Free resource · ADM disclosure
From 10 December 2026, organisations covered by the Australian Privacy Act must disclose in their privacy policy where automated processes make decisions that significantly affect individuals. This editable template gives you a clear structure for that disclosure.
What it is
An automated decision-making (ADM) disclosure is a section of your privacy policy that explains, in plain language, where your organisation uses computer programs or AI to make or substantially assist in decisions that could significantly affect individuals.
The obligation comes from the Privacy and Other Legislation Amendment Act 2024 (Cth), which takes effect on 10 December 2026. At that date, organisations covered by the Privacy Act 1988 must make the disclosure in their privacy policy.
How to use it
Download the Word file and work through it in order. Replace everything in square brackets with your own details. The goal is accuracy, not length.
Step 01
Before filling in the template, list every AI tool or automated process that uses personal information and produces outputs that could significantly affect individuals. You cannot write an accurate disclosure without this list.
Step 02
For each process in scope, fill in the four fields covering what is being decided, how automation is involved, what personal information is used, and what human review (if any) is in place.
Step 03
A disclosure that says only 'we use AI in some decisions' does not meet the obligation and does not help individuals. Name the type of decision and describe the process in plain terms.
Step 04
Add the completed disclosure as a section of your privacy policy, or include a clear reference to it from your policy. The privacy policy is where the legal obligation sits.
Step 05
A privacy professional can check that your disclosure covers every process in scope, uses accurate language, and meets the requirement. Building in time for review is important.
Step 06
Update the disclosure whenever you introduce or change an automated process that affects individuals. Set a review date and stick to it.
Download
ADM disclosure template
A branded, editable Word document. Open it in Word, Google Docs or Pages, replace the bracketed fields with your organisation's details, and paste the completed sections into your privacy policy.
Template content
Below is the full template text. Everything in [square brackets] is a placeholder to replace with your organisation's own details. Duplicate the decision area section for each automated process in scope.
[Organisation name] uses automated processes and computer programs (including artificial intelligence tools) in the following ways that may significantly affect individuals. Where we use your personal information in these processes, we disclose that use below.
What we decide: [Brief description, e.g. whether to progress your application to a human review stage.]
How automation is involved: [Describe the process and tool, e.g. we use [tool name] to score applications against defined criteria. The output is reviewed by a staff member before any final decision is made.]
Personal information used: [List categories, e.g. name, employment history, qualifications.]
Human involvement: [Describe the review step, e.g. all automated outputs are reviewed by [role name] before a final decision is communicated.]
Outcome: [Describe next steps, e.g. if your application does not progress, you will receive notice and may request a manual review.]
What we decide:
How automation is involved:
Personal information used:
Human involvement:
Outcome:
[Optional but useful: state contexts where you do not use automated decision-making to reduce ambiguity. E.g. All complaints, appeals and enforcement-related decisions are made by staff without automated assistance.]
If a decision significantly affects you and an automated process was involved, you may request information about how the decision was made, ask for human review of the decision, or correct personal information we hold that was used in the process. To make a request, contact [privacy contact name or role] at [email address].
We review our automated decision-making processes and update this disclosure when processes change. This section was last reviewed on [date].
This template is general information only. It does not constitute legal advice or a legal opinion on your obligations under the Privacy Act 1988 (Cth) or any other law. VibeZero is not a law firm. Consult a qualified privacy professional before 10 December 2026.
Next steps
The disclosure is one part of compliance. You also need to know which processes are in scope, how data flows through them, and whether your privacy policy as a whole is accurate. These resources and services help with the rest.
FAQ
Tailor it carefully
