Australia Privacy Reform: OAIC Final ADM Transparency Guidance Published — Privacy-Policy Updates Due December 10, 2026; Tranche 2 Bill Not Yet Introduced (October 2026)

Australia Privacy Reform: OAIC Final ADM Transparency Guidance Published — Privacy-Policy Updates Due December 10, 2026; Tranche 2 Bill Not Yet Introduced (October 2026)

Australia's privacy overhaul is advancing on two tracks. The Tranche 2 exposure draft — the Privacy Amendment (Personal Data Protection) Bill 2026, released by the Attorney-General on August 31, 2026 with consultation closing September 18, 2026 — proposes the most significant changes to the Privacy Act 1988 since the APPs were introduced (fair-and-reasonable test, 72-hour breach notification, controller/processor concepts, with the prescribed-country list and contractual clauses for overseas transfers deferred). As of October 5, 2026, there is no evidence the bill has yet been introduced to Parliament; introduction/passage is expected late 2026 or early 2027, starting 6–12 month grace-period clocks. Meanwhile, the Tranche 1 machinery already on the statute book hit a concrete compliance milestone this week.

OAIC final ADM transparency resources (published September 30, 2026) — deadline December 10, 2026

The OAIC published its final guidance package on the automated decision-making (ADM) transparency obligation inserted into Australian Privacy Principle (APP) 1 by the Privacy and Other Legislation Amendment Act 2024 (Royal Assent December 10, 2024): an APP 1.7–1.9 fact sheet, a supplementary fact sheet for government agencies, a flowchart, and an updated APP 1 Guidelines chapter, built on 90 consultation submissions.

Per the read-out: "From December 10, 2026, APP entities that arrange for a computer program to make or inform a decision that could significantly affect an individual's rights or interests must disclose that use in their APP privacy policy.¹" The duty (APP 1.7) engages when three conditions are met: a computer program makes (or substantially and directly informs) a decision; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about the individual is used in the program's operation. APP 1.8 then requires the privacy policy to disclose: the kinds of personal information used in the programs' operation, the kinds of decisions made solely by the programs, and the kinds of decisions for which a thing substantially and directly related to making the decision is done by the programs.

The OAIC's resources point to the exposed populations: banks and credit providers (automated credit decisions), insurers (underwriting, claims), digital platforms and marketplaces (account, access, content decisions), employers and recruitment firms (hiring, workforce decisions), and Commonwealth agencies (eligibility, service decisions). From December 10, 2026, a privacy policy that omits the APP 1.8 information is non-compliant with APP 1, and the OAIC can investigate and take regulatory action — determinations, civil penalty proceedings, enforceable undertakings — using the strengthened enforcement powers from the same 2024 package.

For context, the 2024 amendment package's other limbs commenced earlier: the statutory tort for serious invasions of privacy and the criminal doxxing offence both commenced June 10, 2025.

What this means for APAC compliance teams

• December 10, 2026 is a hard privacy-policy deadline: map every computer program that makes or substantially informs decisions significantly affecting individuals, classify each as solely/substantially automated, and draft the three APP 1.8 disclosures into privacy policies (and any external AI/ADM notices) before commencement. The OAIC flowchart is the fastest triage tool.
• The exposure is a gap between policy and practice, not the existence of the program — keep the policy synchronized as ADM deployments change.
• Tranche 2 remains pending: the consultation closed September 18, 2026 and stakeholder submissions (e.g., the Law Council's September 21 submission) are in; watch for introduction. The deferral of the prescribed-country list and contractual clauses means cross-border transfer mechanics under the new law are not yet settled — do not lock long-term transfer templates to the draft text.
• This ADM duty is a useful global anchor: it is the same disclosure architecture compliance teams are building for EU AI Act transparency and Korea/Japan AI rules — one mapping exercise can feed all three.