From 10 December 2026, must a real-estate agency's privacy policy disclose automated decision-making?
Only if you are an APP entity and your tools cross the line. From 10 December 2026, APP 1.7 requires an APP entity's privacy policy to contain the APP 1.8 information where the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests, using their personal information. In real estate, automated tenancy screening or application scoring is the most likely trigger. If your business is a small business operator, the APPs do not reach you at all unless a s 6D(4) trigger applies, and we will say so.
By Jon Oates, Founder of Privaproof · Last updated · Start the free 2-min audit →
General information, not legal advice. Your obligations depend on your circumstances.
Not sure it's you?
Does this apply to you?
Tap what's true for your agency. Nothing is saved.
Orientation only, not a compliance assessment. General information and tools, not legal advice.
What is the APP 1.7 automated-decision-making rule?
The Privacy and Other Legislation Amendment Act 2024 (Cth) inserts APP 1.7, 1.8 and 1.9 into the Privacy Act 1988 (Cth) through Schedule 1 Part 15, headed "Automated decisions and privacy policies". Its own commencement table (s 2, table item 7) gives the date as 10 December 2026.
The key point up front: this is a privacy-policy disclosure obligation. It does not ban automated decision-making, and it does not force you to change your tools. It requires you to tell people about qualifying automated decisions in your policy. The same Part (item 87) adds APP 1.7 to the s 13K(1)(b) list of APP breaches the Commissioner can act on by infringement notice without going to court, with the civil penalty capped by s 13K(4) at 200 penalty units.
When is the ADM disclosure obligation triggered?
APP 1.7 sets three cumulative conditions: (a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; (b) the decision could reasonably be expected to significantly affect the rights or interests of an individual; and (c) personal information about that individual is used in the operation of the computer program to make the decision or do the thing.
Two different tests sit in that sentence. "Substantially and directly related" describes what the program does; "significantly affect" describes the effect on the person. A human making the final call does not put you outside it: condition (a) reaches a program that does a thing substantially and directly related to making the decision, and APP 1.8(c) is the disclosure for that part-automated case.
What must a privacy policy say about automated decisions?
Where the rule applies, APP 1.8 sets out what the policy must contain:
- the kinds of personal information used in the automated decision-making;
- the kinds of decisions made solely by automated means; and
- the kinds of such decisions for which a thing substantially and directly related to making the decision is done by the program, which is the part-automated case.
Where does APP 1.7 most likely apply in real estate?
Property management is where this matters most, because tenancy decisions directly affect a person's rights and interests. Watch for:
- Automated tenancy screening or application scoring. A platform that ranks, scores or filters rental applicants on their personal information can be doing a thing substantially and directly related to making the decision, even where a property manager signs off. A tool that auto-declines is squarely in view: APP 1.9(a) says making a decision includes refusing or failing to make a decision. And APP 1.9(d)(iii) gives as an example "a decision that affects the individual's access to a significant service or support".
- Automated background, credit or identity checks. A check that decides the outcome is disclosed under APP 1.8(b); one that returns a result a person then weighs up can still be disclosed under APP 1.8(c), where the program's role is substantially and directly related to making the decision.
Whether a given tool crosses the threshold is fact-specific. But the difference between a tool that decides and one that a property manager weighs up is the difference between APP 1.8(b) and APP 1.8(c), not the difference between in and out. The OAIC's Guidance for Transparency in Automated Decision Making was still in development: it published its issues paper on 18 May 2026 and submissions closed on 15 June 2026.
Two limits are worth stating plainly. APP 1.7 binds APP entities only: if your business is a small business operator, s 6C(1) reads it out of "organisation" and the APPs do not reach it unless a s 6D(4) trigger applies, and the s 6D(4)(a) turnover trigger is one-way, so a later fall does not undo it. The second limit is the tool. So the question to put to your own agency is short: which of our tenancy tools uses an applicant's personal information to make, or help make, the call, and does our privacy policy name them?
| Question | Where it lands |
|---|---|
| Does APP 1.7 apply to every agency? | No. It binds APP entities only, and then only where a tool meets the "significantly affect rights or interests" test |
| What triggers it? | Software that makes, or substantially and directly supports, a qualifying decision using personal information |
| Most likely trigger in real estate? | Automated tenancy screening or application scoring |
| What is the obligation? | Set out the three kinds of APP 1.8 information in your privacy policy; it is transparency, not a ban |
| When? | From 10 December 2026 |
Why does APP 1.7 matter for agencies now?
Even though it is conditional, APP 1.7 is a clean example of why privacy compliance is a moving target, not a one-off. A privacy policy written for 1 July 2026 may need a new section for 10 December 2026. That is exactly the kind of change your policy has to keep pace with. A privacy policy that is kept current carries an automated decision-making section ready ahead of the deadline, so you are not scrambling to add it later. For the policy itself, see do real estate agents need a privacy policy and a collection notice?; for the wider picture, see the 2026 real-estate privacy guide.
Common questions
Does APP 1.7 mean I can't use tenancy screening software?
No. It is a transparency rule about your privacy policy, not a ban on automated tools. Where it applies, you disclose the automated decision-making. You do not have to stop using the software.
Does every screening or application tool trigger it?
Not automatically, and two things narrow it. APP 1.7 binds APP entities, so a small business operator with no s 6D(4) trigger is outside it whatever software it runs. Then the program has to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect a person's rights or interests.
When does it start?
10 December 2026. That is the date the commencement table in the Privacy and Other Legislation Amendment Act 2024 (Cth) gives for Schedule 1 Part 15, at s 2 table item 7.
What do I actually have to write in my policy?
APP 1.8 lists three things: the kinds of personal information used in the operation of such computer programs, the kinds of decisions made solely by them, and the kinds of decisions for which the program does a thing substantially and directly related to making the decision.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice. Sources: Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1 Part 15; OAIC: consultation on guidance for transparency in automated decision-making; OAIC: APP 1 guidelines.