Automated decisions in your privacy policy: example wording

From 10 December 2026, if a computer program makes, or substantially helps make, a decision about a person that could reasonably be expected to significantly affect their rights or interests, your privacy policy has to say so. APP 1.8 asks for three things: the kinds of personal information the program uses, the kinds of decisions it makes on its own, and the kinds of decisions it helps a person make. It applies to decisions made from that date, even if the workflow behind them was built years ago. Our explainer on the 10 December Privacy Act change covers why the rule exists and whether a HubSpot workflow counts.

The wording can be short. The OAIC's own worked examples add a section headed "Decisions made by computer programs" with two lists: the kinds of personal information, then the kinds of decisions. Below is example wording for five common HubSpot and AI setups.

Lead scoring that decides who gets a sales call, automated credit or payment terms, and a chatbot or AI agent that decides who reaches a person are the setups most likely to need a line. An AI-drafted quote that a person checks and prices is usually outside the rule. This is general information and example wording, not legal advice. Change it to match what your systems actually do, and have a lawyer review it before you publish.

What exactly does the privacy policy have to disclose?

APP 1.7 to 1.9 were added by the Privacy and Other Legislation Amendment Act 2024 and start on 10 December 2026, 24 months after Royal Assent. The obligation applies when three things are true at once:

• You arranged it. You arranged for a computer program to make a decision, or do something substantially and directly related to making it. Configuring HubSpot or buying an AI tool counts.
• It matters to the person. The decision could reasonably be expected to significantly affect the rights or interests of an individual.
• Their information goes in. Personal information about that individual is used when the program runs.

When all three are true, APP 1.8 says your policy must contain:

• The kinds of personal information used by those programs.
• The kinds of decisions made solely by a program, with no person deciding.
• The kinds of decisions where a program does something substantially and directly related to making them. The OAIC reads "substantially" as a key factor in the person's decision, and "directly" as a direct connection to it. A score or recommendation your team usually follows fits here.

Two details in APP 1.9 change how you write it. Making a decision includes refusing or failing to make one, so a score that means nobody calls someone back is a decision. And a decision counts whether it helps or hurts the person. The same Act also added APP 1.7 to the short list of principles the OAIC can issue an infringement notice for.

From APP 1.7 and 1.8 of the Privacy Act, for decisions made from 10 December 2026.

What does "significantly affect rights or interests" mean in plain English?

The OAIC's fact sheet says the effect must be more than trivial and must have the potential to considerably influence the person's circumstances or outcomes. The Act's examples that matter for most businesses are a decision affecting someone's rights under a contract, agreement or arrangement, and one affecting their access to a significant service or support. The OAIC's list of decisions generally in scope includes loan and credit approvals, insurance eligibility, recruitment software that sorts candidates, personalised pricing on significant goods, and programmatic advertising for significant goods or services.

Three points help when you are unsure:

• Small amounts can still be significant. In the OAIC's grocery pricing example, differences of $0.89 to $3.72 an item added up to $132 more for one shopper's baby formula over a year.
• Vulnerability raises the stakes. A decision can weigh more on a person experiencing vulnerability.
• If in doubt, disclose. The fact sheet tells businesses in doubt to take a cautious approach and include the information.

One more point is our reading, so check it with your lawyer. The rule protects individuals. Where your customer is a consumer, a sole trader or a guarantor, a decision about the account is a decision about a person. Where you sell to large companies, a score on the contact is less likely to affect that person's own rights.

Which HubSpot and AI setups are likely in scope?

The test is what the decision does to the person. How clever the software is does not matter: the OAIC's list of computer programs runs from rule-based processes to machine learning and chatbots. Here is how we would sort the setups we see most often.

If your routing hands leads to staff in New South Wales, a separate law looks at the effect on your team. We covered it in does NSW's AI work law cover your lead routing.

Example wording for five common setups

Each example names the kinds of information and the kind of decision, and says whether a program decides on its own or helps a person decide. Replace everything in square brackets with what your systems actually use. The "we" in each example is your business.

Lead scoring that decides who gets a sales call

Example wording: When you enquire, our CRM gives your enquiry a score using [your contact details, your role and organisation, the pages you have visited on our website, the marketing emails you have opened, and what you told us in your enquiry]. The score decides automatically whether a member of our sales team calls you and how quickly. Enquiries below a set score are sent information by email instead of a call.

If your reps see the score and choose who to call, list it as a decision a program helps your team make: the score helps our sales team decide which enquiries to follow up first.

Automated lead routing

Example wording: We use automated rules to send each enquiry to a member of our team, based on [your state or territory, the product or service you asked about, and the size of your organisation]. The rules decide which team responds to you and [how quickly / whether you are offered a call or an online booking].

If every enquiry gets the same offer from an equally capable person, routing probably sits below the threshold. Include it if routing sends some people to a self-help queue, a different price list or a slower response.

A chatbot or AI agent that triages support or eligibility

Example wording: Our website chat assistant uses artificial intelligence. It uses [what you type into the chat, your name and email address, and your account and support history if you are logged in] to decide whether to answer your question itself or pass you to a member of our team, and to tell you whether you meet the criteria for [service or offer]. You can ask to speak to a person at any time by [how].

Keep the last sentence only if it is true. The OAIC says machine learning and generative AI outputs used in significant decisions will generally be in scope unless subject to extensive human oversight and control.

This video from our YouTube channel looks at where AI needs a human and where it does not.

Automated credit or payment terms

Example wording: When you apply for an account, our systems use [your name, ABN, trading history with us, payment history and credit information] to set your credit limit and payment terms. Some applications are approved, declined or given a lower limit automatically, without a person reviewing them.

If you use credit reports about individuals, the Privacy Act's separate credit reporting rules apply too. This is where a lawyer's read matters most.

AI-drafted quotes approved by a person: probably out of scope

If AI drafts the wording of a quote from your product library, and a salesperson checks it, sets the price and decides the terms, the person is making the decision. The program helps with typing. It is not a key factor in a decision that significantly affects the customer, so there is usually nothing to disclose.

Two things change that. One is a program that recommends the price or discount your reps nearly always accept. The OAIC says human review on its own does not take a decision out of scope; what does is real work, such as interrogating the output, checking the underlying data and writing down why the person departed from it. The other is prices that differ from person to person on significant goods. In either case, use something like:

Example wording: Our quoting system uses [your purchase history, the size of your organisation and your location] to recommend the price and any discount in your quote. A member of our team reviews and approves every quote before it is sent.

How do you put the section together?

Add one section to your existing privacy policy. A combined version for a business that scores leads, runs a support chatbot and sets credit terms automatically looks like this:

Decisions made by computer programs. We use computer programs, including artificial intelligence, to make or help make some decisions about you. They use these kinds of personal information: [contact details; role and organisation; website and email activity; what you tell us in enquiries and chat; account, support and payment history; credit information].

Decisions made automatically: whether and how quickly our sales team contacts you after an enquiry; whether our chat assistant answers you or passes you to a person; your credit limit and payment terms, for some applications.

Decisions our team makes with help from a computer program: which enquiries to follow up first; the price and discount recommended in a quote.

Questions: To ask for more information about these decisions, contact [our privacy officer at email address].

The OAIC's APP 1 guidelines and fact sheet add these rules:

• Plain language, grouped sensibly. Write it so people can understand it, without technical detail. You may group kinds of decisions and information, as long as the result means something to a reasonable person.
• Name sensitive information. If health information or biometric templates go in, say so clearly instead of hiding them in a group.
• Weights can stay private. How your model weights its inputs can stay out if it is genuinely commercial-in-confidence. The fact that personal information feeds the decision cannot, and information that would only embarrass you does not count as commercial-in-confidence.
• Ask your vendors. The obligation stays with you, and the OAIC expects software providers to give you clear, high-level information on how their tools make decisions.
• Keep it current. Review the policy at least yearly, date it, and add a line whenever someone builds a workflow that decides something about a person.

Someone in your business should be able to explain each line when a customer asks. If you have not named that person yet, our one-page AI policy has a place for it. For the other Australian rules that sit around this one, see AI governance in Australia, and for what the next round of reform could ask of your database, Privacy Act tranche 2.

Frequently asked questions

Does my privacy policy need to mention automated decision making? Yes, from 10 December 2026, if a computer program uses personal information to make or substantially help make decisions that could reasonably be expected to significantly affect people's rights or interests. The policy must list the kinds of information used, the kinds of decisions made solely by the program, and the kinds it helps a person make.

When does the automated decision making rule in the Privacy Act start? It starts on 10 December 2026 and applies to decisions made after that date. It does not matter when the program was set up or when the personal information was collected.

Does a human approving the decision take it out of scope? Not by itself. The OAIC says a decision can be in scope even when a person reviews the program's output, if that output is a key factor in the decision.

Do I have to explain how my algorithm or scoring model works? No. The policy needs the kinds of information and kinds of decisions, in plain language. Genuinely commercial-in-confidence detail, such as how a model weights its inputs, can stay out.

Does the automated decision making rule apply to small businesses? It applies to businesses covered by the Privacy Act. Most businesses with annual turnover of $3 million or less are exempt, but some are covered regardless, including health service providers and businesses that trade in personal information.

Sources

• Privacy and Other Legislation Amendment Act 2024, Federal Register of Legislation, for the text of APP 1.7 to 1.9, the 10 December 2026 start, the application to decisions made after it, and the infringement notice amendment.
• APP 1.7 to 1.9 Transparency Obligation Fact Sheet, OAIC, for the meaning of significantly, substantially and directly, the in-scope list, the worked examples and the level of detail.
• Chapter 1: APP 1, open and transparent management of personal information, OAIC, for plain language, layered policies and keeping the policy up to date.
• New resources on transparency for use of AI and automated decision making, OAIC, for the 30 September 2026 guidance release.
• Small business, OAIC, for the $3 million turnover threshold and the businesses covered regardless.

---

Working out which of your workflows, scores and AI agents make decisions about people, and what your policy should say about each, is part of our AI consulting work. Or talk to us.