The limb (a) test.
Limb (a) is one of three.
APP 1.7 has three limbs, and all three must be true before anything has to go in a privacy policy. This page tests the first one only, because it is the limb that decides scope and the one people get wrong.
The other two are narrower and easier to answer. Limb (b): could the decision reasonably be expected to significantly affect the rights or interests of an individual? Limb (c): is personal information about that individual used in the operation of the computer program to make the decision, or to do the thing that is substantially and directly related to making it?
The obligation is a transparency obligation. It creates no right to an explanation, no right to object, and no prohibition on automated decision-making.
Six steps, one decision at a time.
- 01
Name the decision, not the system.
Write it as a sentence with a verb and a person: we decline the application, we set the premium, we order the queue. If you cannot name the person the decision lands on, you are describing a system rather than a decision, and the test will not work.
- 02
Has the entity arranged for a computer program to make it, with no person choosing?
The words in APP 1.7(a) are “has arranged for”. A system a third party runs on your behalf is still arranged for by you. If yes, limb (a) is met. Record it and stop here. If a person makes the choice, keep going: the limb reaches further than fully automated decisions.
- 03
Name what the program produces that reaches the decision.
A score. A rank. A flag. An eligibility result. A shortlist. A recommendation. A draft. A calculation. If the program produces nothing that reaches this decision, limb (a) is not met.
- 04
Is that output directly related to the decision?
The Explanatory Memorandum, as the OAIC quotes it, reads directly as “where the thing has a direct connection with making the decision”. Ask what sits between the output and the decision. If the answer is nothing, it is direct.
- 05
Is that output substantially related to the decision?
The Explanatory Memorandum, as the OAIC quotes it, reads substantially as “where it is a key factor in facilitating the human’s decision making”. The working question: if the output were removed, or reversed, would the decision routinely change? Routinely means as a matter of course, not once in a hundred files.
- 06
Both, or neither.
Limb (a) is met only where step 04 and step 05 are both yes. Directly related on its own is not enough, and that is where most assessments go wrong.
Two points the Act settles for you. APP 1.9 provides that making a decision includes refusing or failing to make one, and that doing a thing includes refusing or failing to do it. A program that does not flag, does not escalate or does not return a result is still doing a thing.
Two things that decide how big this is.
Nothing is grandfathered
The Act applies to decisions made after commencement whether the arrangement for the computer program was made, the personal information was used in it, or that personal information was acquired or created, before or after that date.
Every system already running is in scope from day one. Age is not a defence.
It is enforceable from day one
The same Part adds APP 1.7 by name to the list in section 13K(1)(b) of the Privacy Act, immediately after APP 1.4. From commencement, a privacy policy that omits the required information contravenes section 13K(1).
Section 13K itself has been in force since 11 December 2024. Only the hook for APP 1.7 arrives on 10 December 2026.
Both sit in Schedule 1 Part 15 itself: the application provision at item 89, and the section 13K amendment at item 87. Note the precision: APP 1.7 does not become a civil penalty provision. Section 13K(1) is the civil penalty provision, and breaching APP 1.7 becomes conduct that contravenes it, which opens the Commissioner’s infringement notice and compliance notice routes.
The regulator’s own two examples.
Scoring calls to a crisis hotline
A pre-programmed formula used to score and triage people calling a domestic violence crisis hotline, where the score is a key factor in a person deciding what order to attend calls.
Directly related, and substantially related. Limb (a) met.
Working out an age from a date of birth
The same kind of formula, used only to arrive at an age in years from a date of birth entered into the spreadsheet.
May be directly related. Not substantially related. Limb (a) not met.
Both examples are the OAIC’s, given in its Automated Decision-Making Issues Paper, 18 May 2026, illustrating the Explanatory Memorandum at [337].
The answer is not the output. The reasoning is.
- 01
The decision, in one sentence
- 02
The system, and what it produces
- 03
Step 04 · directly related, and why
- 04
Step 05 · substantially related, and why
- 05
Limb (a) met, yes or no
- 06
Assessed by, and the date
Download the test as an editable Word document
Six steps, the two calibration examples and the six record fields, with room to write. No form, no email address.
Where every line of this came from.
Privacy Act 1988 (Cth), Schedule 1, Australian Privacy Principle 1.7 · inserted by Schedule 1 Part 15 of the Privacy and Other Legislation Amendment Act 2024 (Cth). Commences 10 December 2026. Statutory text read 6 September 2026. legislation.gov.au
Privacy Act 1988 (Cth), section 13K · compilation No. 104, in force 4 June 2026. That compilation does not yet carry subparagraph (iia), because the amendment at Part 15 item 87 commences with the rest of the Part on 10 December 2026. legislation.gov.au
The meaning of substantially and directly · Explanatory Memorandum at [337], as quoted by the OAIC in its Automated Decision-Making Issues Paper, 18 May 2026, at page 12, which is also where both worked examples come from. We quote the OAIC quoting the Memorandum rather than the Memorandum itself, because the Bill carried three versions of it and paragraph numbering can differ between them. Issues Paper read 6 September 2026. oaic.gov.au
The OAIC’s guidance on these provisions is still in development. Consultation on the Issues Paper closed 15 June 2026, and no guidance had been published as at 10 September 2026. This page states the position as at the dates above and will be reissued when the guidance lands.
Scope. General information, current at the dates shown above. Not legal advice, and it does not guarantee compliance. Confirm the position for your own entity.
Work through one decision with us.
Thirty minutes. No pitch. No proposal until it makes sense.