Australia’s December Privacy Rule Can Apply Even When a Human Makes the Decision

The Office of the Australian Information Commissioner (OAIC) released the guidance on 30 September, alongside an updated APP 1 guideline. The duty itself comes from the Privacy and Other Legislation Amendment Act 2024. It was enacted in 2024 and is due to commence in December, so the new development is the regulator’s detailed guidance, not the passage of a new law this week.

The trigger is a decision, its impact and the data used

The law’s APP 1.7 test has three parts. An APP entity must have arranged for a computer program to make a decision or do something substantially and directly related to making it. The decision must be reasonably expected to significantly affect an individual’s rights or interests. The program must use personal information about that individual in making or supporting the decision.

This is narrower than “we use AI”, but broader than a fully automated decision. The OAIC’s updated guidance reads “computer program” broadly, including rules-based and AI systems. A human final decision can still be covered if the program’s output has a substantial and direct role. Merely documenting a decision in software is different.

The guidance also says an APP entity can remain responsible when it arranges for a supplier’s program to make or assist the decision. Significance depends on the expected effect on the person, including their circumstances. A model name, industry label or human sign-off cannot settle that question alone.

What the policy needs to say

Where APP 1.7 applies, APP 1.8 requires the policy to describe the kinds of personal information used, the kinds of decisions made solely by programs, and the kinds of decisions for which programs do something substantially and directly related to making them. These are categories of data and decisions, not a demand to publish code or model parameters.

The law applies to decisions made after commencement, even if the software arrangement was made or the personal information was collected earlier. An existing tool therefore deserves review before 10 December if it will continue to influence decisions after that date.

Our operational reading: inventory decisions before tools

An AI-tool inventory will miss rules-based systems and will not show which decisions have a substantial effect on people. Start with the decision itself: what outcome is reached, who may be affected and which personal information enters the workflow. Then identify every program that produces a score, recommendation, ranking, approval or refusal used in that decision.

For each workflow, record what the human reviewer actually sees and can change. A nominal override button tells little about whether staff can challenge an output in practice. Sample real cases and document when a recommendation was followed or rejected. For a supplier-run service, obtain enough information about inputs and outputs to assess the decision path; a contract alone will not reveal its operational role.

Apply the statutory test to those records, then compare qualifying decisions with the current privacy policy. Group similar decisions and data types in language a reader can understand. Legal and privacy owners should review the scope and wording before publication. This is a practical preparation method, not a separate requirement imposed by APP 1.7.

The rule does not say that every AI use belongs in the policy. It asks whether software using someone’s personal information has a substantial part in a decision with a potentially significant effect on that person. That is the distinction the new OAIC guidance makes operational.

Primary sources

• OAIC announcement and new resources, 30 September 2026
• OAIC APP 1 guideline, version 2.0, updated 30 September 2026
• Privacy and Other Legislation Amendment Act 2024, commencement and Schedule 1 Part 15

This article is general information, not legal advice.