Mandatory Tools & Artefacts · Privacy Act stream
Updated Privacy Policy
Updated 10 Dec 2025
Under the new Schedule 2 to the Privacy Act, the APP 1 privacy policy becomes the public-facing artefact for ADM transparency. It must be updated before the 10 December 2026 commencement and kept current.
Key obligations
- Add an ADM section listing the kinds of personal information used.
- Describe the kinds of decisions made solely or substantially by automated means.
- Specifically call out decisions that have a legal or similarly significant effect.
- Explain how individuals can seek information about, or challenge, an automated decision.
- Review and refresh whenever new ADM systems are introduced.
Key dates
- 10 Dec 2026Updated APP 1 privacy policy must be live.
Who is affected
- Every APP entity that uses or plans to use ADM with personal information.
- Includes vendors providing ADM as a service to APP entities — your customers will need disclosures from you.