Free tool

Automated decision-making privacy policy generator (APP 1.7)

From 10 December 2026, organisations covered by the Privacy Act must explain in their privacy policy how computer programs use personal information to make decisions that significantly affect people. Screen your decisions and draft the wording here.

Runs in your browser. Nothing you enter is sent to AusGPT.

A guide, not legal advice. This tool helps you spot decisions that may be covered by Australian Privacy Principle 1.7 and drafts privacy policy wording. Whether a decision is covered depends on your facts. Have the result checked by a privacy professional or lawyer.

Step 1: Screen your decisions
Is your organisation covered by the Privacy Act (an "APP entity")?

Generally: Australian Government agencies, and businesses and not-for-profits with annual turnover over $3 million. Some smaller organisations are covered too, such as health service providers. The Privacy Act doesn't cover local, state or territory government agencies.

Do you make any of these decisions with help from a computer program?

These are based on examples the OAIC says would generally be in scope. Ticking one adds it to Step 2, where you can edit or remove it.

Now think about one decision at a time. APP 1.7 applies only if all three of these are true.

1. Does a computer program make the decision, or do something substantially and directly related to making it?

A computer program includes rule-based software, spreadsheets with formulas, AI and machine learning, and generative AI. "Substantially" means it is a key factor in the human's decision, such as scoring, ranking, recommending or flagging. Refusing or failing to make a decision counts too.

2. Is personal information about the person used when the program runs?

Personal information is information or an opinion about an identified person, or a person who is reasonably identifiable.

3. Could the decision reasonably be expected to significantly affect the person's rights or interests?

The effect must be more than trivial, and could be good or bad for the person. Examples include decisions about a benefit, rights under a contract, or access to a significant service or support. Consider people experiencing vulnerability.

Answer the three questions to see a screening result.
Step 2: Describe each decision

Add each kind of decision that may be in scope. Describe the kind of decision, not individual cases. You can group similar decisions.

Decision 1
How is the computer program involved?
Could the decision significantly affect a person's rights or interests?
Which kinds of personal information does the program use?

Shown only in the internal checklist, not in the privacy policy wording.

Up to 10 kinds of decision.

Step 3: Privacy policy details
What kinds of computer programs are involved? (optional)

General information only, not legal advice. Review the output with your own advisers before you rely on it.

This automated decision-making privacy policy generator helps you prepare for Australian Privacy Principle (APP) 1.7. From 10 December 2026, organisations covered by the Privacy Act that use computer programs to make, or substantially and directly help make, significant decisions about people using their personal information must describe those decisions in their privacy policy. Screen your decisions in Step 1, describe each one in Step 2, and the tool drafts privacy policy wording plus an internal checklist.

What APP 1.7 requires

Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024 adds APP 1.7 to 1.9 to the Privacy Act. The Act received Royal Assent on 10 December 2024, and Part 15 commences 24 months later, on 10 December 2026.

Under APP 1.7, your APP privacy policy must contain the information in APP 1.8 if all three of these are true:

  1. you have arranged for a computer program to make a decision, or to do something that is substantially and directly related to making a decision
  2. the decision could reasonably be expected to significantly affect the rights or interests of an individual
  3. personal information about that individual is used when the program makes the decision or does that related thing.

APP 1.9 adds that making a decision includes refusing or failing to make one, and that a decision can affect someone's rights or interests whether the effect is good or bad. Its examples include a decision under an Act or legislative instrument to grant or refuse a benefit, a decision affecting rights under a contract, agreement or arrangement, and a decision affecting access to a significant service or support.

What your privacy policy must say (APP 1.8)

Where APP 1.7 applies, your privacy policy must describe:

  • the kinds of personal information used in the operation of those computer programs
  • the kinds of decisions made solely by computer programs
  • the kinds of decisions where a computer program does something substantially and directly related to making the decision.

The generator's Part A follows these three items.

Key terms, as the OAIC reads them

The OAIC published its final guidance on 30 September 2026, including an updated APP 1 chapter of its APP guidelines, a fact sheet, a supplementary fact sheet for government agencies and a flowchart.

Term What the OAIC says
Computer program Includes pre-programmed rule-based processes, AI and machine learning, software, apps and word-processing tools, and generative AI. One of its examples is a spreadsheet formula that ranks clients for care.
Arranged for Includes in-house software, a third-party program you buy, configuring off-the-shelf software, and relying on advisory outputs from a program.
Substantially and directly related "Substantially" means a key factor in the human's decision making; "directly" means a direct connection with the decision. Advisory outputs can count.
Significantly affect More than trivial, with the potential to considerably influence a person's circumstances or outcomes. Vulnerability is relevant.

The OAIC's examples of decisions that would generally be in scope include recruitment software that sorts candidates, personalised pricing for significant goods, programs that prioritise health or disability services, eligibility for government benefits or housing, admission to education or training, loan and credit approvals, insurance eligibility, AI reports used to rank staff performance or decide pay, facial recognition for watchlist matching, and fraud detection that grants or denies account access.

How much detail to include

The OAIC's fact sheet says your wording should help people understand how their information is handled, without overwhelming them with technical detail. You may group similar decisions and kinds of personal information, but the result must be meaningful to a reasonable person, and the use of more sensitive information, such as health information or biometric templates, should be clear.

Commercially sensitive information and trade secrets about your programs are excluded, but the use of personal information to make these decisions is not commercial-in-confidence. If you use third-party software, the OAIC expects the obligation to stay with you as the organisation making the decision, and expects vendors to give you clear, high-level information about how their software can be used to make decisions.

If you're unsure whether a decision is in scope, the OAIC's fact sheet says to take a cautious approach and include it. The generator does this for answers marked "Not sure" and flags them in the checklist.

Timing and enforcement

  • The rules apply to decisions made after 10 December 2026, even if the program was set up, or the personal information collected, before that date.
  • The amending Act adds APP 1.7 to section 13K of the Privacy Act, a civil penalty provision for which the OAIC can issue infringement notices and compliance notices.

How to use this generator

  1. Screen your decisions. Tick the common decision types that apply and answer the three APP 1.7 questions for each decision you have in mind.
  2. Describe each decision. Say how the program is involved, what it does, and which kinds of personal information it uses. System names stay in the internal checklist only.
  3. Add details such as the kinds of programs involved and a contact for questions, then create the wording.

You'll get draft privacy policy wording (Part A) and an internal checklist with your screening answers, a table of every decision and a list of things to confirm before you publish (Part B).

For the rest of your AI governance, use the AI policy generator to set rules for staff, and the AI transparency statement generator if you want to explain your AI use publicly.

Use AI at work with your data kept in Australia

AusGPT gives your team Claude AI with conversations and documents stored and processed in Australia. $29 per user per month, with a free trial.

Start free trial How we keep data in Australia

Sources

  1. Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024 (Schedule 1, Part 15)
  2. Federal Register of Legislation: Privacy Act 1988
  3. OAIC: New resources on transparency for use of AI and automated decision making (30 September 2026)
  4. OAIC: APP 1.7-1.9 Transparency Obligation Fact Sheet (September 2026)
  5. OAIC: APP 1.7-1.9 Transparency Obligation Flowchart
  6. OAIC: APP guidelines, Chapter 1 (APP 1, open and transparent management of personal information)
  7. OAIC: Rights and responsibilities (who the Privacy Act covers)
  8. National AI Centre: Guidance for AI adoption: foundations

Frequently asked questions

When do the automated decision-making privacy policy rules start?
On 10 December 2026. APP 1.7 to 1.9 were added to the Privacy Act by Schedule 1, Part 15 of the Privacy and Other Legislation Amendment Act 2024, which commences 24 months after the Act received Royal Assent on 10 December 2024. The rules apply to decisions made after that date, even if the program was set up or the personal information collected earlier.
Who has to comply with APP 1.7?
APP entities, meaning organisations and agencies covered by the Privacy Act. That generally includes Australian Government agencies and businesses and not-for-profits with annual turnover over $3 million, plus some smaller organisations such as health service providers. The Privacy Act doesn't cover local, state or territory government agencies.
If a person reviews the program's output, is the decision out of scope?
Not necessarily. The OAIC says a decision can be in scope even where the program's output does not replace the whole decision or is reviewed by a person. A program is substantially related to a decision if it is a key factor in the human's decision making, and the OAIC considers machine learning or generative AI outputs used in significant decisions would generally be in scope unless subject to extensive human oversight and control.
Do we have to explain how our algorithm works?
No. APP 1.8 requires the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions where a program does something substantially and directly related to the decision. The OAIC says commercially sensitive information and trade secrets about your programs are excluded, but the fact that you use personal information to make these decisions is not.
Does APP 1.7 give people a right to challenge an automated decision?
APP 1.7 to 1.9 set out what your privacy policy must contain. They don't add a separate process for challenging decisions. Your existing complaint processes and other laws still apply, and the Guidance for AI Adoption recommends giving people affected by AI a way to raise concerns and challenge decisions.
Is anything I type into this generator sent to AusGPT?
No. The generator runs entirely in your browser. Your answers are saved only in this browser so you can come back to them, and Start again clears them.

Keep reading

AI governance AI policy generator Create an AI acceptable use policy for your staff in a few minutes. It follows the National AI Centre's AI policy template and six essential practices, with privacy rules based on OAIC guidance and extra clauses for your sector. AI governance AI transparency statement generator Draft an AI transparency statement in the structure the Digital Transformation Agency requires. Built for Commonwealth agencies, and easy to adapt for councils, universities and businesses that want to publish one voluntarily. Privacy law Automated decision-making and APP 1.7 From 10 December 2026, organisations that use software or AI to make, or substantially help make, significant decisions about people must say so in their privacy policy. Here is what APP 1.7 to 1.9 require, who they cover and a checklist to be ready. Privacy law Privacy Act reforms 2026 Australia's privacy reforms are arriving in two stages. The 2024 amendments are law, with the last major change starting on 10 December 2026. The tranche 2 exposure draft is still a proposal. Here's how to tell them apart and what to do now if your organisation uses AI tools. Privacy AI privacy impact assessment A guided privacy impact assessment for a proposed generative AI use. Describe the project, map the information flows, answer questions on the Australian Privacy Principles and get a structured draft PIA report with risks and recommendations. Security How AusGPT keeps data in Australia Where your data is stored and processed, and the controls that protect it.

Secure AI for your team, processed in Australia

Claude AI, document chat and voice dictation, with your data stored and processed in Australia. $29 per user per month.

Start free trial Talk to us