APP 1.7: what Australian recruiters must publish by 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 added an automated decision-making transparency requirement to APP 1. It commences on 10 December 2026, it plainly covers deciding who gets an interview, and complying means describing your screening tool accurately in a public document.
- APP 1.7 commences 10 December 2026 — a fixed deadline, not a transition period.
- It bites where a computer program uses personal information to make, or directly support, a decision significantly affecting someone’s rights or interests.
- Screening job applicants is the example regulators reach for first.
- You must disclose the kinds of personal information used, the decisions made solely automatically, and the decisions substantially and directly supported by the technology.
- Human review does not exempt you — it changes which limb you disclose under.
What changed, and when
The Privacy and Other Legislation Amendment Act 2024 was the first substantial tranche of reform to follow the Privacy Act review. Among the changes is a new transparency requirement dealing specifically with automated decision-making, inserted into APP 1 — the principle that governs open and transparent management of personal information.
The provision commences on 10 December 2026, two years after assent, precisely so entities have time to work out what their systems do and describe it. That runway is now short.
Does it apply to recruitment? Almost certainly, yes
The obligation is engaged where an APP entity arranges for a computer program to use personal information about an individual to make a decision, or to do something that is substantially and directly related to making a decision, where the decision could reasonably be expected to significantly affect the individual’s rights or interests.
Three elements, and hiring satisfies all three comfortably.
- 01A computer program using personal information — a screening model consuming a CV, an application form or an interview transcript.
- 02Making or directly supporting a decision — ranking, scoring, shortlisting or rejecting. The OAIC has signalled a broad reading of the support limb ahead of commencement, so "the AI only recommends" is not the exit it sounds like.
- 03Significantly affecting rights or interests — access to employment is the paradigm case, and commentary consistently uses "who gets a job interview" as the illustration.
The employee records exemption does not save you
Private-sector employers sometimes reach for the employee records exemption. It is directed at records of current and former employment relationships; a job applicant who is never hired does not have an employment relationship for it to attach to. Do not build a compliance position on it without advice.
What your privacy policy has to say
The disclosure lives in the privacy policy itself — a public document — rather than in a collection notice. Three categories of information must appear.
| Limb | What to describe | Typical hiring example |
|---|---|---|
| Personal information used | The kinds of personal information the automated technology operates on | Application responses, CV content, interview transcripts, assessment responses |
| Decisions made solely automatically | Decisions with no human involvement at all | Automatic knock-outs on stated licence, visa or right-to-work criteria, if you run them |
| Decisions substantially and directly supported | Decisions where the technology materially informs a human decision-maker | Competency scoring and shortlist ranking presented to a hiring manager who decides |
Draft language to adapt
The following is a starting point for an employer whose AI screening informs but does not make the decision. Adapt it to what your systems actually do, and have counsel review it — an inaccurate disclosure is worse than a thin one.
If you do run any solely automated step — a hard knock-out on a mandatory licence, for instance — say so explicitly and separately. The two limbs are disclosed differently for a reason.
What non-compliance costs
Reported enforcement settings put infringement notices for administrative failures in the order of $66,000, with civil penalties for serious or repeated interference with privacy scaling into the tens of millions. Those are ceiling figures for the worst conduct, not the expected outcome of a late privacy-policy update.
The more realistic exposure is reputational and procedural: an OAIC inquiry that requires you to explain, in detail and under time pressure, what your screening vendor’s model does with candidate data. Employers who have never asked the question find that a harder afternoon than the drafting.
A four-step preparation plan
- 01Inventory. List every tool in the hiring funnel that touches candidate personal information and produces a ranking, score, match, filter or recommendation — including ATS resume parsing and keyword knock-outs, which people routinely forget are automated decisions.
- 02Classify each one against the two limbs: solely automated, or substantially and directly supporting a human. Write the classification down; you will need it again for the Fair Work record.
- 03Get the input list in writing from each vendor. Which fields does the model see? Does it see video, audio or images? Does it infer anything not supplied? A vendor unwilling to answer in writing is a vendor whose behaviour you cannot describe in your policy.
- 04Draft, review and publish before 10 December 2026, and put the review on an annual cycle — the disclosure has to keep matching the system as models and vendors change.