SN Assay · Australian Privacy Act, APP 1.8
Have you heard of APP 1.8 of the Privacy Act?
You've probably seen plenty about AI lately — chatbots, deepfakes, what the latest assistant can do. Very little of it has been about a change to Australia's own privacy law that starts on 10 December 2026, and it reaches more businesses than you might expect.
From that date, if a computer program uses personal information to make a decision about someone — or substantially and directly helps a person make it — and that decision could significantly affect them, your privacy policy has to say so. It doesn't matter whether you think of the program as AI. Rostering software, a recruitment tool that ranks applicants, a payment system that flags or blocks a customer, a CRM that scores leads: plenty of everyday business software does this, often switched on by default.
What is APP 1.8? read the OAIC's guidance →
APP 1.8 is part of the first Australian Privacy Principle, the one about being open with people about how you handle their information. Where your business uses computer programs in decisions like these, your privacy policy must describe three things:
- The kinds of personal information those programs use.
- The kinds of decisions made solely by a computer program.
- The kinds of decisions where a computer program does something substantially and directly related to the decision — scoring, ranking or recommending, with a person making the final call.
It applies to decisions made from 10 December 2026. It is a duty to tell people, not a rule about how you make decisions: it does not ask you to stop using software, or to get anyone's consent.
A business whose privacy policy falls short of what the Act requires can face penalties of more than $50,000, and the regulator can issue an infringement notice without going to court.
Who does it apply to?
The Privacy Act covers businesses with an annual turnover of more than $3 million. It also covers some smaller businesses whatever their turnover — health service providers, businesses that trade in personal information, Commonwealth contractors and a few others. Most small businesses are not covered, which is exactly why the check below starts there.
Would you like a free check to see whether APP 1.8 applies to your business?
Seven questions, about a minute. Your answers are worked out on this page and are never sent to us or stored anywhere. We count only how many checks are run and their result (applies, might apply, doesn't apply). If you are not sure of an answer, choose "Not sure".
An Assay report can assist you with next steps.
What an Assay report gives you
APP 1.8 applying to your business does not by itself mean your privacy policy needs new words. That depends on whether any software you use makes, or substantially helps make, decisions about people that could significantly affect them — and most businesses have never looked. An Assay report works that out, and writes what your policy needs to say.
What it checks
- The AI you know you use.
- The software you use every day, and the AI built into it. This is where most businesses find something they didn't know was there.
- Every kind of decision your business makes about people, put through the same two-part test the law uses: does it use personal information, and could it significantly affect someone?
How it works
- Once you have paid, a questionnaire in plain language, about 20 to 30 minutes. Every question allows "Not sure", and we never treat a "Not sure" as a "No".
- We ask about your tools and how decisions are made — never about any individual customer or staff member.
- Your answers are destroyed within 14 days of your report being sent.
What you get
- What APP 1.8 means for your business, in plain words.
- Your software, and the AI inside it.
- Each of your decisions, placed and explained: must be disclosed, needs your judgement, does not need disclosing, or cannot be placed yet and why.
- Draft text for your privacy policy, covering all three things APP 1.8 asks for — ready to publish.
- Anything to settle before you publish it, and where in your policy it goes.
- When to look at it again.
What you can do with it
- Publish the text in your privacy policy before 10 December 2026.
- Hand it to whoever looks after your policy — it is written so they can act on it.
- Keep it as a record that you checked.
Or A$599 plus GST together with an AI Search Visibility Audit — how AI assistants see your business, alongside how your business uses AI on people.