Automated decisions under the Privacy Act: what law firms must disclose

By Michael Nadalin, Founder, Market Lead · 30 September 2026 · 7 min read

On 10 December 2026, a new transparency obligation in the Privacy Act 1988 (Cth) commences. If your firm uses a computer program to make a decision, or to do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect an individual's rights or interests, your APP privacy policy will need to say so. It will need to set out the kinds of personal information the program uses and the kinds of decisions involved.

Most practitioners heard about the Privacy and Other Legislation Amendment Act 2024 when it received Royal Assent in December 2024. They registered the statutory tort, then moved on. The automated decision provisions had a two year runway, and that runway is nearly over. Many firms now have AI embedded in intake, conflict checks, billing and recruitment, often without anyone formally deciding to adopt it.

This article covers what the reform actually requires, which firm uses are likely to be caught and which are not, and a workable way to get your privacy policy right before the commencement date. It does not repeat the vendor pitch that any AI use is now a compliance crisis. It isn't.

What changed, and when

The 2024 amending Act was the first tranche of the government's response to the Privacy Act Review. Some parts took effect straight away, including new OAIC enforcement tools such as infringement notices and a tiered civil penalty regime. The statutory tort for serious invasions of privacy commenced in June 2025. The automated decision transparency provisions were deliberately deferred for 24 months so that entities had time to map their systems.

The obligation sits in APP 1, which already requires a clearly expressed, up to date privacy policy. The new provisions add a disclosure requirement. They do not ban automated decisions, require human review, or create a right to an explanation of an individual decision. It is a transparency obligation, and it should be treated as one. Anyone telling you it requires more than that is describing reforms that have been proposed but not legislated, and you should check the current status of any second tranche before relying on commentary about it.

The three elements that trigger the obligation

The obligation applies only when three things line up. First, a computer program is used. That term is broad: it covers traditional rule based software as well as machine learning and generative AI, so the question is not whether something is badged as AI. Second, the program makes the decision itself, or does something substantially and directly related to the making of the decision. Third, the decision could reasonably be expected to significantly affect the rights or interests of an individual.

The middle element matters most for firms. A program that scores, ranks, filters or recommends, with a human then signing off, may still be caught if its output is substantially and directly related to the decision. A partner who approves nine out of ten system recommendations without reading the file will not take the process outside the provision.

The Act gives examples of significant effects, including decisions about an individual's rights under a contract, agreement or arrangement, and decisions affecting access to a significant service or support. For a law firm, whether to act for someone is the obvious candidate.

Which law firm uses are likely to be caught

Rank your uses by how directly the program shapes a decision about a person. Near the top are automated intake and matter acceptance tools that screen out enquiries by matter type, value or prospects before a solicitor ever sees them. Credit and fee arrangement decisions come next, where a system decides who gets a costs agreement on deferred terms, or flags a client for a debt recovery referral. Recruitment is worth a separate look. The employee records exemption covers acts directly related to current or former employment relationships, so it does not obviously extend to candidates screened out by software.

Conflict checking is harder. A conflict search that produces a hit leading to refusal of instructions affects a prospective client. Most firms treat conflict searching as a mechanical input to a professional judgement, but the question under the provision is whether the program's output is substantially and directly related to the decision, and it often will be. At the bottom of the scale are tools that support legal work without deciding anything about a person: research, drafting assistance and document summarisation. Those raise confidentiality and privilege questions, not APP 1 automated decision questions.

Does the Privacy Act even apply to your firm?

Before spending money on this, check whether your firm is an APP entity at all. The small business exemption still excludes most businesses with an annual turnover of $3 million or less, subject to exceptions such as those providing health services or trading in personal information. Plenty of sole practitioners and small firms fall under that threshold. Mid tier and national firms do not.

Do not stop at the exemption, though. The statutory tort for serious invasions of privacy is not limited to APP entities, and it applies to intentional or reckless invasions. Your professional obligations do not depend on turnover either. Rule 9 of the Australian Solicitors' Conduct Rules, as adopted in each jurisdiction, applies to every solicitor whatever the size of the firm. Courts are also setting their own expectations about AI use in proceedings, most prominently the Supreme Court of New South Wales in its generative AI practice note. Small firms that are exempt from APP 1 still carry most of the risk that matters.

A practical plan for the next ten weeks

The work is not large, but it involves people who rarely talk to each other: the practice manager who bought the intake software, the finance team running credit checks, HR, and whoever owns the privacy policy. The biggest risk is not bad drafting. It is not knowing what the systems do. Vendors often describe features in marketing terms, so ask them in writing what personal information the product processes and what outputs it produces about individuals.

When drafting, describe kinds of personal information and kinds of decisions in plain language. Separate decisions made solely by a program from those where the program does something substantially and directly related to a human decision, because the provisions treat those two categories separately. Do not paste in a generic paragraph about AI, which tells the reader nothing and invites scrutiny. Then set a review trigger so that any new tool touching client or candidate decisions goes through the same check before it goes live.

Where research tools fit, and where they do not

Legal research and drafting tools are rarely the problem under the automated decision provisions, because they are not making decisions about individuals. That does not make them risk free. The OAIC's guidance on commercially available AI products recommends that organisations avoid entering personal information, especially sensitive information, into publicly available generative AI tools. Your duty of confidentiality points the same way. The questions to put to any research tool are where client material goes, whether it is used to train models, and whether it leaves Australia.

A tool like Legal Brain belongs in the research category: it helps a solicitor or barrister find and test authority, and the lawyer makes the professional judgement. Assess it on confidentiality and on the accuracy of its citations, not under APP 1. Keep your automated decision review focused on the systems that decide who your firm acts for, on what terms, and who it hires. That is where the new obligation applies.

Frequently asked questions

When do the Privacy Act automated decision making rules start?

The APP 1 automated decision transparency obligations commence on 10 December 2026. They were introduced by the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024 with a 24 month delay for these provisions.

Does my law firm need to update its privacy policy for AI?

Only if your firm is an APP entity and uses a computer program to make, or do something substantially and directly related to, decisions that could reasonably be expected to significantly affect an individual's rights or interests. Automated intake, fee terms and candidate screening are the usual candidates. Research and drafting tools generally are not.

Are small law firms exempt from the Privacy Act?

Most businesses with an annual turnover of $3 million or less are exempt under the small business exemption, subject to specific exceptions. Exempt firms remain bound by their professional confidentiality obligations. The statutory tort for serious invasions of privacy is also not limited to APP entities.

Do the reforms require a human to review automated decisions?

No. The first tranche creates a disclosure obligation in the privacy policy. It does not create a right to human review or to an explanation of individual decisions. Check the current status of any further reforms before relying on commentary that suggests otherwise.