From 10 December 2026, an Australian recruitment agency covered by the Privacy Act may need to update its privacy policy if it has arranged for a computer program to use a candidate's personal information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect that candidate's rights or interests. That is the heart of the Privacy Act automated decision making recruitment change: a new APP 1 transparency obligation to describe the kinds of personal information used and the kinds of decisions involved.
Below: which recruiting uses may be caught, what to write, the records behind it, APP 8 for offshore vendors, and a ten-step checklist.
This is general information, not legal advice.
Key takeaways
- From 10 December 2026, an applicable APP entity's privacy policy must describe the kinds of personal information used, and the kinds of decisions made or substantially and directly assisted, by computer programs where the decision could reasonably be expected to significantly affect an individual's rights or interests (OAIC APP 1 guidelines).
- The change is a transparency obligation in the privacy policy; on its own it does not ban AI screening of job applicants.
- A recruiter making the final call does not automatically take a tool out of scope: a ranking that decides who gets a phone screen may be substantially and directly related to the decision.
- The obligation sits with the organisation that arranged for the program to be used, including AI features inside a third-party ATS or job-board integration.
- Overseas vendor access to candidate data is a separate question under APP 8, which governs cross-border disclosure of personal information.
Privacy Act automated decision making recruitment rules from 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 adds a transparency requirement to Australian Privacy Principle 1, the principle that governs privacy policies. From 10 December 2026, where an applicable APP entity has arranged for a computer program to use an individual's personal information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect the individual's rights or interests, its privacy policy must describe (APP 1.8):
- the kinds of personal information used in the operation of those programs;
- the kinds of decisions made solely by the operation of those programs; and
- the kinds of decisions for which a program does something substantially and directly related to making the decision.
The detail is in the OAIC's APP 1 guidelines, and the OAIC has also published resources on transparency for AI and automated decision-making. Read both, as current in October 2026, before you update anything.
For recruiters, the practical consequence is that "a recruiter makes the final call" and "we use a third-party platform" are not answers in themselves: the test asks whether your organisation arranged for the program and whether its use of personal information is substantially and directly related to a qualifying decision.
Whether a recruiting decision meets the "significantly affect" test is for you and your advisers to judge, but being screened out of a job is the kind of outcome to assess, not assume away.
Which recruiting uses are likely to be caught – and which probably are not
The useful question is not "do we use AI?" but "does a program use this candidate's personal information to make, or do something substantially and directly related to making, a decision that could significantly affect them?" A practical first sort – a starting point for your own assessment, not a ruling:
| Recruiting use | What the program does | Likely in scope? | Why |
|---|---|---|---|
| CV screening that auto-rejects | Rejects applicants who fail set criteria, without a recruiter review | Likely | The program uses CV data to make a decision that ends the application |
| CV ranking or scoring | Orders applicants; recruiters mostly review the top of the list | Possibly – assess carefully | The ranking may be substantially and directly related to who progresses |
| Chatbot knock-out questions | Ends or diverts the application on an answer (work rights, licence, availability) | Likely | An automated "no" can end the application at the first step |
| Chatbot answering FAQs | Answers questions about pay, roster, location | Unlikely | No decision about the candidate is made |
| Interview scheduling | Offers slots, sends reminders, rebooks | Unlikely, in most set-ups | Logistics, not suitability – unless slot access is rationed by score |
| CV parsing into ATS fields | Extracts skills, tickets and dates into the applicant tracking system (ATS) | Usually unlikely on its own | Becomes relevant if parsed fields feed automated rejection or ranking |
| Talent pool re-matching | Suggests past candidates for a new role | Possibly | Depends on whether unmatched candidates are effectively never considered |
Watch for chained steps (parsing that feeds an auto-reject rule) and nominal human review (a recruiter approving 300 AI rejections in two minutes).
To see how the sort works on a real system, take our recruitment published case study: a chatbot built by NKKTech Global, an AI engineering company based in Hanoi, Vietnam, for AWING Technologies, a technology company also in Hanoi. It runs on the website, Messenger and Zalo, and the client reported an 80% reduction in response time and 45% higher pre-screening completion. Mapped onto the table, its FAQ answers and interview scheduling would sit in the "unlikely" rows, while its CV screening is the function an Australian agency would need to assess. The Vietnamese case study does not establish Privacy Act compliance for an Australian version, which would need its own assessment; our guide to AI recruitment software in Australia covers which use case to start with.
📥 무료 다운로드: 2026 베트남 오프쇼어 개발 비용 가이드
실제 개발자 단가, 프로젝트 비용 내역, 예산 기획 템플릿. 200명 이상의 스타트업 창업자가 사용 중.
구축할 준비가 되셨나요?
NKKTech은 AI Development 프로젝트를 $30K부터 제공합니다.
고정 범위. 베트남 시니어 엔지니어. 14일 킥오프.
What to write in your privacy policy – and the records behind it
The wording should be specific enough to mean something and general enough to stay accurate as tools change.
What the section should cover
- Kinds of decisions made solely by a program – for example, "ending an application where a candidate indicates they do not hold required work rights".
- Kinds of decisions where a program does something substantially and directly related – for example, "ranking applicants against a job's listed requirements for a recruiter to review".
- Kinds of personal information used – for example, CV content (work history, qualifications, licences and tickets), screening answers, availability and location preferences.
- Where a person is involved, and how to ask questions. If a recruiter reviews every rejection, say so – but only if it is true – and give a contact point.
An illustrative sentence (adapt it; it is not legal wording): "We use software to compare applications with the requirements listed in a job advertisement. It uses information from your CV and your screening answers to rank applications for a recruiter to review. A recruiter decides who is contacted for interview."
The internal records you need first
You cannot describe accurately what you have not mapped. Before drafting, record each tool's vendor (including AI features inside your ATS), inputs, decision effect, human review, criteria, data access and last configuration change – the checklist below turns this into steps.
A practical tip from the build side: the share of outputs recruiters actually review is easiest to evidence if the tool logs each recruiter action against each AI result. Ask your vendor whether that log exists before you write "a recruiter reviews every decision".
Offshore vendors, APP 8 and the small business exemption
Many recruitment AI tools are hosted or supported offshore, which brings APP 8 into play. Before personal information is disclosed to an overseas recipient, an APP entity generally needs to take reasonable steps to ensure the recipient does not breach the APPs, and it can remain accountable for what that recipient does. Overseas access may be a cross-border disclosure, depending on who can access the information and the control your organisation retains; some overseas contractor arrangements may instead be a use. The OAIC's APP 8 guidelines set out the detail.
For each vendor, find out where candidate data is stored and processed (including by model providers), who can access it from which countries, and what the contract says about model training, retention and breach notice. The same applies when you commission custom software. An overseas development team can work on anonymised data or through controlled access, with production data hosted in a region you choose – but document the assessment before real candidate data is touched. More in Privacy Act and offshore development.
A caution on the small business exemption. The Privacy Act still has a small business exemption for many businesses with annual turnover of AUD 3 million or less, but it has exceptions, and some may be relevant to a business built around handling other people's personal information. Do not assume your agency is exempt without advice; the OAIC publishes guidance on who is covered. Even if an exemption applies, check any transparency commitments in client contracts.
Practical steps before 10 December 2026
Work through this checklist with whoever owns privacy in your business. Steps 3 and 7 follow the APP 1 test; step 6 follows APP 8.
| Step | What to do | Owner | Done |
|---|---|---|---|
| 1. Inventory | List every tool that reads candidate data, including AI features inside your ATS | Operations / HR lead | ☐ |
| 2. Map decisions | For each tool, record where it acts and whether it rejects, ranks, scores or routes | Recruitment lead | ☐ |
| 3. Assess scope | Decide, with advice, which uses make, or do something substantially and directly related to, significant decisions | Privacy officer / legal adviser | ☐ |
| 4. Test human review | Check what recruiters actually review, not what the process document says | Recruitment lead | ☐ |
| 5. Write down criteria | Make screening criteria explicit; remove proxies such as postcode, graduation year or employment gaps | Recruitment lead | ☐ |
| 6. Vendor and APP 8 check | Confirm data location, overseas access, training use, retention and breach notice | Privacy officer | ☐ |
| 7. Draft the policy section | Describe kinds of personal information, decisions made solely by programs, and decisions programs substantially and directly assist | Privacy officer / legal adviser | ☐ |
| 8. Align collection notices | Make sure job ads, application forms and chatbots tell candidates what to expect | Marketing / HR | ☐ |
| 9. Publish and brief staff | Publish before 10 December 2026; brief recruiters on candidate questions | Management | ☐ |
| 10. Set a review trigger | Re-check the register and policy whenever a tool, model or criterion changes | Privacy officer | ☐ |
Also label AI assistants as AI, show candidates how to reach a person, and keep anti-discrimination law in view – it applies to a shortlist whether a person or a program produced it.
If you are building or replacing a screening tool, our AI Pilot for recruitment agrees the decision points, data flows and human review steps in scope before any build starts, then takes one use case to a working pilot in 3–4 weeks for a fixed fee (USD 5,000–15,000 as of October 2026). Written-down decisions make the policy easier to get right.
Related reading: AI recruitment software in Australia – what to build first · AI for JobAdder and Bullhorn
Frequently asked questions
Do I need to update my privacy policy if I use AI to screen job applicants in Australia? Possibly. From 10 December 2026, applicable APP entities must describe qualifying automated decisions – where a program uses personal information to make, or do something substantially and directly related to making, a significant decision – in their privacy policy. Assess CV screening that rejects or ranks candidates with your adviser, using the OAIC's APP 1 guidelines.
Is an interview scheduling chatbot an automated decision under the Privacy Act? In most set-ups it is unlikely to be, because offering and rebooking interview slots is logistics rather than a decision about suitability. That can change if access to slots depends on an automated score, so check how your tool is configured.
Does the new rule apply if my AI screening tool is provided by an overseas vendor? If you have arranged for the tool to be used on your candidates, describing it in your privacy policy is your organisation's job. Separately, if the vendor stores or can access candidate data overseas, assess the arrangement under APP 8. This article is not legal advice.
📥 무료 다운로드: 2026 베트남 오프쇼어 개발 비용 가이드
실제 개발자 단가, 프로젝트 비용 내역, 예산 기획 템플릿. 200명 이상의 스타트업 창업자가 사용 중.
구축할 준비가 되셨나요?
NKKTech은 AI Development 프로젝트를 $30K부터 제공합니다.
고정 범위. 베트남 시니어 엔지니어. 14일 킥오프.
10+ years building AI systems for Toyota, Sony, and Rakuten in Japan. Founded NKKTech in 2018 with a senior-only engineering model.
NKKTech과 함께 만들고 싶으신가요?
Building a screening tool you will have to describe in your privacy policy? Start with the decision map. We will write down with you what the tool decides, what it reads and where a recruiter steps in, then build a working pilot on one role family in 3–4 weeks for a fixed fee.
무료 상담 예약