From 10 December 2026, Australian Privacy Principle 1.7 requires an APP entity to disclose its use of automated decision-making in its privacy policy. The obligation applies where three conditions are met: the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual's rights or interests; and the individual's personal information is used in the operation of the program. The obligation was inserted by the Privacy and Other Legislation Amendment Act 2024. The disclosure is a few lines in a privacy policy. The evidence behind it is not.
01 · What it requires
Australian Privacy Principle 1.7 is a disclosure obligation, not a design standard. It does not restrict which automated decisions a company can make. It requires an APP entity to disclose its use of automated decision-making where three conditions are met: the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about the individual is used in the operation of the computer program.
APP 1.7 commences alongside APPs 1.8 and 1.9. APP 1.7 is the trigger; APP 1.8 sets out what the privacy policy must contain, including the kinds of personal information used and the kinds of decisions made. The Office of the Australian Information Commissioner administers the obligation and publishes the primary guidance at the OAIC's APP 1 guidelines.
| Condition | What it means in practice |
|---|---|
| The entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision | Covers fully automated decisions and computer programs whose output feeds directly into a decision. The boundary of "substantially and directly related" is a focus of the OAIC's current consultation. |
| The decision could reasonably be expected to significantly affect an individual's rights or interests | Directed at decisions with real consequence for the individual, such as credit, insurance, employment or access to services, rather than trivial or internal operations. |
| Personal information about the individual is used in the operation of the computer program | The privacy limb. If no personal information is used in the program's operation, APP 1.7 is not triggered. |
02 · When it commences
APP 1.7 commences 10 December 2026. It applies to qualifying automated decisions made from that date, not retrospectively.
On 18 May 2026, the OAIC released an Issues Paper seeking submissions on how it should interpret the obligation. Submissions closed 15 June 2026. On 30 September 2026, the OAIC published its guidance in the updated APP 1 guidelines, under "Information relating to decisions made by a computer program" (paragraphs 1.35 to 1.77).
03 · The evidence layer
The disclosure names the automated decisions. It does not, by itself, prove which systems are making them, who is accountable for them, or what oversight exists. That is a separate record.
The Automation Report records part of it. The Workflows reading states the share of workflows with an automation component, by function. The Oversight reading covers policies, review and risk controls. For Australian companies, the Privacy Act is among the report's regulatory references.
Whether a specific decision falls within APP 1.7 is a question for the company's counsel. The report does not interpret the statute.
| The disclosure | The evidence behind it | |
|---|---|---|
| What it is | A few lines in the privacy policy naming qualifying automated decision-making | The record of which systems make decisions, who is accountable, and what oversight applies |
| Who produces it | The company, usually with counsel | Issued by an outside party, or assembled internally |
| When it is needed | By 10 December 2026 | Alongside the disclosure |
| Where it lives | The public privacy policy | On file with the company |
04 · Where the Automation Report sits
The report does not treat APP 1.7 on its own. On kn0w's reading, automated decision-making sits inside two of the six readings: Workflows and Oversight. A company preparing for 10 December 2026 can hold the report beside its privacy policy, so the disclosure and the record behind it sit together.
How each reading is made is published at kn0w.co/methodology. Report 000142 is a published example. The company and its readings are fictional.
05 · Frequently asked questions
Not until 10 December 2026. Before that date there is no APP 1.7 obligation to disclose against, though the Act inserting it was already passed in 2024.
Yes. The obligation applies to qualifying decisions made from 10 December 2026, regardless of whether the arrangement for the computer program was made before or after that date. Legacy systems are in scope if they make qualifying decisions after commencement.
Disclose. APP 1.7 requires disclosure only.
That is a legal determination and sits with the company's own counsel. This page describes the obligation and the evidence layer around it; it does not provide legal advice on scope.
The primary sources are the OAIC's APP 1 guidelines and the OAIC's Automated Decision-Making Issues Paper.
Published 24 August 2026. Updated 2 October 2026 for the OAIC's guidance of 30 September 2026. Verified against OAIC primary sources on 2 October 2026.