From 10 December 2026, all APP entities must explicitly disclose their use of automated decision-making (ADM) systems in their public privacy policies. This mandate creates a significant operational shift for recruitment teams. Organisations utilising automated screening tools, AI algorithms, or applicant tracking systems (ATS) will now need to transparently detail how candidate personal data is evaluated. This article covers what the change means for HR and IT leaders, and the essential steps required to ensure full compliance before the deadline.

What's changing under the Privacy Act — and what it means for HR and IT

New transparency clauses (APPs 1.7–1.9)

The Privacy and Other Legislation Amendment Act 2024 (Cth) introduces explicit ADM transparency obligations. By the 10 December 2026 deadline, your public privacy policies must clearly detail how computer programs process personal information to make or assist with business decisions.

Broad definition of "computer programs"

The legislation adopts a sweeping definition of what constitutes a computer program. The mandate covers not only advanced artificial intelligence (AI) and machine learning algorithms but also traditional, rule-based software — such as applicant tracking system (ATS) CV parsers and keyword filters frequently utilised by HR teams.

No "human-in-the-loop" exemption

Crucially, there is no blanket exemption for processes that keep a "human-in-the-loop". Even if an HR manager issues the final hiring decision, an organisation is not exempt if the automated software "substantially and directly" assists, scores, or filters candidates leading up to that final call.

Final OAIC regulatory guidance released

On 30 September 2026, the Office of the Australian Information Commissioner (OAIC) published its final compliance guidance and factsheet resources. These documents provide businesses with definitive decision frameworks and policy disclosure templates to ensure operational readiness.

Severe financial penalties

Non-compliance carries severe civil penalties under expanded regulatory enforcement powers. These penalties can reach up to $50 million, three times the value of the benefit obtained from the contravention, or 30% of the organisation's adjusted annual turnover — whichever is greater.

Why is the Privacy Act changing?

Addressing algorithmic bias and transparency

Comprehensive government reviews into Australia's privacy framework identified mounting public and regulatory concern regarding unchecked automated screening tools, hidden candidate profiling, and potential algorithmic bias in employment decisions. Without regulatory oversight, automated recruitment tools risk perpetuating historical biases or disqualifying candidates based on opaque, unscrutinised decision-making criteria.

Empowering individuals

These legislative reforms aim to empower job applicants and prospective employees by providing greater transparency. By introducing explicit transparency mandates under Australian Privacy Principle 1 (APP 1), the Act ensures individuals can understand when and how their personal information is processed by automated computer programs to evaluate candidate suitability, determine shortlisting, or shape overall employment outcomes.

Mandatory privacy policy disclosures: what Australian businesses must publish under APP 1.8 and 1.9

What you must disclose under APPs 1.8 and 1.9

Under APPs 1.8 and 1.9, generic privacy statements about technology use are no longer enough. You must clearly articulate how ADM systems function across your recruitment pipeline, distinguishing between fully automated decisions and algorithmically assisted workflows.

Furthermore, APP 1.9 explicitly mandates the disclosure of automated processes that result in negative outcomes, such as application refusals, candidate filtering, or omission from candidate shortlists.

The table below outlines the core disclosure categories and corresponding policy obligations for HR and IT leaders:

3 mandatory content requirements for your privacy policy

To achieve full compliance under APP 1.8 and 1.9, HR and IT teams must collaborate to audit their recruitment technology and ensure public privacy policies explicitly address three essential areas:

1. Categories of personal information processed:

   Policies must explicitly detail all data inputs ingested by automated tools. In recruitment, this includes work history, professional qualifications, psychometric assessment metrics, video interview transcripts, and parsed CV attributes.

2. Types of recruitment decisions made or assisted:

   Organisations must specify the exact recruitment stages where ADM systems are deployed. This spans candidate pre-screening, CV keyword filtering, applicant suitability ranking, psychometric evaluation, and final selection or rejection.

3. Plain-language explanation of algorithmic logic:

   Generic statements such as "we may use AI to process your application" do not satisfy statutory standards. Policies must provide a transparent, plain-language description explaining how computer programs evaluate candidate inputs to influence outcomes—giving applicants meaningful insight into the criteria and mechanics driving recruitment decisions.
   
   

Core OAIC compliance rules: thresholds, employment scope, and contesting rights

To ensure full operational readiness before 10 December 2026, HR, IT, and business leaders must understand the specific regulatory boundaries established by the Office of the Australian Information Commissioner (OAIC). The disclosure obligations under APP 1 extend beyond standard recruitment platforms, establishing strict parameters around decision thresholds, employment arrangements, SaaS vendor accountability, and retrospective application.

Scope of the "significantly affecting" threshold across employment types

The statutory disclosure mandate applies to any automated decision that could reasonably be expected to "significantly affect the rights or interests of an individual." In an employment context, this threshold is interpreted broadly. It encompasses decisions affecting permanent, fixed-term, casual, and independent contractor engagements, as well as internal promotion and transfer opportunities. Any automated system that materially influences an individual's financial standing, career progression, or entry into a workforce pipeline meets this threshold and requires explicit disclosure.

Informing candidates of pathways to contest decisions

Public privacy disclosures must outline accessible procedures for job applicants to make inquiries, request human review, or formally contest decisions driven by automated algorithms. While establishing formal review mechanisms is not strictly mandated within the statutory text of the APPs themselves, providing clear pathways for candidates to challenge automated outcomes is explicitly set out in Australian Government AI governance frameworks and OAIC regulatory guidance. Implementing and disclosing these review options represents a highly recommended best practice to mitigate compliance and reputational risk.

Full accountability for third-party SaaS vendors

A critical point of emphasis in OAIC guidance is that utilising external recruitment software—such as cloud-based ATS platforms, AI video interview tools, or candidate matching algorithms—does not transfer compliance liability to the software vendor. The APP entity remains fully accountable under the Privacy Act. HR and IT departments must proactively map data flows, conduct vendor diligence, and ensure all third-party algorithmic processing is thoroughly documented and disclosed in the organisation's public privacy policy.

Retrospective data scope

The commencement of the mandate on 10 December 2026 applies to all automated decision-making workflows operating on or after that date. Crucially, this disclosure obligation applies regardless of when candidate data was originally collected or ingested into the system. If an active recruitment workflow uses automated software to score, filter, or evaluate candidates on or after 10 December 2026, full APP 1 disclosure is legally required—even if the applicant submitted their personal data years earlier.

Practical action plan: step-by-step HR and IT roadmap ahead of 10 December 2026

Achieving operational readiness before the 10 December 2026 enforcement deadline requires a coordinated effort between HR, IT, legal, and compliance teams. To assist Australian businesses in structuring their transition, the following six-step roadmap outlines the practical actions required to audit recruitment technology, update privacy policies, and embed long-term governance.

Step 1: Conduct an ADM system audit and data flow map

Begin by auditing and cataloguing all software tools currently deployed across your organisation's recruitment and talent acquisition workflows. In accordance with the OAIC's automated decision-making (ADM) guidance framework, this audit must encompass applicant tracking systems (ATS), AI-powered video interview screening platforms, and automated psychometric assessment tools. Map how candidate personal data flows across internal systems and third-party SaaS platforms to pinpoint exactly where computer programs process inputs to make or assist employment decisions under APPs 1.7–1.9.

Step 2: Execute Privacy and Algorithmic Impact Assessments (PIAs / AIIAs)

Perform formal Privacy Impact Assessments (PIAs) and Algorithmic Impact Assessments (AIIAs) on all automated HR tools. These structured evaluations allow organisations to assess potential algorithmic bias, identify data security risks, and verify legal threshold triggers before new systems are deployed or public privacy policies are updated.

Step 3: Apply the OAIC decision classification test (solely automated vs. assisted)

Categorise every automated recruitment tool into one of two statutory buckets: (a) solely automated decisions (e.g. auto-rejections without human review) or (b) substantially and directly assisted decisions (e.g. ATS candidate suitability rankings reviewed by hiring managers). Apply this classification test systematically across all employment categories, including permanent, casual, fixed-term, and independent contractor recruitment pipelines.

Step 4: Perform vendor due diligence and secure logic documentation

Engage directly with HR SaaS vendors to request detailed technical documentation, algorithmic processing explanations, and data usage statements. Because the APP entity retains ultimate regulatory accountability, organisations must ensure they hold sufficient technical detail regarding how candidate data is evaluated to publish accurate, transparent disclosures.

Step 5: Draft two-tier policy disclosures and establish decision contesting pathways

Draft clear, plain-language additions to your public privacy policy under APPs 1.8 and 1.9. Disclosures must explicitly separate solely automated decisions from algorithmically assisted workflows and outline the specific categories of data processed. Concurrently, establish internal administrative procedures that allow candidates to make inquiries, request human review, or formally contest ADM-driven recruitment outcomes prior to the deadline.

Step 6: Establish ongoing internal governance and periodic reviews

Implement recurring review mechanisms to re-evaluate recruitment technologies whenever vendor algorithms, scoring parameters, or human review workflows change. Establishing ongoing governance ensures that public disclosures remain accurate and compliant throughout the lifecycle of every HR technology asset.

Conclusion

Updating your privacy policy is more than a regulatory checkbox—it modernises your recruitment governance and builds candidate trust in an increasingly automated hiring environment.

For specific advice regarding complex software contracts, algorithmic liability, or privacy disclosures, consult a qualified privacy legal specialist or refer directly to guidance published by the Office of the Australian Information Commissioner (OAIC).

Official sources:

• Office of the Australian Information Commissioner (OAIC) – ADM Guidance & Consultations

• OAIC – New resources on transparency for use of AI and automated decision-making

• OAIC – APP 1.7-1.9 Transparency Obligation - Fact Sheet (PDF)

• OAIC – APP 1.7-1.9 Transparency Obligation Flowchart (PDF)

• Federal Register of Legislation – Privacy Act 1988

• Federal Register of Legislation – Privacy and Other Legislation Amendment Act 2024

• Attorney-General's Department – Privacy Act Review

• Parliament of Australia – Chapter 5 - Automated decision-making