Find every decision your software makes about a person.
From 10 December 2026, Australian entities must disclose in their privacy policy the kinds of decisions made, or substantially assisted, by computer programs using personal information. The disclosure is the easy part. Knowing what to write is the work. This pack is the programme: find every decision, test it against the three limbs, and evidence the conclusion.
No email, no form, no account. Free to use, copy, and adapt inside your organisation, with no attribution required.
Why now
Why nowAPP 1.7 to 1.9 were inserted by the Privacy and Other Legislation Amendment Act 2024 and commence on 10 December 2026. The transition provision reaches back: the obligation applies to decisions made after that date even where the arrangement, the use of the personal information, or the information itself predates it.
The penalties are not nominal. An infringement notice for a non-compliant privacy policy runs to $66,000, the mid-tier civil penalty to $3.3m, and a serious or repeated interference with privacy to the greater of $50m, three times the benefit obtained, or 30% of adjusted turnover. The OAIC ran its first proactive sweep of privacy policy content in January 2026 and found a significant proportion non-compliant.
The OAIC's final guidance was still unpublished when this pack was issued. Almost nothing here waits on it. The statute, the commencement date, the transition provision, and the Explanatory Memorandum are settled; only the threshold edges are moving. Start now and treat the guidance as a reconciliation step, not a starting gun.
What is in it
Six tabs- 01
Plan
Sixteen weeks, sequenced backwards from commencement. Ownership, discovery, assessment, vendors, reconciliation, drafting, enablement, live.
- 02
Inventory
One row per decision, never per system. Fifty-one rows with drop-down lists, and the register everything else hangs off.
- 03
Assessment
The three limbs in order, with a five-factor rubric that scores the substantial test and bands the result in scope, borderline, or out.
- 04
Vendors
Six questions to every vendor whose product touches a decision, why each one matters, and the four contract provisions to hold out for.
- 05
Disclosure
What goes in the privacy policy under each limb of APP 1.8, the same fact drafted weakly and drafted well, and three tests before it reaches legal.
- 06
Reference
Primary sources separated by evidential weight: settled law, interpretive material, regulator positions still in motion, and comparative jurisdictions.
Four rules that decide whether it works
- 01
One row per decision
Never per system. A single platform commonly makes several decisions with different risk profiles, and a system-level row hides all of them.
- 02
Ask about the decision, never about automated decision-making
Nobody in HR or marketing thinks they run ADM. They will happily describe how applicants get shortlisted, which is the same thing.
- 03
Record the reasoning for out-of-scope calls too
Those are the ones you will be asked to defend. A contemporaneous note beats a reconstruction written after the guidance lands.
- 04
Track the override rate
It is your evidence on the substantial test. A recommendation staff depart from 4% of the time is a key factor, whatever the policy says.
Status and limits
Status and limits- Version 1.0, issued 20 August 2026
- Prepared by Reece Frazier. Tab 6 separates every source by evidential weight so you can see what is settled law and what is a regulator position still in motion.
- Guidance pending
- Four questions move scope: how broadly substantially-and-directly is read, whether human sign-off of generative AI output stays in, whether unseen advertising decisions count, and how firmly the arranged-for line is drawn. Re-test the borderline calls when the guidance lands, not the whole inventory.
- Not legal advice
- General information about a public obligation. Obtain advice on your own circumstances.
Get the pack
Get the packTake it, delete the worked example rows, and run it. If you are working through the inventory and want a second read on the borderline calls, or you want the discovery sweeps run properly across HR, marketing, and accounts payable, a short note describing the problem is more useful than a meeting request: reece@nomark.au.