Australia’s 2026 Automated-Decision Privacy Rule: What Employers and Screening Providers Need to Know
Effective December 10, 2026, certain Australian organizations must disclose qualifying automated decisions in their privacy policies. The rule applies when a computer program uses an individual’s personal information to make, or materially help make, a decision that could significantly affect that person’s rights or interests.
For employers and background screening providers, the key point is simple:
This is not a new criminal background check requirement and it does not apply merely because information is collected, uploaded, emailed, stored, or provided through an electronic authorization form.
It is a privacy-policy transparency rule focused on meaningful automated decision-making.
What does Australia’s new rule require?
New Australian Privacy Principle (APP) provisions—APP 1.7, 1.8, and 1.9—take effect on December 10, 2026.
An APP entity must add information to its privacy policy when all three conditions are met:
The entity has arranged for a computer program to make a decision, or do something substantially and directly related to making a decision;
The decision could reasonably be expected to significantly affect an individual’s rights or interests; and
The computer program uses that individual’s personal information.
When the rule applies, the privacy policy must describe:
The kinds of personal information used by the computer program;
The kinds of decisions made solely by the program; and
The kinds of decisions where the program performs something substantially and directly related to the decision.
Read the official Office of the Australian Information Commissioner (OAIC) guidance and the Privacy and Other Legislation Amendment Act 2024.
Is this only about criminal background checks?
No. This is a general privacy rule, not a criminal-record rule.
It can apply to any Australia-linked activity involving qualifying automated decisions, including decisions affecting:
Employment or job opportunities;
Housing or tenant screening;
Credit, insurance, or contract rights;
Licensing or access to significant services; and
Other benefits, approvals, or eligibility decisions.
A criminal background check may be involved in an employment decision, but a background report alone does not automatically make the process “automated decision-making.”
What does not count as automated decision-making?
Every use of technology is not an automated decision.
The following are not, by themselves, the type of activity targeted by this new rule:
Activity | Usually a qualifying automated decision? |
Electronic authorization forms or e-signatures | No |
Automated email reminders or status updates | No |
Secure document upload, storage, or transmission | No |
A human researcher obtaining information from an authorized source | No |
A human reviewer providing a report without scoring or recommendation | No |
An employer’s final decision after human review | No, unless a computer program materially guided or recommended it |
An electronic authorization form simply records an applicant’s permission. It does not decide whether the person should be hired, approved, or denied.
When could a screening workflow be covered?
Human review does not automatically remove a workflow from the rule.
The requirement may apply when a computer program uses applicant data to do something that substantially and directly guides a consequential decision. Examples may include software that:
Automatically recommends “hire” or “do not hire”;
Scores, ranks, or prioritizes applicants;
Automatically identifies an applicant as disqualified;
Applies a rules-based risk score used to approve or deny someone;
Uses criminal-history information to direct a recruiter or manager toward an employment outcome; or
Uses applicant data to limit someone’s access to a job, housing opportunity, contract, or significant service.
The employer may still make the final decision, but a program that meaningfully recommends or guides that decision can still require privacy-policy disclosure.
What this means for GBS’s Australia criminal-check workflow
Global Background Screening’s current Australia criminal-check workflow is human-led.
With appropriate authorization, GBS provides the request to a human researcher, who obtains the information through the appropriate process. GBS does not use applicant data to automatically score, rank, recommend, approve, reject, or make a hiring decision.
That means the new APP automated-decision privacy-policy disclosure requirement does not apply solely because GBS:
Uses an online authorization form;
Sends an applicant reminder;
Stores authorization records;
Transmits a request to a human researcher; or
Delivers a human-researched result to the client.
GBS provides information and workflow support. The employer—not GBS—makes the hiring, contracting, leasing, licensing, or other eligibility decision.
What employers hiring in Australia should do
1. Identify actual automated decision tools
Review your ATS, HR platform, recruitment technology, tenant-screening tools, and any AI or rules-based software that uses applicant information.
Focus on tools that score, rank, recommend, filter, approve, deny, or materially guide decisions.
2. Separate administrative automation from decision automation
Do not assume that every automated communication requires a new privacy-policy disclosure.
Electronic forms, scheduling links, email reminders, document portals, and standard workflow notices are ordinarily administrative functions—not automated decisions.
3. Review your privacy policy if qualifying automation is used
If a system uses personal information to make or materially guide a significant employment, housing, or service decision, work with Australian privacy counsel to update the privacy policy before December 10, 2026.
The policy should describe the categories of information used and the general categories of automated decisions. It does not require an employer to publish confidential source code or proprietary model details.
4. Keep meaningful human judgment in employment decisions
Employers should continue to use trained people to review screening information, apply role-related criteria, consider applicable law, and make individualized decisions.
For U.S.-based hiring, employers using a consumer report should also follow applicable adverse-action procedures and applicant-rights requirements.
What CRAs and screening providers should do
Background screening providers serving Australian clients should document how their systems work.
Confirm whether any system scores, ranks, recommends, or automatically filters an applicant based on personal information.
Distinguish human research and report delivery from automated eligibility decision-making.
Review third-party vendors and product features for automated matching, risk scoring, or recommendation functions.
Do not describe a screening result as an automated “pass,” “fail,” approval, or rejection when the client remains the decision-maker.
If qualifying automated-decision functionality exists, coordinate with privacy counsel on the required APP privacy-policy disclosure.
Keep client guidance clear: a screening provider supplies information; the employer or housing provider makes the final decision.
Frequently asked questions
Does this new Australian rule ban AI or automated screening?
No. It is primarily a privacy-policy transparency requirement. It requires disclosure when qualifying computer-program decision-making uses personal information and could significantly affect an individual.
Do electronic authorization forms count as automated decision-making?
No. An authorization form, e-signature, email reminder, secure portal, or routine status update does not itself make or guide a significant decision about an applicant.
Does a human final decision make the rule irrelevant?
Not always. If software scores, ranks, recommends, or materially guides the human decision-maker, the disclosure requirement may still apply.
Does a human-researched criminal background check trigger this rule?
Typically, no. A human researcher obtaining and reporting authorized information—without a program scoring, ranking, recommending, approving, or rejecting the person—is not the automated-decision activity this rule addresses.
International screening support
International screening requires country-specific processes, authorization requirements, and privacy controls. GBS provides international background checks through human-led, authorized workflows and offers employment background checks for employers screening candidates in the United States and internationally.
Applicants who need a copy of their report or want to raise a dispute can visit Applicant Report Requests & Disputes.
Need an Australia Background Check?
Global Background Screening provides authorized, human-led international background checks for employers, contractors, and global hiring teams. Select Australia to view available services, requirements, pricing, and turnaround times.
Compliance notice: This article provides general information, not legal advice. Australian privacy obligations depend on the entity, technology, data use, and decision at issue. Employers and screening providers should consult qualified Australian privacy counsel about their specific processes.
