NEWSFLASH: New privacy rules for automated decision-making - What NFPs and Charities Need to Know

From 10 December 2026, new automated decision-making privacy rules will come into force, affecting organisations covered by the Privacy Act 1988 (Cth).

The changes are set out in new Australian Privacy Principles (APPs) 1.7, 1.8, and 1.9.

These new APPs are designed to improve transparency by giving individuals more information about when and how automated systems use their personal information to make significant decisions about them.

The changes may be relevant to your charity or NFP if it is an APP entity using AI or other automated systems to make decisions that could significantly affect an individual’s rights or interests. Relevant scenarios might include where AI or other automated systems are used to:

• assess eligibility for financial assistance or services;
• prioritise access to programs; or
• make certain employment-related decisions.

What do the new APPs require?

When do the rules apply? – APP 1.7

An APP entity must include additional information in its privacy policy if:

• it uses a computer program to make, or substantially and directly contribute to the making of, a decision;
• that decision could reasonably be expected to significantly affect an individual’s rights or interests; and
• the individual’s personal information is used in the operation of the computer program to make or contribute to the making of the decision.

What must be disclosed? – APP 1.8

Where APP 1.7 applies, the organisation's privacy policy must explain the types of:

• personal information used;
• decisions made solely by the computer program; and
• decisions to which the program substantially and directly contributes by doing an ancillary thing.

What is a significant decision? – APP 1.9

APP 1.9 provides further detail relevant to APP 1.7, including what constitutes a “decision” and when an outcome may significantly affect a person's rights or interests.

What does this mean for charities and NFPs?

The changes may be relevant if your charity or NFP is an APP entity and uses AI or other automated systems to make decisions that affect an individual’s rights or interests. Failure to comply with the new requirements may constitute a breach of the Privacy Act 1988 (Cth) and attract enforcement action and penalties.

Not every charity or NFP is an APP entity. Organisations should first check whether the Privacy Act 1988 (Cth) applies to them.

When and how the new requirements apply will also depend on the nature of the decisions made and their potential impact on the individual.

What should organisations do now?

For those covered, the upcoming changes provide a timely opportunity to:

• review how AI and other automated systems are used within your organisation; and
• update privacy policies, as required.

We also encourage organisations to stay up to date with guidance published by the Office of the Australian Information Commissioner (OAIC) on the application of the new APPs.

How we can help

Please get in touch if we can assist with reviewing and updating your privacy policy and internal governance framework in preparation for the commencement of these new privacy requirements.

Need help navigating NFP or charity law?

We exclusively support charities and NFPs, so we have a specialised and in-depth knowledge of the practical legal, regulatory, and governance needs of these organisations.

Contact us today to review your compliance and ensure you are up to date.

Call us on 07 3160 0010, email reception@nfplawyers.com.au, or submit a contact form to arrange a consultation.