Source of Law / Policy · Privacy Act stream
Privacy Act 1988 (as amended 2024)
Regulator: OAIC · Legislation
LIVE / STAGEDUpdated 2 Sept 2026
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024 — the most significant overhaul of Australian privacy law since 1988. Its Schedule 2 inserts new APP 1.7–1.9, requiring privacy policies to explain the use of computer programs to make, or substantially assist in making, decisions that have a legal or similarly significant effect on an individual. That obligation commences 10 December 2026, so the transition period is now in its final months.
Key obligations
- Update your APP 1 privacy policy to disclose the kinds of personal information used in automated decisions, the kinds of decisions made solely or substantially by automated means, and the kinds of decisions where ADM has a legal or similarly significant effect on an individual.
- Identify which decisions are caught: those made solely by automated means, or where a computer program substantially assists in making the decision.
- Establish internal governance to inventory ADM systems and keep the policy current as systems change.
- Be ready to explain ADM logic on request and to handle complaints to the OAIC.
- Track the OAIC's ADM guidance — consultation closed 15 June 2026 and the final guidance had not been published as at September 2026. Do not wait for it before starting the ADM inventory.
Key dates
- 10 Dec 2024Royal Assent — Act commenced (reforms staged).
- 15 Jun 2026OAIC consultation on ADM transparency guidance closed.
- 10 Dec 2026ADM transparency obligations (APP 1.7–1.9) take effect — no further transition.
Who is affected
- All APP entities — most businesses with annual turnover > A$3M, plus all Commonwealth agencies.
- Smaller businesses caught by carve-outs (health service providers, credit reporting, contracted Commonwealth service providers).
- Any organisation using AI/ML to make or substantially contribute to decisions about individuals — credit, insurance, hiring, hardship, eligibility, fitness-for-work.
- Watch the next tranche: an exposure draft Privacy Amendment (Personal Data Protection) Bill 2026 was released for consultation on 31 August 2026. It is not law and creates no obligations yet.