Free resource | ADM disclosure
From 10 December 2026, APP entities must add information to their privacy policy when a computer program uses personal information to make, or do something substantially and directly related to making, a decision that could significantly affect an individual's rights or interests. This editable template gives you a structure for that disclosure.
What it is
An automated decision making disclosure is a section of your privacy policy that explains, in plain language, the kinds of personal information used and the kinds of decisions made with the relevant computer programs.
The obligation comes from the Privacy and Other Legislation Amendment Act 2024 (Cth). Its automated decision provisions commence on 10 December 2026. The OAIC guidance for APP 1 explains the information that will need to appear in an APP privacy policy.
Download
Start with the Word document, then replace the bracketed fields with your real processes. The browser download starts as soon as you submit the short form.
ADM disclosure template
A branded, editable Word document. Open it in Word, Google Docs or Pages, replace the bracketed fields with your organisation's details, and paste the completed sections into your privacy policy.
The download starts in your browser and we also try to email a copy. You are not added to a mailing list. We handle the submitted details under our privacy policy.
Adapt it
The work falls into three parts. Map the processes, write the disclosure, then keep it current. The detailed instructions remain below for teams doing the work themselves.
List the automated processes, personal information and outcomes before writing the policy text.
Record the decision, role of automation, information used and any human review.
Embed the disclosure in your privacy policy and set an owner and review date.
Before filling in the template, list every AI tool or automated process that uses personal information and produces outputs that could significantly affect individuals. You cannot write an accurate disclosure without this list.
For each process in scope, fill in the four fields covering what is being decided, how automation is involved, what personal information is used, and what human review (if any) is in place.
A disclosure that says only 'we use AI in some decisions' does not meet the obligation and does not help individuals. Name the type of decision and describe the process in plain terms.
Add the completed disclosure as a section of your privacy policy, or include a clear reference to it from your policy. The privacy policy is where the legal obligation sits.
A privacy professional can check that your disclosure covers every process in scope, uses accurate language, and meets the requirement. Building in time for review is important.
Update the disclosure whenever you introduce or change an automated process that affects individuals. Set a review date and stick to it.
Template content
Below is the full template text. Everything in [square brackets] is a placeholder to replace with your organisation's own details. Duplicate the decision area section for each automated process in scope.
[Organisation name] uses automated processes and computer programs (including artificial intelligence tools) in the following ways that may significantly affect individuals. Where we use your personal information in these processes, we disclose that use below.
What we decide: [Brief description, e.g. whether to progress your application to a human review stage.]
How automation is involved: [Describe the process and tool, e.g. we use [tool name] to score applications against defined criteria. The output is reviewed by a staff member before any final decision is made.]
Personal information used: [List categories, e.g. name, employment history, qualifications.]
Human involvement: [Describe the review step, e.g. all automated outputs are reviewed by [role name] before a final decision is communicated.]
Outcome: [Describe next steps, e.g. if your application does not progress, you will receive notice and may request a manual review.]
What we decide:
How automation is involved:
Personal information used:
Human involvement:
Outcome:
[Optional but useful: state contexts where you do not use automated decision-making to reduce ambiguity. E.g. All complaints, appeals and enforcement-related decisions are made by staff without automated assistance.]
If a decision significantly affects you and an automated process was involved, you may request information about how the decision was made, ask for human review of the decision, or correct personal information we hold that was used in the process. To make a request, contact [privacy contact name or role] at [email address].
We review our automated decision-making processes and update this disclosure when processes change. This section was last reviewed on [date].
This template is general information only. It does not constitute legal advice or a legal opinion on your obligations under the Privacy Act 1988 (Cth) or any other law. VibeZero is not a law firm. Consult a qualified privacy professional before 10 December 2026.
Next steps
The disclosure is one part of compliance. You also need to know which processes are in scope, how data flows through them, and whether your privacy policy as a whole is accurate. These resources and services help with the rest.
FAQ
An ADM (automated decision-making) disclosure is a statement in your privacy policy that explains where you use computer programs or automated processes to make, or substantially help make, decisions that could significantly affect individuals. From 10 December 2026, this disclosure is required for organisations covered by the Australian Privacy Act 1988 (Cth) under the Privacy and Other Legislation Amendment Act 2024.
Tailor it carefully
