Guide · Privacy Act · Melbourne, October 2026
Somewhere in your business there’s a spreadsheet called Roster_FINAL_v7_actually_final.xlsx, and it quietly decides who works Saturday. It has never been to a privacy briefing. It hasn’t heard about 10 December. This ADM checklist is how you introduce them, find every other piece of software making decisions about people, and hand your lawyer what they need to update your privacy policy in time.
ADM readiness review included free in Pain Point Audits booked before 10 December 2026.
61 days until APP 1.7 starts
Short answer: From 10 December 2026, businesses covered by the Privacy Act must say in their privacy policy when a computer program makes, or substantially and directly helps make, decisions that could significantly affect people using their personal information. This ADM checklist gets you there in 12 steps: confirm you’re covered, list every system (spreadsheets and rules count, not just AI), test which decisions are significant, record the personal information and human review, then brief your lawyer to update the policy.
The rule, in plain English
A confession before we start: we read privacy policies for fun. With a highlighter. On a Friday night. [Pauses for applause that does not come.] So you don’t have to, here is the whole rule on one screen.
[Switches to serious face.] The Privacy and Other Legislation Amendment Act 2024 added three new paragraphs to Australian Privacy Principle 1, numbered APP 1.7 to 1.9. They start on 10 December 2026, two years after the Act received Royal Assent. They apply to decisions made from that day, even if the system was set up or the data was collected years earlier.
The rule doesn’t ban automated decisions, and it doesn’t give people a new right to challenge them. It’s a transparency duty. If it applies to you, your privacy policy has to describe three things.
The kinds of personal information used in the operation of those computer programs.
The kinds of decisions made solely by the operation of a computer program.
The kinds of decisions where a program does something substantially and directly related to making the decision, such as scoring, ranking or recommending.
Notice the word “kinds”. The policy describes categories in plain language, grouped in a way a reasonable person would understand. It doesn’t publish your formulas, and the OAIC says trade secrets can stay secret. And generic lines won’t cut it, a point the lawyers at Corrs Chambers Westgarth put bluntly: “Generic statements about ‘using technology to improve services’ will not suffice.”
Australians care about this more than most privacy topics. In the OAIC’s 2023 Australian Community Attitudes to Privacy Survey, 89% said they should have the right to know when their personal information is used in automated decision-making that could affect them. For a deeper look at the service side of this, see our automated decision-making review, which covers the rule from the other direction: what Lumeio actually does about it.
Does it apply to you?
The rule bites when all three answers are yes. If you’re unsure on any of them, the OAIC’s advice is to take the cautious route and include it.
Most businesses with annual turnover of $3 million or less are generally exempt. Some are covered at any size, including health service providers, businesses that trade in personal information and Australian Government contractors. Check the OAIC’s small business page.
That includes rules, formulas, spreadsheets, apps, AI and chatbots, whether you built them, bought them or configured them. A person signing off doesn’t automatically take it out.
Think jobs, shifts, credit, insurance, prices, access to a significant service or support, or rights under a contract. Refusing counts, and so do good outcomes, not just bad ones.
Three yeses and personal information in the mix means the ADM checklist below is for you. If you answered no to the first question, you can stop here and go and have a nice afternoon. If you’re not sure about the second or third, keep reading, because that’s what steps 4 to 7 are for.
The checklist
Four phases, 12 steps, and a “done when” line for each, so you know when to stop. Tick as you go: your ticks are saved in this browser, and you can print the list or save it as a PDF for the next meeting.
Steps 2 to 8 are the slow ones, and they’re the part Lumeio does in the ADM readiness review. Your lawyer helps with step 1 and steps 9 to 11, and step 12 is a habit your business keeps.
Step 2, made easier
Nobody’s software is labelled “automated decision-maker”. It’s called Rosters, or Onboarding, or Client Health, or Book1.xlsx. Here’s where it tends to hide in the industries we work in.
Aged care · construction · any shift-based team
Rules or a spreadsheet decide who gets offered which shifts.
Hours are income. One catch: the Privacy Act’s employee records exemption may cover some decisions about current staff, but contractors, agency workers and applicants aren’t employees. Ask your lawyer.
Every business that hires
Your applicant tracking system ranks, filters or knocks out applicants before a person reads them.
The OAIC names recruitment screening and ranking as generally in scope.
Trade suppliers · accounting · finance
An onboarding form that sets credit limits or refuses account terms automatically.
Loan and credit approval is on the OAIC’s in-scope list. Sole traders are individuals too.
Accounting · professional services
A formula that ranks clients by risk, value or “difficulty” and decides who gets serviced, dropped or charged more.
The OAIC’s first example is a spreadsheet formula that ranks people, in its case aged care clients by need.
Aged care · health administration
Software that prioritises referrals, assesses needs or orders a waitlist.
Prioritising health or disability services is on the OAIC’s in-scope list, and the people affected are often vulnerable.
Any team with KPIs and a bonus pool
A report or AI tool that ranks staff for promotions, bonuses or performance plans.
AI reports that rank employee performance are on the OAIC’s list. The employee records exemption may still apply to current staff, so flag these for your lawyer.
Retail · insurance · services
Quotes or premiums adjusted automatically using what you know about the person.
Differential pricing of significant goods and insurance eligibility are both named by the OAIC.
Warehouses · trades · hospitality
Rules that reorder stock when levels drop.
No personal information, no decision about a person. Lovely automation, wrong list.
Everywhere
Typing up a decision a person has already made.
The OAIC says using software only to record a decision isn’t captured. Your letter template is safe.
If CVs are a big part of your week, our CV reformatting use case shows where the line sits between formatting a résumé (not a decision) and shortlisting a candidate (very much a decision). Aged care providers will find more on rostering and evidence in our aged care page, and firms can see our work in accounting and construction.
Steps 4 to 10
The ADM register is the document the whole checklist builds. It’s a table, not a novel. Here are four illustrative rows from a made-up 60-person business.
| System | What it does | Personal information | Decides or shapes? | Human review | Your call |
|---|---|---|---|---|---|
| Roster_FINAL_v7.xlsx | Allocates weekend shifts by a points formula | Names, availability, past hours, leave | Decides alone | None after Thursday 3pm | Ask the lawyer |
| Applicant tracking system | Ranks applicants and hides those below a score | CVs, work history, answers to screening questions | Shapes | Recruiter reads the top 20 only | Significant |
| Customer sign-up form | Sets 30-day terms or cash-only from a credit check | Name, ABN, credit file, address | Decides alone | On appeal, by the accounts manager | Significant |
| Stock reorder rules | Reorders consumables below a minimum | None | Decides alone | Weekly glance | Not ADM |
The last column is the one your lawyer will check hardest. Be generous with “ask the lawyer”. The OAIC’s flowchart walks the same questions in order, and its APP 1.7 to 1.9 fact sheet includes a model privacy policy section headed “Decisions made by computer programs”, which is a useful target for what your lawyer will write.
Timing
If you start the week of 12 October, there is room for every phase, a lawyer’s turnaround and one week of things going sideways. Starting later? Run phases 1 and 2 together.
Steps 1 to 3. Confirm you’re covered, build the list, chase the vendor tools.
Steps 4 to 7. Decides or shapes, significant or not, what data, who reviews.
Steps 8 to 10. Vendor explanations, contract check, register handed over.
Steps 11 and 12. New policy live, register built into how you buy software.
Guesswork
A register you can stand behind
Who does what
Yes, you can automate parts of an automation checklist. We’re aware of the irony. We’re doing it anyway.
The OAIC is clear that a person in the loop doesn’t automatically take a system out of scope. If the output is a key factor in what the person decides, it can still count. What can change the answer is real oversight: checking the output, looking at other evidence, narrowing what the program does, and writing down why staff disagreed with it.
That’s the same principle we build into every workflow. Software handles the rules and the reading, and people keep the decisions that matter. Our explainer on human-in-the-loop covers how to design that review step so it’s more than a rubber stamp.
Common mistakes
[Puts highlighter down.] These are the ones that turn a two-month job into a December panic.
One more, for completeness. The amending Act lists APP 1.7 among the Privacy Act provisions that can attract an infringement notice. We don’t advise on penalties, so ask your lawyer what that means for you, and then go back to step 1.
Our take
We don’t start with the law and we don’t start with AI. We start with how work actually moves through your business, because that’s where the automated decisions live. Our rule for this one fits on a sticky note: Lumeio maps the systems, your lawyer writes the policy.
The ADM readiness review covers steps 2 to 8 in one half-day session inside the Pain Point Audit. You get the register, a risk rating per system and a brief your lawyer can work from, in the same written report within 5 business days. It’s a fixed-price add-on at A$750 + GST, included free in audits booked before 10 December 2026.
The review is part of our AI decision systems work. You can see the wider approach on our solutions page, or read our guide to build vs buy AI if the register has you rethinking a tool or two. Our own privacy policy is fair game for the highlighter too.
Who wrote this
FAQ
An ADM checklist is a step-by-step list for finding the automated decision-making in your business before the Privacy Act’s new transparency rule starts on 10 December 2026. It covers which software makes or shapes decisions about people, what personal information it uses, where a person reviews it, and what your lawyer needs to update your privacy policy. It’s a working document, not legal advice.
If a computer program makes, or does something substantially and directly related to making, a decision that could significantly affect someone’s rights or interests, and it uses their personal information, your privacy policy must say so. It must describe the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially and directly helps to make.
No. The OAIC’s September 2026 fact sheet says a computer program includes pre-programmed rule-based processes, AI and machine learning, software, apps and generative AI tools such as chatbots. One of its examples is a spreadsheet formula that ranks aged care clients by need. If a rule or formula shapes a significant decision about a person, it belongs on your list, AI or not.
Not by itself. The OAIC says a decision can be in scope even when the program’s output is reviewed by a person, if the output is a key factor in what they decide. Extensive human oversight, such as checking the output, gathering other evidence and recording why staff disagree with it, can change the answer. Write down how review really works and let your lawyer decide.
Most businesses with annual turnover of $3 million or less are generally exempt from the Privacy Act. Some are covered whatever their size, including health service providers, businesses that trade in personal information and contractors to the Australian Government. Turnover counts income from all sources. If you’re near the threshold or in one of those groups, confirm with your lawyer.
It still counts. The OAIC says businesses that buy, configure, integrate or rely on a third-party program may be in scope, and the obligation usually stays with the business making the decision. Ask the vendor for a clear, high-level explanation of how its program works, and check your contract says who holds the decision-making role.
No. The privacy policy describes kinds of personal information and kinds of decisions in plain language, grouped in a way a reasonable person would understand. The OAIC says commercial-in-confidence details and trade secrets don’t need to go in, though embarrassment isn’t a reason to leave something out. Generic lines such as “we use technology to improve our services” won’t do the job.
Lumeio maps the systems and your privacy lawyer writes the policy. Our ADM readiness review finds the software that touches decisions about people and hands your lawyer a register and a brief. It’s a fixed-price add-on to the Pain Point Audit at A$750 + GST, and it’s included free in audits booked before 10 December 2026. We don’t give legal advice or certify compliance.
Bring the subscriptions list, the roster spreadsheet and Gary’s macro. The Pain Point Audit is a half-day look at how work really moves through your business, with a written report in 5 business days. Book before 10 December 2026 and the ADM readiness review comes with it: the register, a risk rating per system and a brief for your lawyer. Highlighter optional. We’ll bring ours.
Pain Point Audit fixed price A$1,950 + GST. ADM readiness review free in audits booked before 10 December 2026.
