Automated Decisions and the Privacy Act | What Lenders Must Do by 10 December 2026
If your business uses computer programs in credit decisions or fraud checks, new rules start soon. From 10 December 2026, the automated decision making Privacy Act rules require you to explain these programs in your privacy policy.
This guide is for lenders, credit providers, non-bank lenders, fintechs and mortgage brokers. It sets out what the law says, what the Office of the Australian Information Commissioner (OAIC) says in its guidance, and the steps the law and the OAIC point to.
Key points at a glance
- Start date: the new rules commence on 10 December 2026 and apply to decisions made after they commence.
- Who: APP entities, which are organisations and agencies covered by the Australian Privacy Principles (APPs).
- What: your APP privacy policy must describe the kinds of personal information used by the relevant computer programs, and the kinds of decisions they make or substantially and directly assist.
- Human involvement: the OAIC says an output can still be caught where the human decision maker “relies on or is significantly influenced by” the program’s output.
- Enforcement: the Act adds APP 1.7 to the provisions for which infringement notices and compliance notices can be issued.
What are the new automated decision making Privacy Act rules?
The Privacy and Other Legislation Amendment Act 2024 added three new subclauses (1.7, 1.8 and 1.9) to Australian Privacy Principle 1. APP 1 deals with open and transparent management of personal information, including your APP privacy policy.
The Act received Royal Assent on 10 December 2024. The automated decision provisions commence 24 months later, on 10 December 2026.
The Act says the new rules apply to decisions made after they commence. This is regardless of when the arrangement for the computer program was made, or when the personal information was used, collected or created.
Which decisions are covered?
Under APP 1.7, your privacy policy must include the new information if all three of these things are true:
- you have arranged for a computer program to make a decision, or to do something that is substantially and directly related to making a decision;
- the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
- personal information about that individual is used in the operation of the program.
Under APP 1.9, making a decision includes refusing or failing to make a decision. The effect on rights or interests can be adverse or beneficial.
What counts as a computer program?
The OAIC’s APP 1 guidelines say the term takes its ordinary meaning. They say it includes “pre-programmed rule-based processes, artificial intelligence and machine learning processes”. The guidelines also say generative AI tools fall within the definition.
When is a program “substantially and directly related” to a decision?
The OAIC lists five factors to consider:
- degree of reliance on the computer program output;
- ability and likelihood of human override over a computer program output;
- nature of the output (advisory vs determinative);
- transparency and explainability of outputs available to the decision maker; and
- integration and complexity of the computer program into the decision-making workflow.
What is a “significant” effect?
The OAIC says the impact “must be more than trivial and must have the potential to considerably influence the circumstances or outcomes for the individual concerned”.
What must your privacy policy say?
Under APP 1.8, your APP privacy policy must describe:
- the kinds of personal information used in the operation of those computer programs;
- the kinds of decisions made solely by those programs; and
- the kinds of decisions where the program does something substantially and directly related to the decision.
The OAIC says the information should be “sufficiently specific to be meaningful, while avoiding overwhelming levels of detail”. It also says the information should be in plain language and structured to enable consumers to request further information, where required.
What the OAIC says about credit and fraud decisions
The table below sets out what the OAIC’s APP 1 guidelines say on topics relevant to lending. It does not apply the guidance to any particular business.
| Topic | What the OAIC says |
|---|---|
| Loan assessments | Example E: “A bank uses a computer program to assess loan applications. The loan officer relies heavily on the computer program’s risk score and almost always follows its recommendation.” The OAIC gives this example to illustrate the “degree of reliance” factor. |
| Banking and credit | The OAIC lists “access to essential banking and credit services” among the significant rights or interests generally considered in scope. |
| Fraud, scam and cybersecurity tools | The OAIC says an entity may use computer programs for fraud detection, scam identification and cybersecurity which may prevent access to significant goods or services. Its privacy policy may outline that it uses fraud prevention technologies that process personal information (such as identity information, geolocation data, biometric information and IP addresses) to decide whether to permit, flag or deny access to an account. |
| Human decision makers | An output can still be caught “where the human decision maker relies on or is significantly influenced by the computer program’s output”. |
| Third-party software | The obligation “typically remains with the APP entity who is using personal information” to make the decision. Entities “may still be required to comply with APP 1.7” where another entity provides the program under a contract. |
| Word processing | Where a human makes the decision and uses a program for other purposes, such as a word processing program to document a decision, this will not be captured. |
The OAIC’s APP 1 guidance does not specifically address credit limits, pricing, hardship processes or anti-money laundering checks. Whether the rules apply to these processes depends on the facts, so get advice.
Credit reporting, vendors and brokers
Credit reporting
Credit providers also have obligations under Part IIIA of the Privacy Act and the Credit Reporting Code. The OAIC’s APP 1 guidance does not specifically address how APP 1.7 interacts with those obligations. Get advice on how your privacy documents fit together.
Third-party software and vendors
The OAIC says APP entities “should actively identify, assess and keep oversight over the third-party computer programs” they use. It also says contractual arrangements should be clear about which entity maintains ultimate decision-making capability or judgement.
Mortgage brokers and aggregators
The OAIC’s APP 1 guidance does not specifically address mortgage brokers or aggregators. If you are a broker, or a lender working with brokers, get advice on how the rules apply to your arrangements.
What happens if you do not comply?
The 2024 amendments introduced infringement notices and compliance notices for certain breaches. They also introduced separate civil penalty provisions for interferences with privacy and for serious interferences with privacy.
The Act adds APP 1.7 to the list of provisions for which infringement notices or compliance notices can be issued.
Separately, since 10 June 2025 individuals have been able to sue for serious invasions of privacy under a new statutory tort. Under the Act, the invasion must be serious, and intentional or reckless.
Your compliance checklist before 10 December 2026
- Identify your computer programs. APP 1.7 applies where you have arranged for a program to make, or do something substantially and directly related to, a decision that could significantly affect an individual.
- Record the kinds of personal information each program uses. APP 1.8 requires your privacy policy to describe them.
- Consider the OAIC’s five factors. These include the degree of reliance on the output and the ability and likelihood of human override.
- Update your APP privacy policy. Describe the kinds of information and decisions required by APP 1.8, in plain language, as the OAIC recommends.
- Review third-party programs and contracts. The OAIC says entities should keep oversight of third-party programs, and contracts should be clear about who maintains ultimate decision-making capability.
- Put practices and procedures in place. APP 1.2 requires you to take reasonable steps to implement practices, procedures and systems to ensure you comply with the APPs. Staff training may form part of this.
- Set a review cycle. The OAIC says an entity “should regularly review and update” its APP privacy policy, and that this review could, at a minimum, be done as part of annual planning.
If you use tracking or analytics tools on your website, our article on the OAIC guidance on tracking pixels sets out the regulator’s guidance on those tools.
Frequently asked questions
Do the rules apply if a person makes the final credit decision?
They can. The OAIC says an output can still be caught where the human decision maker “relies on or is significantly influenced by” the program’s output. Whether this applies depends on the facts, so get advice.
Do we need to explain individual decisions to customers?
APP 1.7 to 1.9 deal with what your APP privacy policy must contain: the kinds of information and the kinds of decisions. The OAIC says the information should be structured to enable consumers to request further information, where required. Get advice on any other obligations that apply to your business.
Does this only apply to AI?
No. The OAIC says computer program includes pre-programmed rule-based processes, as well as AI and machine learning processes.
We collected the data years ago. Are we still caught?
The Act says the rules apply to decisions made after 10 December 2026, regardless of when the information was collected or the arrangement for the program was made.
Need help preparing your business?
We help lenders, credit providers and brokers review their automated decision processes and update privacy policies and vendor contracts. Learn more about our data and privacy law and consumer credit services.
Alternatively, you can give us a call, send us a message or book a call with us by clicking the buttons below.
Quotes and examples from the OAIC are from the Office of the Australian Information Commissioner website – www.oaic.gov.au, licensed under the Creative Commons Attribution 4.0 International Licence.
This article is general information only and is not legal advice. It reflects Australian law at the date of publication. Please contact us for advice about your circumstances.
Table of Contents
Posted in Data & Privacy Law