Privacy policies must disclose automated decisions
In short
- Date
- 10 December 2026
- Status
- In law or official guidance
- Who it affects
- Organisations covered by the Australian Privacy Principles
What changes
A privacy policy must say when a computer program makes, or substantially helps make, decisions that could significantly affect a person, using their personal information. It must describe the kinds of information used and the kinds of decisions. This is a Privacy Act change. It applies to NDIS providers covered by the Privacy Act.1
Sources
Last reviewed 3 October 2026. Rules change: check the sources before you act.
Based on content from the Federal Register of Legislation and the NDIS Quality and Safeguards Commission website, © Commonwealth of Australia, licensed under CC BY 4.0. CareHelm summarised it in plain English. Check the linked sources for the official text. For the latest legislation go to legislation.gov.au.