The 10 December 2026 automated-decision rule and your ATS: what recruiters must disclose
From 10 December 2026, APP 1.7 requires an APP entity's privacy policy to contain the APP 1.8 information where three conditions are all met: the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; that decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about that individual is used in the operation of the program. In recruitment an applicant-tracking system that scores, ranks, shortlists or auto-declines candidates is the obvious candidate, and APP 1.9(a) counts refusing or failing to make a decision as making one. It is a disclosure rule, not a ban. And it binds APP entities only, so a small business operator with no s 6D(4) trigger is outside it whatever software it runs. We would rather tell you that.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice. This page describes the rule; it does not assess whether any particular automated decision in your process is lawful.
What the rule actually says
The Privacy and Other Legislation Amendment Act 2024 (Cth) inserts APP 1.7, 1.8 and 1.9 into the Australian Privacy Principles (Schedule 1, Part 15). They commence 10 December 2026, the date set in terms by item 7 of that Act's commencement table. APP 1.7 sets three cumulative conditions, all of which must be met:
- (a) the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision,
- (b) the decision could reasonably be expected to significantly affect the rights or interests of an individual, and
- (c) personal information about that individual is used in the operation of the computer program to make the decision or do the thing.
- A rider that matters in hiring: APP 1.9 counts refusing or failing to make a decision as making one, so an automated decline is a decision, and a beneficial effect counts as much as an adverse one.
Where all three are met, APP 1.8 sets what the policy must contain: the kinds of personal information used in the operation of those programs, the kinds of decisions made solely by them, and the kinds of decisions for which the program does a thing substantially and directly related to making the decision. Two different tests sit inside APP 1.7: "substantially and directly related" describes what the program does, while "significantly affect" describes the effect on the person. It is a transparency obligation, not a prohibition, and it lives in your privacy policy.
Does it reach your ATS?
One gate comes first. APP 1.7 binds APP entities, so if your agency is a small business operator under s 6D and no s 6D(4) trigger applies, the rule does not reach you at all. In recruitment two things commonly push an agency inside anyway, and they are set out below. If you are covered, work the three conditions rather than assuming either way.
- You have arranged for a computer program. An applicant-tracking system, a resume-screening tool, a candidate-scoring or ranking algorithm, a knockout-question auto-decline, or an AI video-interview assessor are all computer programs, and each is arranged by you or by a vendor on your behalf.
- It makes the decision, or does a thing substantially and directly related to making it. If the system auto-declines, the decision is made solely by the program, which is the APP 1.8(b) case, and APP 1.9(a) counts that refusal as a decision. If it ranks and shortlists so a human only ever sees the top of a machine-sorted list, the program is doing a thing substantially and directly related to making the decision, which is the APP 1.8(c) case. A person clicking the final button moves you from (b) to (c). It does not move you out of APP 1.7.
- The decision could reasonably be expected to significantly affect rights or interests. Being shortlisted for, or screened out of, a job is the kind of outcome that meets that description, though it is a test to apply to your own decisions rather than a given. APP 1.9(c) puts a beneficial effect on the same footing as an adverse one, so a tool that only advances candidates is not outside the rule because it never rejects anyone.
Where all three hold, the disclosure duty applies. Whether a specific configuration of your ATS crosses the line is fact-dependent, so work it through against your actual tool and workflow, and against the OAIC's guidance as it lands, rather than assume it either way.
What it is not
- It is not a ban on automated hiring tools. You can keep using your ATS, scoring and screening. The rule asks you to be transparent about it, not to stop.
- It is not a general right to a human decision, in itself. APP 1.7 is a privacy-policy disclosure obligation. Other duties may bear on how you screen (discrimination law, for example), but the 10 December 2026 change specifically is about disclosure.
- It is not automatic, and the first question is size. APP 1.7 binds APP entities. A small business operator at A$3 million turnover or less, with no s 6D(4) trigger, is outside the APPs entirely, whatever software it runs. Two things commonly pull a recruitment agency in: the employee-records exemption is about your own current and former staff and does not reach candidates, and supplying candidate information to employer clients for a benefit can engage the s 6D(4) trading limb, though the s 6D(7) consent carve-out will often answer that where the candidate asked to be put forward. Read: does the Privacy Act apply to recruitment agencies?
What to do before 10 December 2026
- Map where automation touches a candidate decision: application scoring, keyword filtering, ranking, knockout questions, video or assessment scoring, and any third-party screening tool.
- Decide, for each, whether it makes or substantially supports a significant decision about the candidate.
- Update your privacy policy to contain what APP 1.8 asks for: the kinds of personal information used in the operation of those programs, the kinds of decisions made solely by them, and the kinds of decisions the programs do a substantially and directly related thing towards.
- Ask your vendor a specific question. The duty sits with the entity that arranged for the program, so a third-party ATS or screening provider running the automation does not shift it. Does the tool score, rank or decline candidates, on what personal information, and does any decision come out of it with no human involved?
- Keep it current. OAIC guidance on this rule was being finalised, so the wording you use should be reviewed against the current guidance as it lands. This is exactly the kind of change a kit that is kept current as the law changes is meant to carry for you.
Common questions
Does an ATS that just filters keywords count?
It can. A knockout filter that screens candidates out before a human sees them is a decision made solely by the operation of the program, which is the APP 1.8(b) case, and APP 1.9(a) counts a refusal as a decision. What matters is whether the decision could reasonably be expected to significantly affect the candidate's rights or interests, not how simple the algorithm is. Work it through for your own filter rather than assuming a simple rule is exempt.
We have a human make the final call. Are we out?
Usually not, and the published shortcut is worth correcting: a human in the loop decides which disclosure you owe, not whether you owe one. A decision made solely by the program is APP 1.8(b). A decision a person makes after the program has done something substantially and directly related to making it, such as producing the ranked shortlist they choose from, is APP 1.8(c). Both sit inside APP 1.7. You are outside it only where the program's role is not substantially and directly related to the decision, or where one of the other two conditions is not met.
Is this the same as the European "right to an explanation"?
No. The Australian rule commencing 10 December 2026 is a privacy-policy transparency obligation (APP 1.7). It is narrower than some overseas regimes. Do not import overseas requirements; work from the Australian rule.
What happens if we do nothing?
From 10 December 2026, an APP entity whose privacy policy should contain the APP 1.8 information and does not is in breach of APP 1. Item 87 of the amending Act also adds APP 1.7 to the list in s 13K(1)(b), the Privacy Act's "civil penalty provision for which infringement notices or compliance notices can be issued", with a maximum under s 13K(4) of 200 penalty units. The fix itself is small, a privacy-policy update, if you start before the date.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice, and does not assess whether any particular automated decision in your recruitment process is lawful. The automated-decision-making rule commences 10 December 2026 and the regulator's guidance was still being finalised, so confirm you are working from the current guidance. For advice on your specific circumstances, consult a qualified Australian legal practitioner.