Decision Inventory · Australian Privacy Act, APP 1.7 to 1.9

Your lawyers can't write the 10 December disclosure without this list.

From 10 December 2026, Australian businesses covered by the Privacy Act must disclose where software makes, or substantially helps make, decisions that significantly affect people. We map every one of those decisions inside your systems, in two weeks.

Book 30 minutes See what you get

10 Dec 2026Disclosure obligation starts

2 weeksFixed scope, agreed systems

24 NovLast start date for a 10 December handover

From A$14,500Fixed fee, plus GST

Any platformCustom, SaaS or low-code

The decisions are already in your systems. The list isn't.

Software that approves, prices, flags or blocks people rarely lives in one place. It sits in workflows, rules, scoring tools and integrations built over years, often by people who have since left. Before anyone can write the disclosure, someone has to find each decision and say what it uses.

Approvals and eligibility

Applications, accounts, admissions, access to a service

Pricing, fees and deposits

Personalised prices, security deposits, means-tested fees

Claims and refunds

Approving, rejecting or holding a claim or refund

Risk flags and blocks

Fraud scores, account holds, suspensions, collections

Applicant screening

Automated ranking, shortlisting and assessment scores

What you get

A written inventory of every place your systems make or shape a decision about a person, ready for your lawyers and your governance team.

Decision What is decided, in plain business words

System and location The system, module or workflow where it happens

Automation level Fully automated, software-recommended with human sign-off, or human-only

Personal data used The kinds of personal information that feed it

Effect on the person What changes for the customer or staff member

Owner The team accountable for the rule

Plus

A draft APP 1.8 disclosure schedule: the inventory sorted into the three things your privacy policy must cover, the kinds of personal information used, decisions made solely by computer, and decisions substantially assisted by computer. Ready for your counsel to review and finalise
A list of the decisions that meet the technical criteria (automated, uses personal information, affects the person), for your counsel to assess
A one-page guardrail checklist for any AI or agents that touch these systems next
A handover session with IT and legal

Two weeks, start to handover

Days 1 to 2

Kickoff

Agree the systems in scope, get read access, meet the owners.
Days 3 to 7

Read the systems

Walk the workflows, rules and integrations. List every decision and its data.
Days 8 to 9

Check with owners

Confirm each decision's purpose and owner. Flag what nobody can explain.
Day 10

Hand over

Inventory, draft APP 1.8 schedule and guardrail checklist, walked through with IT and legal.

From you: read access to the systems in scope, about two hours from each system owner, and one named contact.

One line from an inventory

Illustrative example, not a client record.

Sample inventory entry
Decision	System and location	Automation	Personal data	Effect	Owner
Hold a new customer account pending review	Customer portal, onboarding workflow, risk rule set	Fully automated; staff can release	Identity check result, address history, past payment record	Customer can't transact until released, typically one business day	Credit and collections

We supply the facts. Your lawyers make the legal calls.

The inventory shows what your systems actually do. Whether a decision must be disclosed, and the final wording of your privacy policy, stay with your counsel. We give them a draft APP 1.8 schedule to start from. Changes to systems are a separate engagement.

Read: The 10 December disclosure: the wording is the easy part

Why Hezico

We run live enterprise systems that people rely on every day, and AI is part of how we operate them
Senior architects only, reading your systems directly
We know the path an AI change takes through security review, data classification and change boards, and where each one stalls
Built for companies of roughly 300 to 5,000 staff, on any platform

Price

Fixed fee, agreed before we start. Prices exclude GST.

Core
A$14,500 Up to 6 systems, two weeks. Inventory, draft APP 1.8 schedule, guardrail checklist and handover.

Extended
A$24,000 Up to 15 systems or several brands, three weeks. Same deliverables, one schedule per brand.

Quarterly refresh
A$3,500 per quarter Re-check the systems that changed and update the inventory and schedule.

For law firms and privacy consultancies

Your clients need the facts before you can advise on the disclosure. We deliver the inventory and draft schedule under your name or alongside you, in Australia and Singapore, and you keep the advice. Partners get 20% off the fees above.

Questions we get

Does software we bought and configured count? It can. The OAIC has said that systems you buy and configure, not only ones you build, can fall within the rule. Vendor platforms, scoring tools and rules engines are all in scope for the inventory.

If a person signs off every decision, are we out of scope? Not necessarily. The rule also covers decisions where a program does something substantially and directly related to making the decision. A human approving a score the system produced is exactly what the inventory records, so your counsel can decide.

What happens if we miss 10 December? Privacy policies are an OAIC enforcement priority, and the OAIC can issue infringement and compliance notices. A dated inventory also shows you took reasonable steps, which matters if a regulator or customer asks.

Can we start after 24 November? Yes. You will finish after 10 December, so tell us early and we will prioritise the systems most likely to need disclosure first.

Do you have that list today?

Thirty minutes is enough to scope it. Tell us which systems decide things about your customers or staff, and we'll tell you what two weeks covers.

Book 30 minutes hello@hezico.com