From 10 December 2026, must a real-estate agency's privacy policy disclose automated decision-making?
Only if your tools cross a line. From 10 December 2026, APP 1.7 requires your privacy policy to disclose automated decision-making: where a computer program uses personal information to make, or substantially and directly support, a decision that could reasonably be expected to significantly affect a person's rights or interests. In real estate, automated tenancy screening or application scoring is the most likely trigger. Whether your tools qualify is fact-specific.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What is the APP 1.7 automated-decision-making rule?
The Privacy and Other Legislation Amendment Act 2024 inserts a new APP 1.7 into the Privacy Act 1988 (Cth), requiring transparency about automated decision-making (ADM) in your privacy policy. It commences on 10 December 2026, which is 24 months after the Act received assent.
The key point up front: this is a privacy-policy disclosure obligation. It does not ban automated decision-making, and it does not force you to change your tools. It requires you to tell people about qualifying automated decisions in your policy.
When is the ADM disclosure obligation triggered?
APP 1.7 applies where you use a computer program, using an individual's personal information, to make a decision, or to substantially and directly support making a decision, that could reasonably be expected to significantly affect the individual's rights or interests.
Two parts of that test do the work: the decision has to be materially driven by the software, not just informed by it, and it has to be one that could significantly affect a person's rights or interests. Both need to be met.
What must a privacy policy say about automated decisions?
Where the rule applies, your privacy policy must set out:
- the kinds of personal information used in the automated decision-making;
- the kinds of decisions made solely by automated means; and
- the kinds of decisions substantially based on automated means that could significantly affect a person's rights or interests.
Where does APP 1.7 most likely apply in real estate?
Property management is where this matters most, because tenancy decisions directly affect a person's rights and interests. Watch for:
- Automated tenancy screening or application scoring. If a platform ranks, scores or filters rental applicants using their personal information, and that materially drives who is approved or rejected, it may cross the APP 1.7 line. Deciding who gets a home sits close to the heart of "significantly affects a person's rights or interests".
- Automated background, credit or identity checks that effectively decide an outcome, rather than simply returning a result a person then weighs up.
Whether a given tool actually crosses the threshold is fact-specific and not yet settled. A tool that returns a report a property manager then uses to make the call may sit differently from one that effectively decides the outcome. OAIC guidance on ADM transparency was still being finalised in 2026.
So the honest position is conditional: if you use software that significantly affects a person's rights or interests in the way the test describes, your privacy policy will need to disclose it from 10 December 2026. Do not assume every screening or check tool automatically qualifies. It is a "review your tools and take advice", not an automatic obligation.
| Question | Where it lands |
|---|---|
| Does APP 1.7 apply to every agency? | No, only where a tool meets the "significantly affect rights or interests" test |
| What triggers it? | Software that makes, or substantially and directly supports, a qualifying decision using personal information |
| Most likely trigger in real estate? | Automated tenancy screening or application scoring |
| What is the obligation? | Disclose the automated decision-making in your privacy policy; it is transparency, not a ban |
| When? | From 10 December 2026 |
Why does APP 1.7 matter for agencies now?
Even though it is conditional, APP 1.7 is a clean example of why privacy compliance is a moving target, not a one-off. A privacy policy written for 1 July 2026 may need a new section for 10 December 2026. That is exactly the kind of change your policy has to keep pace with. A privacy policy that is kept current carries an automated decision-making section ready ahead of the deadline, so you are not scrambling to add it later. For the policy itself, see do real estate agents need a privacy policy and a collection notice?; for the wider picture, see the 2026 real-estate privacy guide.
Common questions
Does APP 1.7 mean I can't use tenancy screening software?
No. It is a transparency rule about your privacy policy, not a ban on automated tools. Where it applies, you disclose the automated decision-making. You do not have to stop using the software.
Does every screening or application tool trigger it?
Not automatically. It applies only where the tool makes, or substantially supports, a decision that could significantly affect a person's rights or interests, which is fact-specific. Review your tools and take advice rather than assuming.
When does it start?
10 December 2026, which is 24 months after the Privacy and Other Legislation Amendment Act 2024 received assent.
What do I actually have to write in my policy?
The kinds of personal information used, the kinds of decisions made solely by automated means, and the kinds substantially based on automated means that could significantly affect someone's rights or interests.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: OAIC: automated decision-making and privacy; OAIC: APP 1 guidelines; MinterEllison: Privacy and Other Legislation Amendment Act 2024 now in effect.