Australia's privacy regulator has opened consultation on guidance for new transparency rules. The rules will force organisations to disclose how they use automated decision-making (ADM) systems.

The Office of the Australian Information Commissioner (OAIC) released the Issues Paper on 18 May. Submissions close 15 June 2026.

The obligation commences on 10 December 2026. It was introduced by the Privacy and Other Legislation Amendment Act 2024 and sits within Australian Privacy Principle 1.

Affected entities must disclose in their privacy policy how computer programs use personal information. The trigger is decisions that could significantly affect an individual's rights or interests.

The OAIC said the obligation will “improve integrity, accountability and trust” at a moment of widespread technological change. The regulator intends to release final guidance by September 2026.

Three criteria must be met for the obligation to apply. The entity must have arranged for a computer program to make or substantially assist a decision. The decision must reasonably be expected to significantly affect rights or interests. Personal information must also be used in the program's operation.

Disclosure must cover the kinds of personal information used. It must also cover the kinds of decisions made solely by the program. The disclosure extends to decisions for which the program does something substantially and directly related.

OAIC research found 89 per cent of Australians believe they have the right to know when their personal information is used in ADM. A further 86 per cent believe government should publicly report on technology used to inform decision-making.

Australian Privacy Commissioner Carly Kind announced the consultation on LinkedIn. She described the change as an important right and protection for Australian consumers increasingly concerned about how their information is used in AI systems.

The Issues Paper sets out questions on contested terms. These include substantially and directly related, significantly affect rights or interests, and arranged for. The paper also presents fictional edge cases.

The edge cases cover generative AI used to recommend aged-care eligibility, differential pricing based on residential postcode, and an algorithm that promotes engineering job ads predominantly to male candidates.

The OAIC has flagged third-party ADM as a focus area. Entities will need to consider whether they have arranged for ADM or merely operate it.

Examples of arranged-for ADM include procuring an AI system to screen job applications. Another is directing staff to use an AI chat tool to draft performance assessments. Contracting third-party software to approve or decline refunds is also captured.

Commercial-in-confidence information about ADM systems is excluded from disclosure under the Explanatory Memorandum to the amendment Act.

The Issues Paper notes the obligation operates alongside other frameworks. These include anti-discrimination law, administrative law, the Freedom of Information Act and the General Insurance Code of Practice. The paper also references the Trust Framework for Government Use of AI and ADM. It cites UK Information Commissioner's Office guidance on explaining decisions made with AI.

Submissions can be sent to privacyreformtranche1@oaic.gov.au. The Issues Paper and submission form are available here.