What Is ADM Disclosure and Does My Australian Business Need One?

An automated decision-making (ADM) process is any system that makes or substantially assists in making decisions about individuals without meaningful human review at the point the decision takes effect. Common examples in small and medium businesses include:

• Loan or credit scoring tools that automatically approve or decline applications
• Recruitment platforms that rank or filter job applicants algorithmically
• Insurance pricing engines that calculate premiums from data inputs
• Customer service workflows with authority to approve or decline refunds
• Rostering systems that determine shifts or working conditions based on rules
• Marketing algorithms that decide which customers see which offers

The key question is not whether software is involved — almost every business uses software — but whether the system is making a significant decision that meaningfully affects a specific person.

The explanatory memorandum to the Privacy and Other Legislation Amendment Act 2024 indicates that a significant decision is one with a material legal or similarly significant effect on the individual. This includes decisions about:

• Financial products — lending, insurance, credit limits
• Employment — hiring, termination, performance assessment
• Healthcare access or treatment pathways
• Housing or accommodation
• Education enrolment or assessment outcomes
• Access to government services

A customer management system that automatically flags accounts for suspension, or an HR platform that scores interview responses and determines who advances to interview, likely qualifies.

The ADM disclosure requirement amends APP 1. Your privacy policy must state:

1. That you use automated decision-making processes
2. The kinds of personal information used as inputs
3. The kinds of decisions made, or significantly contributed to, by the process
4. Whether a human reviews the automated output before the decision is acted on

You are not required to publish source code, model weights, or proprietary logic. The obligation is transparency about the existence and nature of the system — not a technical audit.

Yes — and this is where many small businesses get confused. If you use a third-party SaaS platform — a CRM that auto-scores leads, a payment processor that auto-declines transactions, or a hiring tool that ranks CVs — and that tool makes significant decisions about your customers or employees, the disclosure obligation falls on you as the APP entity using the tool, not only on the software vendor.

Before 10 December 2026, review your software stack and ask:

• Which tools make or contribute to significant decisions about individuals?
• What personal data do they use as inputs?
• Is a human meaningfully in the loop before the decision takes effect?

If yes to the first question, update your privacy policy before the commencement date.

1. Does this system produce an output that directly or substantially determines an outcome for a specific individual?
2. Is that outcome significant — does it affect their finances, employment, health, or access to services?
3. Does that outcome take effect without meaningful human review?

If yes to all three, your privacy policy needs an ADM disclosure before 10 December 2026.