From December 2026, must a conveyancer's privacy policy disclose automated decision-making?
Possibly: only if your software crosses a line. From 10 December 2026, APP 1.7 requires your privacy policy to disclose automated decision-making: where a computer program uses personal information to make, or substantially and directly support, a decision reasonably expected to significantly affect a person's rights or interests. Whether your VOI or screening tools qualify is fact-specific.
By Jon Oates, Founder of Privaproof · Last updated
‹ Conveyancer privacy compliance hub
General information, not legal advice. Your obligations depend on your circumstances.
What is the new rule?
The Privacy and Other Legislation Amendment Act 2024 inserts a new APP 1.7 into the Privacy Act, requiring transparency about automated decision-making (ADM) in an entity's privacy policy. It commences on 10 December 2026 (24 months after the Act received assent). For a conveyancer that is a reporting entity, it applies to the AML-connected personal information the Privacy Act already reaches via s 6E(1A).
Note the key point up front: this is a privacy-policy disclosure obligation. It doesn't ban automated decision-making or require you to change your tools; it requires you to tell people about qualifying automated decisions in your policy.
When is APP 1.7 triggered?
APP 1.7 is triggered where an entity uses a computer program, using an individual's personal information, to make a decision, or to substantially and directly support the making of a decision, that could reasonably be expected to significantly affect the individual's rights or interests.
Two parts of that test do the work: the decision has to be materially driven by the software (not just informed by it), and it has to be one that could significantly affect a person's rights or interests. Both need to be met.
What would the policy need to say?
Where the rule applies, the privacy policy must set out:
- the kinds of personal information used in the automated decision-making;
- the kinds of decisions made solely by automated means; and
- the kinds of decisions substantially based on automated means that could significantly affect a person's rights or interests.
What's the conveyancer angle, and why does it stay conditional?
This is where care is needed. Conveyancers increasingly use electronic VOI, identity-verification (IDV) and PEP/sanctions-screening software. Some of those tools might fall within APP 1.7, if they make, or substantially support, a decision that significantly affects a person's rights or interests. But whether a given tool actually crosses that threshold is fact-specific and not yet settled: a tool that simply returns a verification result a human then acts on may sit differently from one that effectively decides an outcome. OAIC guidance on ADM transparency was still being finalised in 2026.
So the honest position is conditional: if you use software that significantly affects a person's rights or interests in the way the test describes, your privacy policy will need to disclose it from 10 December 2026, but don't assume every VOI or screening tool automatically qualifies. It's a "review your tools and take advice," not an automatic obligation.
| Question | Where it lands |
|---|---|
| Does APP 1.7 apply to every conveyancer? | No, only where a tool meets the "significantly affect rights or interests" test |
| What triggers it? | Software that makes, or substantially and directly supports, a qualifying decision using personal information |
| What's the obligation? | Disclose the ADM in your privacy policy; it's transparency, not a ban |
| When? | From 10 December 2026 |
Why does it belong on your radar now?
Even though it's conditional, APP 1.7 is a good example of why compliance is a moving target rather than a one-off. A privacy policy written for 1 July 2026 may need updating for 10 December 2026, which is exactly the kind of change a conveyancer's policy has to keep pace with. For the policy itself, see Do conveyancers need a privacy policy in 2026?; for how the Privacy Act reaches you at all, see Does becoming an AUSTRAC reporting entity trigger the Privacy Act?.
Common questions
Does APP 1.7 mean I can't use VOI software?
No. It's a transparency rule about your privacy policy, not a ban on automated tools. Where it applies, you disclose the automated decision-making; you don't have to stop using the software.
Does every VOI or identity-check tool trigger it?
Not automatically. It only applies where the tool makes, or substantially supports, a decision that could significantly affect a person's rights or interests, which is fact-specific. Review your tools and take advice rather than assuming.
When does it start?
10 December 2026: 24 months after the Privacy and Other Legislation Amendment Act 2024 received assent.
What do I actually have to write in my policy?
The kinds of personal information used, the kinds of decisions made solely by automated means, and the kinds substantially based on automated means that could significantly affect someone's rights or interests.
This is general information, not legal advice. Privaproof provides privacy tools and general information; it is not a law practice and does not provide legal advice, and it does not assess your AML/CTF obligations, which are administered by AUSTRAC. Privaproof's conveyancer materials are self-authored and are not independently reviewed by a solicitor. Sources: OAIC, automated decision-making and privacy; OAIC, consultation on transparency in automated decision-making; Privacy Act 1988 (Cth).