Source of Law / Policy · Privacy Act stream
Privacy Act 1988 (as amended 2024)
Regulator: OAIC · Legislation
LIVE / STAGEDUpdated 10 Dec 2025
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024 — the most significant overhaul of Australian privacy law since 1988. A new Schedule 2 introduces transparency obligations for automated decision-making (ADM) that uses personal information.
Key obligations
- Update your APP 1 privacy policy to disclose the kinds of personal information used in automated decisions, the kinds of decisions made solely or substantially by automated means, and the kinds of decisions where ADM has a legal or similarly significant effect on an individual.
- Identify which decisions are caught: those made solely by automated means, or where automated processing 'substantially' contributes to the decision.
- Establish internal governance to inventory ADM systems and keep the policy current as systems change.
- Be ready to explain ADM logic on request and to handle complaints to the OAIC.
Key dates
- 10 Dec 2024Royal Assent — Act commenced (most reforms staged).
- 10 Dec 2026ADM transparency obligations take effect (24-month transition).
Who is affected
- All APP entities — most businesses with annual turnover > A$3M, plus all Commonwealth agencies.
- Smaller businesses caught by carve-outs (health service providers, credit reporting, etc.).
- Any organisation using AI/ML to make or substantially contribute to decisions about individuals — credit, insurance, hiring, hardship, eligibility.