01
Assumption: the vendor handles it
The vendor may operate the technology, but your organisation may still have arranged for it to be used in the decision process.
- Question
- Which decisions you may need to disclose from 10 December 2026
- Output
- An initial view of exposure, a full decision register or a board-level risk summary
- Who it suits
- Organisations and agencies that have not yet checked their decisions about people against APP 1.7
- Format
- 3 depths: the Rapid Screen, the Full Review and the Review and Board Pack
- Fee
- A fixed price, set after a short scoping discussion
- Does not include
- Legal advice or the final privacy policy wording
Australian Privacy Principle (APP) 1.7 and APP 1.8 apply from 10 December 2026. They apply where an APP entity has arranged for a computer program to do either of 2 things:
- make a decision
- do a thing that is substantially and directly related to making a decision.
An APP entity is an organisation or agency covered by the Privacy Act 1988. Both of these conditions must also be met:
- the decision could reasonably be expected to significantly affect the rights or interests of an individual
- personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.
The privacy policy must then describe 3 things:
- the kinds of personal information used in the operation of such computer programs
- the kinds of such decisions made solely by the operation of such computer programs
- the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.
Source: Privacy Act 1988 (Cth), Schedule 1, APP 1.7 and APP 1.8.
Who it suits
The Rapid Review suits organisations and agencies that have not yet checked their decisions about people against APP 1.7. It applies the test above to each workflow.
Privacy, legal, risk and operations leaders use it to have the disclosure ready before 10 December 2026.
Six-question check
Check for an automated decision disclosure gap
This check is not a legal determination. It shows whether a Rapid Review is worth your time.
Question 1 of 6
Is your organisation or agency covered by the Privacy Act 1988?
An organisation or agency the Act covers is an APP entity, and APP 1.7 applies only to APP entities. A business with an annual turnover of $3 million or less is generally exempt as a small business. Some businesses are covered whatever their turnover, such as health service providers.
Find the decisions before you disclose them
Updating the privacy policy is the last step. First you need to find every workflow that may meet the test.
Decisions are often hidden in:
- vendor platforms bought years ago
- rules engines and spreadsheets
- features enabled inside existing software
- workflows where staff usually accept a system recommendation
- processes owned by operations teams instead of legal or procurement.
A software register lists what the organisation bought, but not the decisions those systems make or shape.
Decisions that may be in scope
The examples show where to look. Whether each one meets the test above depends on the facts of the workflow. Artificial intelligence is not the deciding factor, because the Australian Privacy Principles are technology-neutral.
Examples include decisions about:
- 01
who reaches a recruiter's shortlist
- 02
who qualifies for credit, insurance or another service
- 03
what premium, rate, limit or price someone receives
- 04
whether a claim, refund or account review is approved
- 05
whether an account is flagged, held or restricted
- 06
which customers receive priority or specialist support
- 07
who receives work, shifts, benefits or opportunities.
Common assumptions about APP 1.7
02
Assumption: a person approves it
A final human click does not automatically take a workflow out of scope. The system may still do a thing substantially and directly related to making the decision.
03
Assumption: it is only a rule or spreadsheet
The obligation refers to computer programs. Legacy rules, scoring tools and established software may still require assessment.
What the Rapid Review shows your board
The review shows which decisions you may need to disclose from 10 December 2026. The depth you choose sets the output: an initial view of exposure, a full decision register or a board-level risk summary.
The Rapid Screen gives an initial view. The Review and Board Pack adds board material. The Full Review sets out:
- which systems are involved in decisions about people
- which personal information each workflow uses
- what outcome the system influences
- whether human review is genuine and effective
- which vendor tools require further investigation
- which workflows may require privacy policy disclosure
- which gaps need legal, operational or governance action.
Choose the review depth
The Rapid Review comes in 3 depths: the Rapid Screen, the Full Review and the Review and Board Pack. Each goes further than the last.
01
Rapid Screen
The Rapid Screen confirms where to investigate.
It identifies the systems and workflows most likely to warrant assessment.
It includes:
- a focused review of priority workflows
- an initial view of possible APP 1.7 exposure
- a short executive summary
- a recommended next step.
02
Full Review
The Full Review builds the complete decision inventory.
It maps relevant systems and vendor tools, records the personal information used, examines human involvement and classifies each workflow against the obligation.
It includes:
- a decision register
- workflow-level findings
- identified disclosure gaps
- draft plain-English disclosure content for legal review
- a ranked plan to close the gaps.
03
Review and Board Pack
The Review and Board Pack adds named ownership and a board risk summary.
It includes the Full Review plus documentation for the board.
It includes:
- named ownership for each decision workflow
- governance and oversight findings
- a board-level risk summary
- materials for executive and legal review.
Why now
Time to find the decisions before 10 December 2026
Finding the decisions comes first, so your legal team still has time to approve the wording.
Starting now leaves time to investigate before the deadline.
Ramon Rodriguez leads the review
He has 15 years in commercial leadership, 9 of them at News Corp Australia, including senior leadership and P&L accountability. The findings are written for your legal and operations teams.
What it does not include
The Rapid Review does not include legal advice or the final privacy policy wording.
It drafts disclosure content for your legal team to review and approve.
What we need from you
A review needs input from legal, privacy, procurement, technology and the operational teams that use the systems each day.
It also needs your current privacy policy and any register of systems or vendors you hold.
How the fee is set
Every engagement is fixed-price and scoped through one initial discussion.
The review depth you choose sets what you receive.
Frequently asked questions
What is changing on 10 December 2026?
From 10 December 2026, APP 1.7 and APP 1.8 set privacy policy disclosure rules for some automated decisions. Our guide to what APP 1.7 requires explains when they apply, and the opening section of this page states the full test.
How do we know whether we may be in scope?
Start with the workflow instead of the product name. List the decisions about people that software makes or shapes, such as hiring, eligibility, pricing, claims, account access or service priority. Then apply the test at the top of this page to each one.
Does this apply only to artificial intelligence?
The obligation is not limited to artificial intelligence. The Office of the Australian Information Commissioner (OAIC) states in its APP guidelines that 'computer program' is intended to be interpreted broadly. It includes pre-programmed rule-based processes, artificial intelligence and machine learning processes.
Does human approval remove the workflow from consideration?
Human approval does not automatically remove a workflow from consideration. The review looks at what the person does with the system's output, and whether they check it independently or mostly accept it. The OAIC's fact sheet says steps such as documenting why staff diverged from the program's recommendation could indicate otherwise.
Does APP 1.7 require human review of automated decisions?
APP 1.7 and APP 1.8 do not require human review. They set what a privacy policy must disclose. Community expectation goes further, according to the OAIC's 2026 Community Attitudes to Privacy Survey. It found 81% of Australians consider a right to have a human review AI decisions essential, up from 73% in 2023.
Which decisions does the OAIC say are generally in scope?
Its fact sheet of September 2026 lists examples including candidate sorting in recruitment, loan and credit approval, and insurance eligibility. It also lists personalised pricing for significant goods and AI reports that rank employee performance. The list is non-exhaustive, so the review applies the test to every workflow.
Can we keep how the program works confidential?
Trade secrets and commercially sensitive information are excluded from the obligation. Information that would only expose the organisation to embarrassment or public criticism is not excluded, according to the OAIC.
Does the vendor carry the obligation?
The OAIC generally expects the obligation to remain with the organisation that uses personal information to make the decision. The test asks what your organisation has arranged for. Your contract can require the vendor to supply what the disclosure needs, such as the kinds of personal information its program uses.
What does the Rapid Review cost?
Each review has a fixed price, set after a short scoping discussion. The price depends on how many business units, systems and workflows are included.
Is this legal advice?
The Rapid Review is not legal advice. Its findings and draft disclosure content are written for your lawyers, who confirm the legal position before the privacy policy changes.
What happens if the privacy policy does not meet APP 1.7?
The organisation may face regulatory action for failing to meet an enforceable privacy policy obligation. The consequence will depend on the facts, the nature of the privacy interference and the regulator's response.
Identify the decisions you have not mapped
The first conversation establishes whether APP 1.7 may apply to your organisation and which workflows to examine first. It also agrees which depth fits: the Rapid Screen, the Full Review or the Review and Board Pack.