This is a plain-language explainer from a software company, not legal advice. Check the position for your agency with your privacy adviser.
What changed
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Most of it commenced straight away. One part was given a two-year runway because it asks organisations to do work: new Australian Privacy Principles 1.7 to 1.9, which add automated decision-making to what a privacy policy has to disclose. They commence on 10 December 2026.
What the rule says
In substance: if you use personal information in a computer program to make a decision, or to do something substantially and directly related to making a decision, and that decision could reasonably be expected to significantly affect a person's rights or interests, then your privacy policy has to say three things.
- The kinds of personal information the program uses.
- The kinds of decisions the program makes on its own.
- The kinds of decisions the program helps make, where it does something substantially and directly related to the decision.
One definition in the OAIC guidance catches people out. For these purposes, the Commissioner states that “making a decision” includes refusing or failing to make a decision, and that the obligation applies whether the decision benefits or disadvantages the person. A tool that quietly never surfaces an applicant is inside the rule, not outside it.
The distinction between 2 and 3 is the important one. A program that rejects an application outright is making the decision. A program that scores an application and hands the score to a recruiter is doing something substantially and directly related to it. Both have to be described; they are described differently.
Does it apply to a recruitment agency?
The rule applies to entities covered by the Privacy Act. Broadly that is organisations with annual turnover above $3 million, plus some smaller ones that fall into specific categories (contracted service providers to the Commonwealth, for example). Many agencies are over the threshold. Many that are under it are asked by clients to comply anyway, and it is easier to have the paragraph than to explain why you do not.
Whether a screening decision "significantly affects" a person is not something we can rule on, but being screened out of a job is the kind of thing the rule is aimed at, and we would plan on the basis that it applies.
What counts as an automated decision in a hiring funnel
More than people expect. Go through the funnel end to end and list every step where software, not a person, changes what happens to an applicant.
- ATS knockout questions that auto-reject on an answer ("Do you have the right to work in Australia?"). That is a decision made solely by a program.
- Job board or ATS matching scores that order the list a recruiter reads.
- CV parsing and keyword scoring.
- AI grading and screening tools, including Alert Hire.
- Automated messages that tell a candidate an outcome.
- Video interview scoring, psychometric scoring, skills tests with automatic cut-offs.
What to do before December
- Inventory. List every automated step from the table above, with the tool, what personal information it uses, and what happens as a result.
- Classify. For each, decide: does the program make the decision, or assist a person who makes it? Be honest. If a recruiter never looks at candidates below a score, the score is closer to making the decision than assisting it.
- Write the section. One paragraph per tool or category, in plain language, covering the three points above. Put it in the privacy policy, not in a separate document nobody finds.
- Align the candidate-facing notices. The collection notice on your application form and any automated message a candidate receives should say the same thing the policy says.
- Ask your vendors. Every tool in the list should be able to give you a description of what it decides and what data it uses. If a vendor cannot, that tells you something.
A paragraph you can adapt for Alert Hire
This is how we describe Alert Hire in our own privacy policy. An agency using it could adapt something like the following, and your adviser should check it against your actual configuration, in particular whether you have switched on any write-back that moves candidates between stages.
We use Alert Hire, an AI screening tool, to help assess applications. It uses the contents of your application (CV, cover letter and form answers, with your name and other identifying details removed) and your replies to the screening questions it sends you. It produces a score against the criteria we set for the role, a ranking, and a summary of your answers. It does not decide whether your application is progressed or declined; our recruiters make those decisions, and they can see and overrule the reasoning behind every score. [If applicable: We have configured it to update the stage of your application in our system when your score meets a threshold we set.]
Why we think this is good for agencies
The rule asks you to write down what your tools decide. Most agencies have never had to, and the exercise surfaces the auto-rejects and hidden cut-offs that nobody chose on purpose. The agencies that do it well will have a one-line answer when a client asks "do you use AI to screen, and how", which is a question clients are already asking. It is also, quietly, the reason Alert Hire is built the way it is: the AI grades and ranks, people decide. That is a sentence you can put in a policy.
Related: what the AI is allowed to decide, and what it is not. Our own disclosures are in the privacy policy and on the candidate data page.
Sources
- Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024. Checked 10 September 2026.
- Office of the Australian Information Commissioner, Australian Privacy Principles guidelines, Chapter 1: APP 1. Checked 10 September 2026.
- Johnson Winter Slattery, Practical implications of new transparency requirements for automated decision making. Checked 10 September 2026.
- Australian Human Rights Commission with LexisNexis, AI and recruitment compliance checklist. Checked 10 September 2026.
Every source here was opened and read on the date shown. If one has moved or changed, tell us at admin@alertai.com.au.