Need incident response?

Home › Legal Alerts

01.10.2026Priority 3: MediumInternational

OAIC guidance on automated decision making transparency ahead of December 10 deadline

What changed

The Office of the Australian Information Commissioner released new resources, including a fact sheet, on the automated decision making transparency requirements under APP 1.7 of the Privacy Act 1988. The resources set out what entities must disclose in their privacy policies about their use of automated decision making. Entities regulated by the Privacy Act must update their privacy policies before the obligation commences on December 10, 2026.

Source: View the official source

Why it matters

Entities regulated by the Privacy Act must describe their use of automated decision making in their privacy policies.
The obligation commences on December 10, 2026, across all sectors.
Insurers and claims technology providers using AI in underwriting or claims handling are concerned.

Our comment

This is a mandatory disclosure obligation with a fixed start date that applies across sectors, including insurers and claims technology providers using AI or automated decision making in underwriting or claims handling. The question for regulated entities is whether their privacy policies accurately reflect where and how automated decisions affect individuals.

Questions about this alert?

Sara Derbel

Paralegal

Our team can explain what this development means for your organization.

Related services

Regulatory Intelligence
Regulatory intelligence and legislative monitoring for AI, privacy and cybersecurity across Canada, the US, EU, UK and Australia, filtered, prioritized and reviewed by legal experts.
View service
Privacy Notices
Privacy policies and notices drafted for Law 25, PIPEDA and GDPR: clear, multilingual external notices and internal policies aligned with how your data actually flows.
View service
Privacy Compliance
Privacy compliance for Law 25, PIPEDA, GDPR and ISO 27701: gap analyses, audits, individual rights frameworks and proportionate corrective plans for SMEs and complex tech environments.
View service
The Vox
Our regulatory intelligence magazine, with the latest issues and Legal Alerts.
Read The Vox

Related expertise

Artificial Intelligence
AI law and AI governance advice in Canada: responsible AI policies, data use, accountability and AI contracts for companies that build or deploy AI.
View expertise
Privacy & Data Protection
Privacy law compliance under PIPEDA, Quebec Law 25 and provincial rules, with practical privacy programs for personal information.
View expertise

Similar alerts

29.10.2026GuidanceEuropean Union
Italy's Garante requires consent for email tracking pixels
Guidelines from the Garante require organizations using tracking pixels in marketing emails to obtain prior, free, specific and informed consent before the pixel collects information about whether and when a recipient opened the email. A pixel that can be traced back to a single recipient is treated as a tracking technology subject to the same consent standard as website cookies. The guidelines rest on Article 122 of the Italian Privacy Code, which implements Article 5(3) of the ePrivacy Directive. The compliance period ended on October 29, 2026, and the Garante has included verification of these guidelines in its planned inspections for the second half of 2026.
- Privacy
Read the alert
23.10.2026ConsultationCanada
Privacy Commissioner of Canada comments on AI transparency consultation
The Office of the Privacy Commissioner of Canada released its comments on Innovation, Science and Economic Development Canada's consultation on AI transparency, which ran from July 23 to September 23, 2026. The OPC agrees that transparency issues arise in all five areas ISED identified: AI generated content, AI interaction, information about AI systems, AI incidents and AI agents. It argues that information about a system must be understandable at the point where it affects an individual's decision. The OPC anchors its position in its existing consent guidelines and names developers and deployers of generative AI as bearing transparency responsibilities.
- Privacy
- Artificial Intelligence
Read the alert
22.10.2026GuidanceQuebecCanada
Quebec's CAI warns that dark patterns can invalidate consent
The Commission d'accès à l'information published new guidance on dark patterns, meaning interface designs that steer users toward decisions against their own interest. Examples include disclosing more personal information, spending more time on a platform or spending more money. The CAI states that consent obtained through such an interface may be invalid, which would make the resulting use or communication of personal information unlawful. The guidance sets out the applicable legal obligations and best practices for organizations that collect personal information from Quebec users online.
- Privacy
Read the alert