Policy · Privacy, Data Protection & Cyber
APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
A complete APP privacy policy for an Australian organisation that covers every APP 1.4 heading and the automated-decision disclosures required from 10 December 2026 under APP 1.7 to 1.9, with plain-English AI and chatbot sections.
- Kind
- Policy. A policy or procedure for a firm or client.
- Where it applies
- Australia
- AI use
- Yellow AI can help in set ways. A lawyer checks specific points before use.
- Law stated as at
- 17 October 2026
- Status
- Maintained. Checked on 17 October 2026 against the 7 authorities it cites, for Australia.
- Version
- 1
- Source
- Written for this library
When to use it
Use when drafting a new privacy policy or rebuilding an old one before the automated-decision rules start on 10 December 2026. If the client only needs to add AI and automated-decision wording to an existing policy, use the AI and automated decisions clause instead.
How AI may be used
AI may produce a first draft mapped to the APP 1.4 and APP 1.8 headings from facts the client has supplied. Every statement must match the client's verified data inventory and its inventory of computer programs used in significant decisions.
AI may
- Map an existing policy against APP 1.4 and APP 1.7 to 1.8 and list what is missing.
- Draft plain-English descriptions from the client's own system list, vendor contracts and decision inventory.
- Compare the policy with the client's collection notices and chatbot notices and flag inconsistencies.
AI must not
- Must not invent or assume data flows, overseas locations, AI uses or automated decisions the client has not confirmed.
- Must not state that the client does not use AI or automated decisions without the client's written confirmation.
- Must not copy another organisation's published privacy policy.
The lawyer checks
- Each entry in clause 7.2 matches the client's inventory of computer programs used in decisions that could significantly affect individuals.
- Overseas countries in clause 6 match the vendor contracts and hosting locations.
- Every promise (human review, no training, deletion periods) is true and backed by a contract or process.
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Official form
Open the official form. Always use the current version from the issuer.
Read the full text
The full text is for signed-in accounts. It is free. When you sign in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area