Mandatory Tools & Artefacts · Privacy Act stream
Updated Privacy Policy
Updated 2 Sept 2026
Under Schedule 2 to the Privacy Act, the APP 1 privacy policy becomes the public-facing artefact for ADM transparency through new APP 1.7–1.9. It must be updated before the 10 December 2026 commencement and kept current. The OAIC consulted on draft guidance to 15 June 2026 but had not published the final version as at September 2026 — the statutory wording is what you draft to.
Key obligations
- Add an ADM section listing the kinds of personal information used.
- Describe the kinds of decisions made solely by a computer program, or where a computer program substantially assists in making the decision.
- Specifically call out decisions that have a legal or similarly significant effect.
- Explain how individuals can seek information about, or challenge, an automated decision.
- Review and refresh whenever new ADM systems are introduced.
Key dates
- 15 Jun 2026OAIC guidance consultation closed; final guidance still pending.
- 10 Dec 2026Updated APP 1 privacy policy must be live.
Who is affected
- Every APP entity that uses or plans to use ADM with personal information.
- Includes vendors providing ADM as a service to APP entities — your customers will need disclosures from you.