The 10 December disclosure: the wording is the easy part

From 10 December 2026, every business covered by Australia's Privacy Act has to say in its privacy policy where software makes, or substantially helps make, decisions about people.

Most of the commentary so far is about how to word that disclosure. The wording is not the hard part. The hard part is knowing what is true about your own systems, because you cannot describe decisions you have not found.

This piece covers what APP 1.7 and the automated decision-making rules ask for, what counts, where the decisions usually hide, and what has to happen before anyone drafts a sentence.

This is a technical explainer, not legal advice. Your lawyers make the legal calls.

What changes on 10 December: APP 1.7 and automated decision-making

The Privacy and Other Legislation Amendment Act 2024 added three new clauses to Australian Privacy Principle 1, known as APPs 1.7 to 1.9. They apply to decisions made from 10 December 2026, even when the system or the personal data behind them existed before that date.

If a business uses a computer program to make a decision, or to do something substantially and directly related to making one, and the decision could significantly affect someone's rights or interests, its privacy policy must describe:

• the kinds of personal information used in those programs,
• the kinds of decisions made solely by the program, and
• the kinds of decisions where the program does something substantially and directly related to the decision.

It is a transparency duty. It does not ban automated decisions or require an impact assessment. It requires the privacy policy to be accurate. The OAIC published its final guidance on 30 September 2026.

The three tests

A decision is in scope when all three of these apply.

1. You arranged for a program to make it, or to substantially help make it. "Arranged for" matters. If you deployed a vendor's screening tool, the disclosure duty is yours, not the vendor's.

2. It could significantly affect someone's rights or interests. Access to a service, a job, housing, a price, an account, eligibility for something. Positive outcomes count as well as negative ones, and the effect can be more significant when the person affected is vulnerable.

3. Personal information is used in it.

What counts as a computer program

More than most teams assume. This is not an AI rule. Rules engines, scoring formulas, workflow automation, CRM logic and off-the-shelf software all count. The OAIC's own example is a spreadsheet formula used to score and triage people calling a crisis line: if that score is a key factor in the order people are helped, it is in scope.

Generative AI is in scope too, but most of the decisions a typical business needs to disclose were automated long before anyone said "AI".

"A human reviews it" does not take it out

This is the point that catches the most people. A person signing off at the end does not remove a decision from the rule if the software did the sorting, scoring or recommending that shaped the outcome. If the tool is a key factor in the human's decision, it is in scope.

So "we always have a person in the loop" is not a reason to skip the work. It is a description of half the decisions you will need to disclose.

Where the decisions hide

In most organisations of a few hundred to a few thousand people, decisions about individuals are spread across systems that were never designed to be described together:

• Approvals and eligibility: tenant and applicant approval, account opening, admission and enrolment, service eligibility.
• Pricing and fees: dynamic pricing, personalised offers, deposits, late fees, admin fees. The Explanatory Memorandum names differential pricing as one way targeting can become significant.
• Holds, flags and blocks: fraud holds, risk flags, access suspension after a failed payment, debt referral.
• Screening and ranking: applicant screening, shortlisting, matching, triage and prioritisation.

Each of these might live in a different place: a vendor platform, a rule someone added to a workflow in 2021, a nightly job, an integration between two systems, a spreadsheet an operations team relies on. Some arrived quietly through a vendor update.

The people who know about each one are rarely the people writing the privacy policy.

Why your lawyers need a list first

The law firms writing about this rule keep making the same point. Updating the privacy policy is the straightforward part. Finding where automated decisions already happen across the organisation is the difficult part.

A lawyer can tell you whether a decision crosses the threshold and how to describe it. They cannot see inside your systems. Without a factual list, the disclosure is either written from guesses or written so broadly that it says nothing, and lawyers advising on the rule warn that generic wording is unlikely to be enough.

The list has to come from the people who can read the systems.

What a decision inventory contains

For each decision point, a usable inventory records:

• the decision, in plain words,
• the system and the step where it happens,
• how automated it is: fully automated, or software substantially shaping a human's call,
• the personal information it uses,
• what happens to the person as a result,
• who owns it inside the business.

That gives counsel what they need to apply the three tests and write the disclosure at the right level of detail. It also gives IT and risk a single view they have usually never had.

After 10 December

The rule does not stop applying once the policy is updated. Every new vendor tool, workflow change or AI feature can add a decision. A privacy policy that is accurate in December can be wrong by March.

The organisations that cope best treat the inventory as a living record: owned by someone, updated when systems change, checked before new automation goes live.

Six weeks out

If your privacy policy does not yet describe automated decisions, the order of work is simple:

1. Find the decisions.
2. Let counsel apply the tests.
3. Write the disclosure from facts.
4. Decide who keeps it current.

Step one is the one that takes time, and it is the one we do. Hezico maps where your systems make decisions about people, across any platform, in two weeks at a fixed fee. We supply the facts. Your lawyers make the legal calls.

---

Sources

• OAIC, guidance on automated decision-making transparency (APP 1.7 to 1.9), released 30 September 2026.
• OAIC, ADM transparency issues paper, 18 May 2026 (spreadsheet triage example).
• Privacy and Other Legislation Amendment Act 2024 (Cth) and its Explanatory Memorandum.
• Hamilton Locke, "Transparency in automated decision-making: what regulated entities need to know and do before December 2026", 4 June 2026.
• Holding Redlich, "OAIC guidance and how private sector organisations can prepare", 15 October 2026.
• Thomsons Lawyers, "Opening the black box: new privacy rules for automated decisions".
• Gilbert + Tobin, "Automated decision-making transparency under the Privacy Act".