Automated Decision-Making under the Privacy Act: what your firm needs to do before 10 December

From 10 December 2026, firms covered by the Privacy Act will need to disclose in their privacy policy where computer programs are involved in decisions that significantly affect individuals. 

Most firms are already using automated decision-making somewhere, whether that's conflict checking, risk-rating new clients during onboarding, or functionality within a practice management system that has never been closely examined. 

The new requirements are about transparency, giving clients visibility into how decisions affecting them are made. The real risk is often not the regulator, but a client discovering the use of automation from another source, Importantly, these changes are not limited to AI. They apply to tools that contribute to a decision as well as those that make one. That means the starting point is understanding where decisions are made in your firm, rather than compiling a list of software products.
 
In this session Fiona will step through the approach she uses: 

• identifying key decisions,
• understanding the systems and processes behind them,
• assessing them against the legislative criteria, and
• documenting the outcome in a way that remains effective even when vendors update their products without notice.

 
By the end of the session, you'll have a practical framework you can apply in your own firm, along with resources and templates to help you get started