Automated Decision-Making Privacy Policy Template

The complete automated decisions section, free to copy from this page or download as an editable Word document. No sign-up. Replace every [bracketed placeholder] with your own details, delete anything that does not apply, and have it approved before you rely on it. The guide below explains what each section has to contain and what an auditor checks.

Your privacy policy needs this section when all three are true for a program you use. Answer them for each program that touches decisions about people. If you are unsure about a part, the OAIC's advice is to take the cautious approach and include it.

1. Part 1

   Have you arranged for a computer program to make a decision, or to do something substantially and directly related to making it?

   Any computer program counts: rule-based software, a spreadsheet formula, machine learning, a generative AI tool. So does one a vendor runs for you, because you arranged for it. A score, ranking or recommendation is substantially and directly related to a decision when it is a key factor in the person's decision and directly connected to it, even though the person makes the final call.

2. Part 2

   Could the decision reasonably be expected to significantly affect someone's rights or interests?

   The effect has to be more than trivial, and can be good or bad for the person. APP 1.9 gives examples: decisions about a benefit under a law, a person's rights under a contract, or their access to a significant service or support. The OAIC treats access to housing, employment, healthcare and aged care, education, financial assistance, essential banking and credit, telecommunications and essential utilities as generally in scope. Refusing or failing to decide is itself a decision.

3. Part 3

   Is personal information about the person used in running the program?

   Information about the person the decision is about, including information you get from someone else, such as a credit or tenancy database check.

It applies to organisations the Privacy Act covers, which leaves out most businesses with an annual turnover of $3 million or less unless an exception applies. See does the Privacy Act cover your business?

6

sections

2

with real wording

5

questions to answer

6

failure modes

a few hours

to write it yourself

APP 1.8 asks for three things: the kinds of personal information the programs use, the kinds of decisions they make on their own, and the kinds of decisions where they do something substantially and directly related to a person's decision. Describe each in categories a reasonable person understands, without technical detail. Two clauses decide whether the section is accurate, so those come with example wording.

1. 1

   Opening statement

   What it must contain

   One or two sentences: you use computer programs to make or help make decisions that could significantly affect people, and this section explains the information and decisions involved.

   What to check

   That it reads as part of your privacy policy and describes what you do now. The law's start date is not the date your practices began, so do not date the section or the practices it describes.

2. 2

   How we use computer programs in decisions

   What it must contain

   The kinds of program and what they are used for, in categories a reasonable person understands: assessing applications, detecting fraud, setting prices. AI and ordinary software both count.

   What to check

   Plain categories, with no technical detail and no trade secrets. APP 1.8 asks for kinds of decisions and information, not how a model works.

3. 3

   The personal information these programs use

   What it must contain

   The kinds of personal information used in running the programs (APP 1.8(a)), grouped meaningfully, with any sensitive information, such as health information, named separately.

   What to check

   That the list matches what the programs really draw on, including information from outside sources.

4. 4

   Decisions made by computer programs alone

   What it must contain

   The kinds of decisions made solely by a program, with no person making them (APP 1.8(b)). If there are none, say so in one sentence.

   What to check

   That every fully automatic decision is here, described plainly enough that the person affected recognises it.

   Applications that score below a set threshold are declined automatically, without a person looking at them.

   It names the decision and its trigger in plain words, and says plainly that no person is involved.

5. 5

   Decisions computer programs help us make

   What it must contain

   The kinds of decisions a person makes where a program does something substantially and directly related to making them, such as a score or recommendation the person relies on (APP 1.8(c)).

   What to check

   An accurate account of who decides. Do not say a person reviews every decision, or can override the program, unless that is true.

   Our staff decide all other applications, relying on the program's score and the checks it runs.

   It says who decides and how much the program shapes the decision, without promising discretion or a review the business does not provide.

6. 6

   Questions about these decisions

   What it must contain

   Where to ask about a decision and how to complain, pointing to your privacy contact and, if the Act covers you, the OAIC.

   What to check

   No promise of a review or an explanation you do not provide. The privacy policy rule is about transparency.

Get it written for your business - your first document is free Card required; no charge today.

The section in your policy is the public half. The other half is a register of every program you use in decisions about people, each assessed against the test, with the wording your policy needs for the ones in scope. It is how you answer these questions, and how the section stays true as your software and suppliers change.

? Which of your programs are in scope, and why?

Satisfies A register of the programs you use in decisions about people, each assessed against the three-part test with its result recorded.

Fails A section written from memory, with nothing behind it.

? Why is this decision significant?

Satisfies A reason recorded for each program, such as its effect on someone's access to housing, credit, employment or an essential service.

? What information does it actually use?

Satisfies Kinds of information that match the program's real inputs, including data from third parties.

? Who makes the final call?

Satisfies An accurate split between decisions the program makes alone and decisions a person makes with its help.

Fails "All decisions are reviewed by a person" when some are declined automatically.

? How do you keep it current?

Satisfies A rule that staff report new programs and AI tools before relying on them, and a review whenever a program or its provider changes.

• ! Thinking a human in the loop takes you out of scope

  A program whose score or recommendation is a key factor in a person's decision is doing something substantially and directly related to it. It is in scope even when the person makes the final call.

• ! Waiting until 10 December

  The rule applies to decisions made from that date, including by programs you already use. The section has to be in your privacy policy when the day begins.

• ! Forgetting software you did not build

  A screening, scoring or AI tool from a vendor counts if you arranged to use it in your decisions. The obligation sits with you, not the vendor.

• ! Describing the algorithm

  APP 1.8 asks for kinds of information and decisions in plain categories. Technical detail confuses readers and can give away trade secrets you do not have to disclose.

• ! Promising a review you do not offer

  The rule is about transparency, not a right of review. Offering a review on request is fine if you do it; promising one you do not provide is a commitment you can be held to.

• ! No record behind the section

  Keep an automated decision inventory: each program, the decisions it makes or informs, the information it uses and its assessment. It is how the section stays accurate as your software changes.

The cover in the hero and the page below are the section above run through PolicyMint's export path, with an example company's branding applied. Generated for your business, it names the programs you really use, the information they draw on and who makes the final call, checked against APP 1.7 and 1.8 before you see it. The full Privacy Act pack also writes your privacy policy and the decision inventory behind it.