If the Privacy Act covers your business, and software scores, ranks or filters job applicants, tenants or clients where the decision could reasonably be expected to significantly affect them, your privacy policy has to describe those decisions from 10 December 2026. That generally includes a score your software vendor calculates. For Sydney property, construction and professional services firms with 5 to 100 staff, I’d look first at three kinds of software: the job board or applicant tracking system that ranks candidates, the rental platform that scores tenants and the anti-money laundering (AML) onboarding tool that rates a client’s risk.
I built the AI and Privacy Check because I see a lot of businesses that may need to change their privacy policy and don’t know it yet, and I wanted to make the first step easier. I know people in recruitment, property management and real estate who this rule is likely to affect.
I’ve covered who the Privacy Act applies to, and why a person signing off on a score doesn’t settle it, in whether Australian businesses still need AI governance.
Which decisions about applicants, tenants and clients does the rule catch?
It catches decisions where software your business has arranged for makes the decision, or does something substantially and directly related to making it, using the person’s personal information, and the decision “could reasonably be expected to significantly affect the rights or interests of an individual”. That’s the new APP 1.7, from the Privacy and Other Legislation Amendment Act 2024, and as at October 2026 nothing has changed or delayed its 10 December 2026 start.
The OAIC’s list of significant interests in chapter 1 of the APP guidelines (version 2.0, 30 September 2026) includes access to employment opportunities and access to housing. Its fact sheet on the rule (September 2026) lists “recruitment software used to sort through candidate profiles and make hiring decisions” among the decisions it would generally consider in scope, and its Example 5 puts an engineering firm’s AI video-interview tool, which ranks graduates into a shortlist, in the firm’s privacy policy.
Here’s how that lands, assuming the Privacy Act covers you, with the same three results as the AI and Privacy Check. Where you’re in doubt, the fact sheet says businesses “should take a cautious approach and include information in their APP privacy policy”.
| Decision | Where software comes in | In scope if you’re covered? |
|---|---|---|
| Shortlisting job applicants | A job board’s ranking feature or an applicant tracking system | Likely If the ranking shapes who gets an interview |
| Scoring video interviews | A platform that scores recorded answers and ranks a shortlist | Likely If its ranking sets the shortlist, as in the OAIC’s own example |
| Ranking CVs pasted into an AI chat tool | A general AI chat tool your staff use | Worth checking The OAIC’s examples suggest it can count |
| Choosing a tenant | A rental application platform’s score or ranking | Likely If the score feeds the decision, even when a person makes the final call |
| Rating a new client’s money laundering risk | An AML onboarding tool | Worth checking If the tool sets the rating or blocks onboarding |
| Payment terms or credit for a household client or sole trader | A credit check or scoring rule | Worth checking Likely if the software approves or refuses the credit |
| Writing up a decision a person already made | A word processor, or the system you file it in | Probably not If it only documents what a person decided, and nothing scored them first |
For a builder, the rows to check are hiring and payment terms, the same two I flagged in where AI pays for builders.
Whose disclosure is it when the score comes from your software vendor?
The disclosure is usually yours, even when the vendor built the score. The OAIC’s fact sheet says it generally expects the obligations to “typically remain with the APP entity who is using personal information” to make the decision, and buying the software can be enough to count as arranging for it. Chapter 1’s own example is a business that buys another company’s AI system to screen and rank job applications.
Vendors are expected to help: the fact sheet says providers should give customers “clear, high-level information about how their software can be used to make decisions”. A contract with the provider doesn’t, on its own, take the duty off you, and chapter 1 says contracts should be clear about which party keeps the ultimate decision-making capability.
Does ranking CVs in an AI chat tool count?
Chapter 1 points that way, where the ranking shapes who gets an interview. The OAIC hasn’t addressed chat tools in hiring directly, so check with your lawyer.
Chapter 1 generally treats an employer that permits or directs staff to use an AI chat tool to draft performance assessments that determine promotions as having arranged for that program. Pasting a pile of CVs into a chat tool and asking for the five strongest looks similar, for a decision about access to a job. If you’re covered and staff do this, list it as worth checking. An AI use policy that names the approved tools makes it easier to see.
The employee records exemption won’t help with applicants you don’t hire: the OAIC says it doesn’t cover unsuccessful job applicants. Where pasted CVs end up is a separate question, covered in whether it’s safe to put client information into AI tools.
Does a property manager’s tenant screening count?
For an agency the Privacy Act covers, a rental platform’s score that feeds the decision is likely to count, even when a property manager makes the final call.
The OAIC’s rental example in chapter 1 is about this kind of score: a rental company’s program calculates a suitability score and “places the result directly into the employee’s application assessment screen”. The OAIC calls that deeply integrated, one of the factors it lists for deciding a program is substantially and directly related to the decision, and a program doesn’t have to make the final decision to count.
AHURI’s January 2026 report on tenant data mapped 57 rental PropTech products headquartered and operating in Australia as at February 2025. One property manager told the researchers: “So each application has a score.” From a small number of interviews, the report suggests fully AI-driven scoring without human oversight isn’t yet widespread, and that final decisions often involve professional discretion. The OAIC’s example has a person deciding too.
Some agencies sit outside the rule altogether. The report notes that agencies under the small business threshold, and most landlords, aren’t bound by the Australian Privacy Principles, and property management doesn’t bring an agency in through the AML reforms: AUSTRAC’s guidance says the regulated real estate services leave out leases of 30 years or less (updated 31 August 2026).
Can AML onboarding software fall under the rule?
The AML reforms are what can bring a small firm in, for its AML work only, and inside that work an onboarding tool that rates or blocks clients could fall under the new rule.
Since 1 July 2026, AUSTRAC has regulated firms such as real estate agencies and accountants that provide designated services, and a small one is covered by the Privacy Act for that work only (who’s covered is in the governance post linked above). The OAIC’s guidance for AML reporting entities (updated 28 August 2026) works through a real estate agency with turnover of $1.1 million that is “not required to comply with the Privacy Act for other personal information-handling activities”. So for a small agency covered only through its AML work, tenant screening sits outside the Act.
AUSTRAC expects reporting entities to give each customer a risk rating, such as low, medium or high, which decides when simplified or enhanced due diligence applies (updated 5 October 2026). If your onboarding software sets that rating, or blocks a client from being onboarded, the new rule could apply inside your AML scope by analogy with the OAIC’s credit example: it treats programs that approve or reject credit applications as generally in scope, and the Act’s examples include a decision that affects someone’s access to a significant service. If so, your AML privacy policy would need the new section too. The OAIC hasn’t addressed AML onboarding directly, so check with your lawyer, and ask your vendor whether the tool sets the rating itself.
Do you have to tell each applicant or tenant that software scored them?
This rule doesn’t require it: from 10 December it’s about what your privacy policy contains, with no notice to each person when software scores them. On their text, APPs 1.7 to 1.9 add content to the policy and nothing more. Allens’ commentary of 2 October 2026 describes it as a transparency measure only, with no right to contest a decision and no duty to notify people directly.
Other obligations keep running: if the Privacy Act covers you, collection notices under APP 5 are a separate duty, and discrimination law and state rental rules still apply.
What should you ask your software vendors before 10 December?
Ask each vendor whether its product scores, ranks, filters or decides anything about a person, what personal information it uses and whether it can describe that in plain English for your privacy policy.
Make your own list first: every tool that touches applicants, tenants or clients, including any AI chat tool your staff use. For each, note what personal information goes in and whether the output only records a decision someone already made or shapes it first, the split the AI and Privacy Check asks about. If you build automations, record what each workflow does and add it to the list.
Then put these to each vendor:
- Does the product score, rank, filter, recommend or flag people, and is that switched on by default?
- What personal information does it use, including any biometric or health information?
- Does it ever decide on its own, for example by auto-rejecting an applicant or declining a client?
- Can you describe in plain English how it’s used in decisions, for our privacy policy?
- What does our contract say about which of us makes the decision?
- Can our staff see why a score came out as it did, and override it?
I drew these from the OAIC’s guidance, which expects businesses to “actively identify, assess and keep oversight over the third-party computer programs that they use to make a decision”. Keep the answers on file.
What goes in the new section of your privacy policy?
APP 1.8 sets out three things for the new section: the kinds of personal information your software uses, the kinds of decisions it makes on its own and the kinds where it does something substantially and directly related to making a decision. Where you can, say which decisions software makes on its own and which it feeds; APP 1.8 names both.
The fact sheet’s Example 6 shows the shape. A lender’s section headed “Decisions made by computer programs” lists the kinds of personal information its fraud tools use, such as identity information, credit information and biometric templates, then the kinds of decisions, such as granting or denying a loan or credit application. You can group decisions and kinds of information, but the detail “must be meaningful to a reasonable person”, and sensitive information such as health information or biometric templates should be clear.
Have a privacy lawyer check the wording before you publish it. Amanda Olic at Lawgix reviewed the AI and Privacy Check before it went live, and she’s who I’d point you to for this part. Then name one person who adds each new tool to the list before staff start using it.
If you’re not sure where you stand, the AI and Privacy Check takes about five minutes, needs no email and ends with what to do first. If AI already sits inside one of these decisions, the AI risk assessment works through one use at a time. Or tell me how your firm uses software with applicants, tenants or clients on a discovery call, and I’ll come back to you afterwards with what I’d look at first.
FAQ
Can we keep how the score works confidential?
Partly. The OAIC says how a program weights data can be commercial-in-confidence and stay out of your policy. The fact that personal information is used to make the decision can’t. In its lender example, the weightings stay private and the kinds of information and decisions go in.
We stopped using a tool before 10 December. Does it still count?
Not for the new section, on the Act’s wording: the rule applies to decisions made from 10 December 2026, when it commences. A tool still making decisions from that date counts, even if you bought it years ago and the information in it is older.
Our recruiter screens candidates for us. Whose disclosure is it?
Possibly both of yours. The OAIC generally expects the duty to stay with whoever uses the personal information to make the decision. If the recruiter’s software ranks candidates and you choose from its shortlist, each of you may have something to disclose, where the Act covers you both. Ask your lawyer to settle who covers what.
Does a job ad that a platform targets count?
It can. In the OAIC’s graduate-engineer example, a job site promotes an engineering firm’s ad mainly to male graduates aged 21 to 30, so a 45-year-old woman who has just finished her degree doesn’t receive it. The OAIC treats the firm’s use of that site as in scope, because the targeting can limit her access to employment opportunities.
What can the OAIC do if our privacy policy isn’t updated?
From 10 December 2026, the amending Act makes APP 1.7 one of the provisions for which the OAIC can issue compliance notices and infringement notices, so leaving this content out is a real exposure for a business in scope. The OAIC already checks privacy policies: in December 2025 it announced its first compliance sweep, reviewing the privacy policies of about 60 businesses in six sectors from January 2026, rental and property among them.
General information only, not legal advice. Current as at October 2026: this area is moving quickly and the position may have changed by the time you read it.
