The 10 December 2026 automated-decision rule and your ATS: what recruiters must disclose

From 10 December 2026, Australian privacy law adds a new transparency duty (APP 1.7): if a computer program uses personal information to make, or substantially and directly support, a decision that could reasonably be expected to significantly affect a person, your privacy policy must say so. In recruitment, that squarely reaches an applicant-tracking system that scores, ranks, shortlists or auto-rejects candidates. It is a disclosure rule, not a ban. You can keep using your tools, but from that date your privacy policy is expected to disclose that you use them.

By Jon Oates, Founder of Privaproof · Last updated 23 July 2026

General information, not legal advice. Privaproof is not a law practice. This page describes the rule; it does not assess whether any particular automated decision in your process is lawful.

What the rule actually says

The Privacy and Other Legislation Amendment Act 2024 inserts a new requirement, APP 1.7, into the Australian Privacy Principles. It commences 10 December 2026. In plain terms, your privacy policy must disclose automated decision-making where:

a computer program is used,
to make a decision, or to substantially and directly support the making of a decision,
the decision uses personal information, and
the decision could reasonably be expected to significantly affect an individual's rights or interests.

Where that test is met, the privacy policy must set out the kinds of decisions involved, the kinds of personal information used, and that automated decision-making is happening. It is a transparency obligation, not a prohibition, and it lives in your privacy policy.

Does it reach your ATS?

For most recruiters, the honest answer is: quite possibly, and here is how to think about it rather than assume either way.

A computer program is used. An applicant-tracking system, a resume-screening tool, a candidate-scoring or ranking algorithm, a knockout-question auto-reject, or an AI video-interview assessor are all computer programs using personal information.
It makes or substantially supports a decision. If the system auto-rejects, or ranks and shortlists so that a human only ever sees the top of a machine-sorted list, it is at least substantially and directly supporting the decision, even if a person clicks the final button. A human who rubber-stamps the machine's output may not take the decision outside the rule.
The effect is significant. Whether someone is shortlisted for, or screened out of, a job is the kind of outcome that can reasonably be expected to significantly affect a person's interests.

Where all of that holds, the disclosure duty applies. Whether a specific configuration of your ATS crosses the line is fact-dependent, so this is a point to work through for your own process rather than to assume confirm against your actual tool and workflow, and against the OAIC's finalised guidance.

What it is not

It is not a ban on automated hiring tools. You can keep using your ATS, scoring and screening. The rule asks you to be transparent about it, not to stop.
It is not a general right to a human decision, in itself. APP 1.7 is a privacy-policy disclosure obligation. Other duties may bear on how you screen (discrimination law, for example), but the 10 December 2026 change specifically is about disclosure.
It is not only for big employers. The obligation attaches to entities covered by the Australian Privacy Principles. For a recruitment agency, remember that candidate data generally sits under the APPs regardless of the employee-records exemption. Read: does the Privacy Act apply to recruitment agencies?

What to do before 10 December 2026

1. Map where automation touches a candidate decision: application scoring, keyword filtering, ranking, knockout questions, video or assessment scoring, and any third-party screening tool. 2. Decide, for each, whether it makes or substantially supports a significant decision about the candidate. 3. Update your privacy policy to disclose the automated decision-making: the kinds of decisions, the kinds of personal information used, and that automation is involved. 4. Check your vendors. If a third-party ATS or screening provider runs the automation, you still owe the disclosure, so you need to know what their tool does. 5. Keep it current. OAIC guidance on this rule was being finalised, so the wording you use should be reviewed against the current guidance as it lands. This is exactly the kind of change a kit that is kept current as the law changes is meant to carry for you.

Common questions

Does an ATS that just filters keywords count?

It can. If keyword filtering screens candidates out before a human sees them, it is at least substantially and directly supporting the decision. The test is the effect on the candidate, not how simple the algorithm is. Work it through for your own filter rather than assuming a simple rule is exempt.

We have a human make the final call. Are we out?

Not necessarily. If the human only ever reviews a machine-ranked shortlist, or signs off the system's recommendation without genuinely making the decision, the automation may still be "substantially and directly supporting" the decision, which is enough to trigger disclosure. A genuine, informed human decision is different from a rubber stamp.

Is this the same as the European "right to an explanation"?

No. The Australian rule commencing 10 December 2026 is a privacy-policy transparency obligation (APP 1.7). It is narrower than some overseas regimes. Do not import overseas requirements; work from the Australian rule.

What happens if we do nothing?

From 10 December 2026, a privacy policy that should disclose automated decision-making and does not is non-compliant with APP 1. The practical fix is small (a policy update) if you start before the date, which is the point of flagging it now.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice, and does not assess whether any particular automated decision in your recruitment process is lawful. The automated-decision-making rule commences 10 December 2026 and the regulator's guidance was still being finalised, so confirm you are working from the current guidance. Privaproof's recruitment documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.