Australian Privacy Principles Reform · 10 December 2026
The decision is automated.Can you trace the data behind it?
From 10 December 2026, APP entities must include specified information in their privacy policies when personal information is used by a computer program to make—or substantially and directly contribute to—a decision reasonably expected to significantly affect someone’s rights or interests.
Can your team connect the personal information, the program and the decision?
The Realising Potential framework — strategy at the core, governance around everything.
until APP 1.7 and 1.8 automated decision-making transparency obligations take effect at midnight AEDT, 10 December 2026.
Maximum civil penalty for serious or repeated interference with privacy
Entities across 6 sectors under the OAIC privacy policy compliance sweep
Automated decision-making disclosures your privacy policy must make under new APP 1.7 and 1.8
2026 — automated decision-making transparency obligations commence under the POLA Act 2024
The Method
Seven elements. One integrated operating picture.
Most organisations are treating APP reform as a legal drafting exercise or an IT ticket. Legal rewrites the privacy policy, IT lists its systems, risk keeps a separate register — and nobody can show how a piece of personal information travels from collection to an automated decision.
Siloed approaches fail because the regulator asks joined-up questions. Realising Potential's Seven Elements framework connects strategy, structures, people, processes, data, technology and governance into one picture you can defend.
Click any element to see how it applies to APP compliance.
Read more about the Seven ElementsAn effective strategy clearly articulates the organisation's goals and objectives. We help you align your strategy. A well aligned and communicated strategy forms the frame for activity, timing and results.
APP Application
Maps automated decision-making policy decisions to commercial risk appetite and sets the regulatory tolerance threshold the board endorses.
Graph Analytics
No other advisory sees your data the way we do.
Spreadsheets and system registers give you lists. Lists can tell you that a CRM, a tracking pixel and a credit model exist — but not that pixel data quietly flows through feature engineering into a loan decision nobody reviews.
Realising Potential's graphing platform renders every relationship between your data sources, derivations, models and decisions as one navigable picture. Exposure that hides between systems becomes visible, traceable and ready to evidence.
Sample environment findings
- 1 Critical
- 6 High
- 3 Medium
What We Enable
Six capabilities that transform how risk managers govern data.
From first visibility to continuous improvement — each capability builds the evidence base a reformed privacy regime demands.
Book a Diagnostic
-- days to map your automated decision exposure.
Our APP Readiness Diagnostic applies the Seven Elements method and graph analytics to your own environment. We trace personal information from collection to automated decision, rank every exposure against the reformed Australian Privacy Principles, and hand you the evidence your board and the OAIC will ask for.
What you receive
- Inventory of every automated decision system mapped to APP 1.7 and 1.8
- Interactive Kineviz data lineage graph of your environment
- Prioritised exposure register with recommended remediation actions
- Board-ready evidence pack for OAIC compliance sweep readiness