Control
The privacy policy does not describe the decisions computer programs make or help make with personal information
Where an organisation has arranged for a computer program to make, or do something substantially and directly related to making, decisions that could significantly affect individuals using their personal information, its privacy policy must state the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions the program substantially helps make.
Informational data, not legal advice. Summaries and rules have not been reviewed by a lawyer: always verify official law text for decisions. A suggested guard is intended to address each rule; adding it is not a statement of compliance to that law.
Reach
enacted, not yet applying in Australia (AU); next date 2026-12-10.
Trust and provenance
How far the rules this guard addresses have been checked. Each rule links to its provision, with its citation, official text and its own panel.
- This control
- Audit-grade: meets all 3 checks of the TwinEthos audit standard that apply to it.
- Lanes
- Binding law — not yet in force or stayed 1
- Verification
- Sources last verified 3 Oct 2026; each provision states how.
- Data release
- Data release 2026.10.03.3, data as of 3 Oct 2026, schema 0.3.9.
- Legal review
- None of the 1 rule has been reviewed by a lawyer; no TwinEthos rule has been legally reviewed yet. Treat each as research to check against the official text; it is not legal advice. Open questions for counsel on them: 1.
- Audit standard
- 1 of 1 rule audit-grade. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
- Detectors
- 2 detectors, all experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify. Each provision lists its detectors' known limits.
The guard to add
Keep an automated-decisions section in the privacy policy, generated or checked against the decision paths in code.
A section of the privacy policy that lists the kinds of decisions computer programs make solely, the kinds they substantially and directly help make (scores, rankings, recommendations a person then decides on), and the kinds of personal information each uses. Keep a small inventory in the repository (decision name, model or rule, inputs, solely automated or assisted) and a CI check that every decision service calling a model or scoring rule appears in the inventory and in the policy, so a new decision path cannot ship without its policy entry.
Where it goes: 11 CI/CD pipeline, 12 repository artifacts, 14 user-facing text.
What reviewers look for: a privacy policy file with an automated-decisions section naming decision kinds and the personal information used; a decisions inventory (decisions.yaml) whose entries match the decision services in code; a CI step that compares them.
Example (APP privacy policy), before:
# Privacy policy
We collect your name, contact details and transaction history to provide our services.After:
# Privacy policy
We collect your name, contact details and transaction history to provide our services.
## Automated decisions
Decisions made solely by a computer program: instant approval or decline of credit limit increases
(uses your income, repayment history and current balances).
Decisions a computer program substantially helps us make: fraud reviews, where a model scores each
transaction (uses transaction amount, merchant, device and location) before a staff member decides.Engineering guidance, not legal advice. Each provision below may add its own details (a cadence, a deadline, a required notice element): open it for those.
Upcoming dates
Every rule this guard addresses
Binding law — not yet in force or stayed (1)
- Australia (AU)
- State in the APP privacy policy the personal information computer programs use and the decisions they make or substantially help make (Australia, APP 1.7-1.9) POLA Act 2024, Sch. 1 item 88 (APP 1.7-1.9, automated decisions) · applies from 2026-12-10 · AI-adjacent law
Informational data, not legal advice. Summaries are TwinEthos's own words and rules have not been reviewed by a lawyer: check the official text before relying on any of it. A guard addresses an item; adding it is not a statement that your code meets any law.