Automated decisions in your privacy policy from 10 Dec 2026
APP 1.7 to 1.9 explained for AML reporting entities, with a worked look at whether automated ID checks, screening matches and risk scores need disclosing.
From 10 December 2026, your privacy policy must explain where a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect someone's rights or interests using their personal information. For a Tranche 2 firm, automated ID checks, screening matches and risk scores that decide or shape whether you take on a client are likely to meet that test, so the safer course is to describe them.
This article sits under our Privacy Act reforms hub. It works through APP 1.7 to 1.9 using the OAIC's September 2026 guidance, then tests the three automated steps most common in AML onboarding at accounting, legal, conveyancing and real estate firms.
Page one of Google for this topic is mostly law firm alerts and the OAIC's own announcement. They explain the test well but stay general, with examples about lending, hiring and pricing. None tests a know your customer (KYC) workflow against the three limbs, which is what a small reporting entity needs.
Why a small firm is caught at all
Small businesses with turnover under $3 million are generally exempt from the Privacy Act. The OAIC confirms that reporting entities under the AML/CTF Act, including small ones, must comply with the Privacy Act when handling personal information for their AML/CTF obligations. For Tranche 2 firms that applies from 1 July 2026. Customer due diligence, monitoring, reporting and AML record keeping are all covered. So the new APP 1 duty reaches your AML onboarding even if the rest of your practice sits outside the Act.
What APP 1.7 to 1.9 require
APP 1.7 applies when all three limbs are met:
- you have arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision;
- the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
- personal information about the individual is used in the program's operation.
If so, APP 1.8 says your privacy policy must state the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where the program does a thing substantially and directly related to the decision. APP 1.9 adds that a decision includes refusing or failing to decide, and that effects count whether adverse or beneficial.
How the OAIC reads the key words
- Computer program includes pre-programmed rule-based processes, artificial intelligence (AI) and machine learning, ordinary software and apps, and generative AI. A scoring formula in a spreadsheet counts; the OAIC's own first example is one.
- Arranged for includes buying a third-party program, configuring off-the-shelf software and relying on its advisory outputs.
- Substantially and directly related means the output is a key factor in a person's decision and has a direct connection with it. Advisory outputs can count. The OAIC says a decision may be in scope even where the output is reviewed by a human.
- Significantly means more than trivial, with potential to considerably influence the person's circumstances. Vulnerability can raise the impact.
- When in doubt, the OAIC says take a cautious approach and include the information.
The duty stays with you. The OAIC expects vendors to give clear, high-level information about how their software can be used, so you can describe it, but the privacy policy is yours. Commercially sensitive information and trade secrets are excluded.
A worked look at a Tranche 2 onboarding flow
The table applies the three limbs to common steps. It is our reading of the OAIC guidance, not legal advice; your answer depends on how your process actually runs.
| Step | Program does | Decision affected | Likely in scope? |
|---|---|---|---|
| Automated ID check (document plus selfie) | Returns pass, fail or review, based on document checks and a face match | Whether the client can be onboarded, and whether you can lawfully provide the service | Likely. The Australian Transaction Reports and Analysis Centre (AUSTRAC) says you must not provide the service if you cannot establish identity on reasonable grounds, so the result is a key factor in a decision about access to a professional service. A fail that stops onboarding without real human review points strongly to in scope. |
| Politically exposed person (PEP), sanctions and adverse media screening | Flags possible matches against lists | Whether enhanced due diligence applies, whether you proceed, whether you decline | Likely. A person confirms or dismisses matches, but the OAIC says advisory outputs and human-reviewed outputs can still be substantially and directly related. |
| Risk scoring on a risk assessment form | Calculates a risk rating from answers and results | Low, medium or high rating; extra questions, source of funds checks, senior approval or refusal | Likely. This is close to the OAIC's spreadsheet example, where a formula ranked people and staff acted on the ranking. |
| Ongoing monitoring alerts | Re-screens clients and raises new matches | Whether to review, re-rate or exit the client | Likely, on the same reasoning as screening. |
| Onboarding form that only collects details | Stores what the client enters | None by itself | Unlikely on its own; it becomes relevant if its answers feed a score or rule. |
The OAIC's third example shows what can take an output out of scope: staff interrogating outputs, reviewing the underlying factors, using other evidence and documenting why they diverged. If you want to rely on that, your file notes must show it happening, case by case. Most small firms will find it simpler to disclose.
What to write in the privacy policy
The OAIC says you may group decisions and kinds of information, provided the result is meaningful to a reasonable person, and that more sensitive information such as biometric templates should be clear. Avoid detail that overwhelms the reader, and structure it so people can ask for more. A KYC section often covers:
- Kinds of personal information used: identity details, images of identity documents, a live selfie and the biometric comparison made from it, details of related persons such as beneficial owners, and screening results.
- Decisions made solely by a program, if any. If no decision is final without staff, say so plainly.
- Decisions a program substantially informs: whether we can verify your identity, whether you are a politically exposed person or subject to sanctions, the risk rating we assign, and whether further checks are needed before we act for you.
Two AML points shape the wording. First, the OAIC notes you need not put information in a collection notice where that would be inconsistent with tipping off obligations; a privacy policy describes kinds of decisions, never an individual's outcome. Second, the OAIC says the AML/CTF Act does not require you to keep copies of identity documents, so check your policy's retention wording matches what you now keep.
What to do before 10 December
- List every automated step in onboarding and ongoing due diligence, including vendor tools and spreadsheets.
- For each, record who acts on the output and how much weight it carries.
- Ask each vendor for a high-level description of what its software does with personal information.
- Draft the APP 1.8 section, grouping where it stays meaningful.
- Have your privacy and AML/CTF compliance owners sign it off together, since both touch the same data.
What StackGo does here
IdentityCheck runs several of the automated steps in the table: a biometric document and selfie check with liveness (Verify), PEP, sanctions and adverse media screening with ongoing monitoring (Screen), and risk assessment forms with scoring and enhanced due diligence steps (Assess). Your firm decides how those outputs are used and owns its privacy policy. StackGo does not write privacy policies or give legal advice on whether your process falls within APP 1.7.
Frequently asked questions
Does a human review take my process out of scope?
Not automatically. The OAIC says a decision may be in scope even where a human reviews the output, unless the program's output is not a key factor in the decision.
We are a small firm. Does APP 1.7 apply to us?
For your AML/CTF activities, yes. The OAIC says small reporting entities must follow the Privacy Act for personal information handled for AML/CTF purposes.
Do we have to name our software vendor?
APP 1.8 asks for kinds of information and kinds of decisions. It does not list vendor names, and commercially sensitive information is excluded.
When does this start?
10 December 2026.
Sources
- OAIC: New resources on transparency for use of AI and automated decision-making (30 Sep 2026)
- OAIC: APP 1.7-1.9 Transparency Obligation fact sheet (5 Nov 2026)
- OAIC: APP Guidelines, Chapter 1: APP 1 Open and transparent management of personal information (5 Nov 2026)
- OAIC: Privacy guidance for reporting entities under the AML/CTF Act (28 Aug 2026)
- AUSTRAC: Overview of initial customer due diligence (5 Nov 2026)
- Allens: Mandatory automated decision-making disclosure requirements are coming (2 Oct 2026)