When Machines Decide
Decisions that once required human judgment are increasingly being made, or heavily influenced, by computer programs. Examples include credit approvals, fraud detection and routing of calls.
Australia has introduced new transparency rules for organisations that rely on these Automated Decision Making (ADM) technologies. From 10 December 2026, the Privacy Act will require organisations to explain their use of ADM when those decisions significantly affect the rights and interests of an individual.
The definition of ADM in the Australian Privacy Act is deliberately broad. It covers situations where a computer program makes the decision outright, as well as when a program does something substantially and directly related to the decision.
However, the key threshold as to whether you are required to provide notification is whether the outcome significantly affects someone’s rights or interests. For example the approval of a loan, the payment of an insurance claim, the success of a job application, eligibility for government benefits, or being flagged for fraud or non-compliance. Low-stakes automation such as call routing, product recommendations or website recommendations will not usually meet this test. The Australia significance threshold is wider than that of the GDPR, which focuses on “legal effects” or “similarly significant effects.”
From 10 December 2026, organisations will need to include in their privacy statement details about their use of ADM whenever it crosses that significance threshold. The privacy statement needs to detail:
When personal information is used in automated decisions
The types of information used in those systems; and
The kinds of decisions being made.
While Australia stops short of offering an explicit right to human review, as the GDPR does in certain circumstances, it is setting a clear expectation of transparency.
For organisations, the changes mean you will need to determine what ADM technologies are in use and then determine if the effects of the use meet the threshold.
The changes in the Australian Privacy Act do not restrict the use of automation. Instead, they shine a light on where automation matters most, when it affects rights, entitlements, or opportunities. Automated systems can be powerful, but they cannot be invisible. Transparency is now the expectation whenever algorithms play a decisive role in shaping people’s lives.