From 10 December 2026, the automated decision making rules in APP 1.7 mean some Australian businesses must explain in their privacy policy how computer programs use personal information to make, or help make, significant decisions about people. You can't write that section accurately until you know which systems make those decisions, what data they use and who checks them. This checklist is for that technical inventory.
The privacy policy is the last step. The work underneath it is finding every rule, form, AI tool and workflow in your business that touches a decision about a person, and writing down what it does. It's also what a privacy lawyer will need from you before they can draft anything.
The short version: list every system that decides something about a person or feeds a person's decision, record the personal information it uses, who owns it, what gets logged and where a human can step in. Then take that inventory to a privacy lawyer to work out what your policy needs to say. This article is not legal advice.
What changes on 10 December 2026
The Office of the Australian Information Commissioner (OAIC) published new resources on 30 September 2026. Its announcement puts it plainly:
"On 10 December 2026, APP entities must include information in their privacy policy where they have arranged for a computer program to make or inform decisions that significantly affect individuals’ rights or interests."
OAIC, 30 September 2026
The OAIC says this obligation was introduced by the Privacy and Other Legislation Amendment Act 2024, within APP 1. Here is how the OAIC sets out the three conditions in APP 1.7, word for word. APP entities must include the APP 1.8 information in their APP Privacy Policy if:
- "the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making a decision (APP 1.7(a)); and"
- "the decision could reasonably be expected to significantly affect the rights or interests of an individual (APP 1.7(b)); and"
- "personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision (APP 1.7(c))."
And this is what the OAIC says APP 1.8 requires the policy to include when those conditions are met:
- "the kinds of personal information used in the operation of such computer programs; and"
- "the kinds of such decisions made solely by the operation of such computer programs; and"
- "the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs."
All three APP 1.8 items ask for kinds of information and kinds of decisions, and you can't name those until you've looked at the actual systems.
The OAIC also released a fact sheet, a supplementary fact sheet for government agencies and a flowchart, and updated the APP 1 guidelines on the same day.
Sources: OAIC announcement, 30 September 2026 and OAIC APP 1 guidelines, chapter 1.
Does the automated decision making rule apply to your privacy policy?
Start with whether the Privacy Act covers your business at all. The OAIC's small business page says "Most small businesses are not covered by the Privacy Act 1988, but some are." It also lists businesses covered regardless of turnover, including health service providers, businesses trading in personal information and contractors providing services under a Commonwealth contract. The OAIC has a small business page with the turnover test and a checklist. If you're not sure, that's the first question for your lawyer.
If you are covered, three parts of the OAIC guidance tend to surprise people.
"Computer program" is broad
The APP 1 guidelines say the term is "intended to take its ordinary meaning and encompass a broad range of matters, including pre-programmed rule-based processes, artificial intelligence and machine learning processes to make a computer execute a task." A simple if-this-then-that rule in a booking system can count as a computer program. So can a chatbot.
Software you bought still counts
The rule turns on whether you "arranged for" a computer program. The OAIC's examples of things that would generally be "arranged for" include an entity that "procures another entity’s AI system to screen and rank job applications", one that "contracts a third-party software company to automatically approve or decline refunds on its behalf" and one with "a case management system that automatically escalates particular types of complaints." The OAIC also says entities "should actively identify, assess and keep oversight over the third-party computer programs that they use to make a decision". So a setting buried in a SaaS tool belongs on your inventory.
Human review doesn't automatically take it out
The guidelines say: "a decision may be within scope of the APP 1.7-1.9 transparency obligation even where a computer program output does not replace the entire decision-making process or is subject to human review." The factors the OAIC lists include the degree of reliance on the output, the ability and likelihood of human override, whether the output is advisory or determinative, how explainable it is, and how deeply it is built into the workflow.
You can only answer those factors by looking at how each system actually runs day to day, which is why the inventory comes first.
Why your privacy policy needs a systems inventory first
Most small and mid-sized businesses don't have one system that "makes decisions". They have a CRM with lead scoring, a web form that rejects some enquiries, a booking tool with a no-show rule, an n8n or Zapier workflow someone built two years ago, an AI assistant in the inbox and a few spreadsheets with formulas that decide who gets followed up.
Often nobody has the whole picture, and the person writing the privacy policy may know the least about it.
The decision points aren't always where people expect. An AI tool might only draft text, while a quiet rule in the booking system is what actually stops someone getting an appointment.
An inventory gives the lawyer facts to work from, and gives you a register you can keep current when systems change.
The automated decision making inventory checklist
Use this table as the column list for a spreadsheet. One row per system or workflow. The last column links each item back to what the policy needs, so nothing on the list is busywork.
| Record this | What it means in practice | Why the policy needs it |
|---|---|---|
| System or workflow | Name, vendor, where it runs and who set it up. Include rules inside SaaS tools as well as custom builds. | Shows what you "arranged for", including bought software |
| Trigger and data flow | What starts it, which systems it reads from and writes to, and where the output lands. | Tells you which personal information reaches the program |
| Decision point | The exact step where something is approved, declined, ranked, flagged, held, escalated or routed. Include refusing or failing to act. | The OAIC says making a decision includes refusing or failing to make one |
| Who decides | Does the program decide on its own, or does it recommend, score or pre-fill for a person? | APP 1.8 splits decisions made solely by the program from ones where it does a thing substantially related |
| Personal information used | Every field the program uses for that decision. Flag sensitive information such as health details. | APP 1.8 asks for the kinds of personal information used |
| Effect on the person | What happens to the individual, and whether it touches things like healthcare, housing, credit, employment or support. | Helps the lawyer judge "significantly affect" under APP 1.7(b) |
| Vulnerable people | Does the decision reach children, people with disability or others experiencing vulnerability? | The OAIC says vulnerability can make a decision significant |
| Business owner | One named person who decides whether the outcome is right. | Someone has to answer questions and keep the entry current |
| Technical owner | The person or supplier who can change, pause or explain the logic. | Needed to confirm what the program actually does |
| Human review and override | Who reviews, what they see, whether they can override, and how often they actually do. | Reliance and override are factors in the OAIC guidance |
| Logs | What is recorded for each decision, where, for how long, and who can see it. | Lets you explain or check a decision when someone asks |
| Contract position | For vendor tools, what the contract says about who makes the decision. | The OAIC says contracts should be clear on who keeps decision-making capability |
| Commercially sensitive detail | Anything about the logic you think would harm the business if published. | The OAIC describes a narrow commercial-in-confidence exclusion. Your lawyer decides if it applies |
| Status | Likely in scope, needs legal view, or likely out of scope with the reason written down. | Gives the lawyer a short list and a record of what you ruled out |
The status column is not yours to settle alone. Its job is to sort the list so the lawyer spends time on the hard rows.
How to work through the inventory
- List the systems. Pull the subscriptions list from your accounts system and the admin panel of each tool. Add every automation platform account (n8n, Zapier, Make, Power Automate) and every AI tool staff use, including ones people signed up for themselves.
- Walk each customer and staff journey. Enquiry, onboarding, booking, payment, support, complaints, hiring, rostering. At each step ask: does a program accept, decline, rank, flag, hold or route a person here?
- Open the logic. Read the actual rule, workflow or prompt. Don't rely on what someone remembers it doing. In n8n that means opening the workflow and reading the IF and Switch nodes. In a SaaS tool it means the automation or rules screen.
- Trace the fields. For each decision point, list the exact fields the program reads. This becomes your "kinds of personal information" list.
- Check how people use the output. Ask the staff who see the score or recommendation how often they go against it. If the answer is "basically never", write that down.
- Check the logs. Confirm you can find what the program did for one real person last month. If you can't, that's a gap worth fixing whatever the policy says.
- Sort and hand over. Mark each row with a status, then take the spreadsheet to your privacy lawyer.
Worked example: a made-up allied health clinic
This example is invented. It is a made-up physiotherapy clinic used to show how the inventory works. It is not a Workvolve client and the scope calls below are not legal conclusions.
Picture a physio clinic with three locations. The OAIC's small business page says the Privacy Act covers health service providers regardless of turnover, so the clinic is covered. The practice manager walks the patient journey and finds five systems that touch people.
| System | Decision point | Personal information used | Who decides | Human review and logs | Status |
|---|---|---|---|---|---|
| Online booking rule | Blocks online booking after two missed appointments without notice | Name, contact details, attendance history | Program, on its own | No review. Block shows in the booking tool, reason not logged | Needs legal view |
| AI intake chat on the website | Suggests appointment type, length and which practitioner | Symptoms and injury details typed by the patient, age, contact details | Recommends. Reception books what it suggests almost every time | Chat transcripts kept in the vendor dashboard with no set retention | Needs legal view |
| Overdue account workflow | Flags accounts overdue past a set point and puts new bookings on hold until reception approves | Name, invoice history, payment status | Program flags, reception approves or releases | Reception can override. Flag logged in the workflow history | Needs legal view |
| Newsletter segments | Sorts patients into email lists by treatment type | Email, treatment type | Program | No pricing or access changes. Unsubscribe in every email | Likely out, reason recorded |
| Practice software to accounts sync | None. Copies invoices across | Name, invoice details | No decision made | Sync log in the automation platform | Likely out, reason recorded |
Three rows go to the lawyer. Two are ruled out, with the reason written down so nobody has to re-check them later.
The inventory also surfaced problems that have nothing to do with the policy wording. The booking block had no override path that anyone knew about. The intake chat was holding health information in a vendor dashboard that nobody owned. Both are worth fixing before 10 December, and the policy will be easier to write once they are.
Here is what the clinic hands its lawyer, mapped to the three APP 1.8 items:
- Kinds of personal information used: contact details, attendance history, payment history, and health information patients enter in the intake chat.
- Kinds of decisions made solely by a program: blocking online booking after missed appointments.
- Kinds of decisions where a program does a thing substantially related: recommending appointment type and practitioner, and flagging overdue accounts for a booking hold.
The lawyer decides which of these actually meet APP 1.7 and how to word them. The clinic's job was to make sure nothing was missing from the list.
Where automated decisions hide in a typical stack
When we review a business's systems, these are the places we check first:
- Web forms and quote tools that reject, rank or route enquiries by postcode, budget or answers.
- CRM rules for lead scoring, assignment and "do not contact" flags.
- Booking and rostering tools with no-show rules, waitlist priority or automatic shift allocation.
- Accounts and billing automations that hold accounts, stop services or escalate debts.
- Refund and returns rules that approve or decline without a person.
- AI assistants and chatbots that recommend outcomes, triage requests or screen applicants.
- Hiring tools that screen or rank applications.
- Old workflows in n8n, Zapier or Make that nobody has opened since the person who built them left.
Plenty of automation never decides anything about a person. Our mortgage brokerage CRM sync runs around 412 syncs a week between HubSpot and their loan-origination system and replaced roughly 11 hours a week of manual entry. It copies contacts, deals and stage changes across. On its own, a sync like that moves data and doesn't choose an outcome for anyone. If a later rule used the synced stage to decide something about a client, that rule would go on the inventory as its own row.
Design choices help too. In our NDIS provider compliance build, the AI assistants refer to participants by code, never by name, and every output is a draft for human review that can't send anything anywhere. Boundaries like that are easy to describe in an inventory.
Keeping the inventory current after 10 December
An inventory is only accurate on the day you finish it. Systems change. Someone adds a rule to the CRM, a vendor ships an AI feature, a new workflow goes live.
Three habits keep it current:
- Add "does this decide anything about a person?" to your checklist for any new tool or automation. We already ask it as part of the privacy check in our n8n production checklist.
- Review the inventory whenever you review the privacy policy. The OAIC's APP 1 guidelines suggest regular reviews, at a minimum as part of annual planning.
- Give each row a named owner, so a change to the system has someone responsible for updating the entry.
If you use AI tools with client or participant data, our guide on whether ChatGPT is safe for NDIS participant data covers the data side in more detail.
This is not legal advice
Workvolve is an automation and AI build business, not a law firm. Nothing here is legal advice. The quotes above come from OAIC pages linked in this article, and the OAIC's own guidance is the authority. Whether a decision is in scope, whether the Privacy Act covers your business, and what your privacy policy should say are questions for a privacy lawyer. Check all wording with one before you publish.
What we can do is the technical half: open every system, trace the data, find the decision points and hand your lawyer an inventory they can work from.
Not sure what your systems are deciding? We can map the workflows, automations and AI tools behind each decision so your lawyer has the facts. See our workflow automation service or book a short call.