Australia’s Privacy Deadline: Human Review May Still Count as Automation

From 10 December 2026, Australian APP entities must describe covered computer-assisted decisions in their privacy policies under the Privacy and Other Legislation Amendment Act 2024. The test applies when an entity arranges for a program to make a decision, or do something substantially and directly related to making it, using personal information about someone whose rights or interests could reasonably be expected to be significantly affected.

A staff member’s final approval does not automatically take the decision outside that obligation. DLA Piper’s analysis explains that a recommendation or ranking can remain in scope when it is a key factor in the human decision. The useful question is what the program actually contributes to the outcome, not whose name appears on the approval.

Which workflows meet the test?

Start by establishing whether the organisation is an APP entity. The OAIC’s Privacy Act overview identifies covered private-sector organisations and most Australian Government agencies as APP entities. Then examine each type of decision about a person, following the workflow from the program’s input to the eventual outcome.

1. Identify the decision. Name the outcome rather than the software product: progression to an interview, approval of a benefit, access to credit or suspension of an account. Refusing or failing to make a decision can count, as can an outcome that benefits the person.
2. Trace the program’s role. Determine whether the entity arranged for software to decide the matter or perform a step substantially and directly related to deciding it. A vendor-operated tool and a rules-based program can qualify; the test is not confined to AI.
3. Check whose information it uses. Identify the personal information about the affected individual used in that operation. Information held elsewhere by the organisation does not belong in this part of the assessment merely because it is available.
4. Assess the likely effect. Ask whether the decision could reasonably be expected to significantly affect the person’s rights or interests. Employment opportunities, housing, financial assistance and access to significant services are examples; the circumstances of the people affected matter.

The effect must be more than trivial. An account hold, for example, may be particularly significant for a person who depends on a rideshare service to reach work or medical appointments. By contrast, using a word processor to record a decision that a person has independently made does not make the program a substantial part of that decision.

When does human review still leave a decision in scope?

Measure the program’s influence, not the existence of an approval button. The OAIC’s APP 1 guidance points to staff reliance on an output, their ability and likelihood of overriding it, the output’s place in the workflow and how well they can understand its basis. Advisory output can be substantial when it is directly connected to the final decision.

In a recruitment workflow, a ranking that determines which applicants reach a shortlist may shape who receives an interview even if a hiring officer signs off. Likewise, a reviewer’s theoretical power to overturn an account suspension says little if staff rarely exercise it. An independent assessment of the full applicant pool could produce a different scope analysis; record what reviewers actually see and do before drawing that conclusion.

Look upstream of the final approval. A complaint triage system may determine which cases receive attention, while a risk score may strongly influence a later credit decision. The program’s output need not be labelled a final decision to have a substantial and direct connection to one.

Build an inventory around decisions, not products

Use a separate worksheet row for each decision type and workflow. One product can support several decisions with different inputs, human involvement and consequences. Conversely, several programs may contribute to the same decision. An internal inventory can preserve the detail needed to assess scope while giving the public policy a clear set of decision and information categories.

• Decision and effect: record the outcome, who is affected and why its effect may be significant.
• Program and responsibility: name the system or supplier, who arranged its use and who makes the final decision.
• Personal information: list the categories the program actually uses, noting sensitive information where relevant.
• Output and influence: record whether the program decides, ranks, recommends, flags or prioritises, where its output enters the workflow and how reviewers use it.
• Policy mapping: assign an understandable public category to the decision and mark whether it is made solely by software or substantially assisted by it.

Include established systems that will keep producing decisions after commencement: the law’s application provision covers later decisions even when the software arrangement or information predates the new obligation. Ask a supplier what its program uses and produces, then map that account against how staff use the output. Recruitment screening, account holds and complaint triage deserve attention because a program may filter a person’s case before a reviewer encounters it.

What must the privacy policy disclose?

For decisions that meet the test, the policy must describe the kinds of personal information used, the kinds of decisions made solely by programs, and the kinds of decisions substantially and directly assisted by programs. The OAIC’s disclosure summary sets out those distinct fields. A general statement that the organisation uses AI would leave the reader unable to identify the consequential decisions involved.

Model wording to adapt: “We use [actual categories of personal information] in [identified workflow]. Computer programs make [kinds of decisions made solely by programs]. Programs also [rank, recommend or flag] cases used by staff when deciding [kinds of decisions substantially assisted by programs].” Include a sentence only where the inventory shows that it describes the organisation’s practice.

Group similar workflows if the result remains meaningful to a reasonable person. Where a program uses sensitive information, such as biometric templates, identify that category clearly rather than hiding it within a broad label such as “identity information”. For a hypothetical stadium admission system, the policy should connect the information it actually uses to the kind of entry decision it makes or assists. Publish the revised policy for the commencement of the obligation and update the description when a workflow’s inputs, influence or decisions change.

Also read:

• Ramp vs Airbase: Review Scores Tie, but the Buying Process Does Not
• Character.AI vs Replika: Privacy Policies Do Not Tell the Whole Story
• Stormlikes TikTok Likes Review: How Does It Compare With Other Providers?