Privacy and Other Legislation Amendment Act 2024 (Cth), Automated Decision-Making Transparency
Privacy and Other Legislation Amendment Act 2024 (Cth) No. 128, 2024, Schedule 1, Part 15, inserting Australian Privacy Principles 1.7 to 1.9 into Schedule 1 to the Privacy Act 1988
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force in 85 days, effective 10 December 2026.
A data subject rights rule binding public and private bodies.
As of 6 September 2026.
What it requires
- This measure is enacted but does not bind anyone until 10 December 2026; what follows is what it will require from that date.
- Disclose in the entity's APP privacy policy the kinds of personal information used, and the categories of decisions made, by a computer program that could reasonably be expected to significantly affect an individual's rights or interests.
If you get it wrong
Private right of actionNo
Who enforces it
Enforcement body
Office of the Australian Information Commissioner (OAIC)
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Inserts a new Australian Privacy Principle 1.7 to 1.9 requiring an APP entity's privacy policy to disclose, for computer programs the entity uses to make decisions that could reasonably be expected to significantly affect an individual's rights or interests, the kinds of personal information used in that decision-making and the categories of decisions made.
Received Royal Assent on 10 December 2024, and the commencement table fixes the day for this Schedule at 24 months after Assent, so the disclosure duty takes effect on 10 December 2026.
When LexLint raises it
high_risk_decisionsautomated_outreach