Skip to content

Free tool

Privacy policy check: automated decisions

From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy when they use computer programs to make, or substantially help make, decisions that could significantly affect people. Answer six questions to see whether this is likely to apply to you and what to do next.

Your answers stay in your browser. Nothing is sent or stored.

  1. 01Is your organisation covered by the Privacy Act?

    Australian Government agencies are covered, as are most businesses with annual turnover above A$3 million. Some smaller businesses are covered too, including health service providers and businesses that hold a Commonwealth contract. State and local government agencies fall under their own state privacy laws instead, so answer no.

  2. 02Do you use a computer program to make decisions about individuals, or to do things substantially and directly related to making them?

    This includes AI tools, scoring or rules engines, and spreadsheets with built-in logic. Having a person review the result does not take a program out of scope.

  3. 03Could those decisions reasonably be expected to significantly affect someone's rights or interests?

    For example access to a service, a job, credit, a payment, a price or a benefit. Decisions that help someone count as well as ones that go against them.

  4. 04Does the program use personal information to do this?
  5. 05Do you have a list of these programs and the decisions they make or help make?
  6. 06Does your privacy policy already describe the kinds of personal information used and the kinds of decisions involved?

0 of 6 answered. Your result appears here when all six are done.

This check is general information, not legal advice. It is based on the Privacy and Other Legislation Amendment Act 2024 and the guidance on Australian Privacy Principle 1 published by the Office of the Australian Information Commissioner. Speak to a privacy lawyer about your own circumstances.