tools that screen job applicants and software that auto-approves refunds — and a dated action list for the weeks before 10 December 2026.
Who it is for
Lenders and brokers, insurers, recruiters, clinics and allied health, property managers, online stores with automated refunds or account suspensions, and any business using software or AI to approve, decline, rank, score or filter people. It is written for business owners, not lawyers, and it is a starting point to review with your adviser — not legal advice.
What you get
- Does APP 1.7 apply to you? A reasoned assessment per system
- Automated-decision register (system, decision, personal information, human review, in scope)
- Ready-to-paste privacy policy section covering the three things APP 1.8 asks for
- Vendor and contract checklist ("arranged for" third-party systems)
- Staff and review-cadence checklist before 10 December 2026
- Free AI revisions included
Turnaround: ~15 minutes. Delivery: On-page + Markdown download (print to PDF).
Frequently asked questions
Is this legal advice?
No. It is general information and draft wording built on the regulator's published guidance, for you to review with your lawyer or adviser before publishing.
What if a person reviews the AI result?
The regulator says a decision can still be in scope when a computer program's output is reviewed by a person or does not replace the whole process. The pack records the review step in your register either way.
We use a vendor's software. Is that our responsibility?
Usually yes. If your business arranged for a third-party program to make or help make the decision, the obligation generally stays with you. The vendor checklist tells you what to ask and record.
What do I need to provide?
Your business details and turnover band, the systems or AI tools you use and what they decide, the kinds of personal information they use, whether a person reviews the result, and optionally your current privacy policy link.
Is the A$149 a one-off?
Yes, one-off with free AI revisions. If the result is genuinely unusable, you're covered under Australian Consumer Law.