The date and the scope
The OAIC states that new privacy-policy transparency requirements for certain automated decisions commence on 10 December 2026. They apply to APP entities where the statutory conditions are met. They should not be presented as a blanket rule that every recruiter must obtain a particular certification, board minute or privacy impact assessment.
This article was reviewed on 9 October 2026. The earlier seven-month countdown is no longer a useful planning assumption. Work backwards from the commencement date, using the systems and open questions in your own organisation. Give your privacy adviser enough time to assess your actual arrangements, rather than asking them to approve a generic template. The dated compliance plan covers the work plan that sits behind that timetable.
Workstream one: inventory decisions, not just software
For each recruitment workflow, record the decision being made, who it affects, what personal information is used and what the software does. A product list isn’t enough: the same application may support a simple drafting task and a materially different selection workflow, so record those uses separately.
Include rules, filters and ranking features as well as generative AI. Capture the human step, what evidence the reviewer sees and whether the output changes which candidates are considered. Don’t declare a workflow out of scope solely because a person clicks approve. Equally, don’t declare every calendar or search operation covered without analysing the conditions. When a supplier’s tool goes on the inventory, ask the supplier about data access, processing providers and human review, and request evidence for each answer. The page on how FluxHire handles security covers those same topics for FluxHire.
Workstream two: resolve applicability
Give counsel a concise example for each decision class. Include the actual inputs, output, review process and potential effect on the individual. Ask for a written scope decision and the assumptions behind it. Keep genuinely unresolved cases open; an unsupported assertion that a system is compliant is not a substitute for that assessment.
The OAIC’s consultation material describes requirements involving personal information and decisions with the potential to affect rights or interests. Use current regulator guidance and legislation for the final assessment. This roadmap intentionally avoids penalty amounts and universal interpretations of borderline recruitment uses.
Workstream three: draft accurate disclosures
Build the public-facing description from the approved inventory. Use recognisable categories of information and decisions. Explain the actual role of the software without suggesting that a recruiter reviews material they never see. Check consistency with collection notices, job-application forms and supplier descriptions.
As a hypothetical drafting exercise, suppose an organisation uses software to prepare a qualification summary, which a recruiter checks against the application. Describe that operation accurately and have its legal treatment assessed. Don’t copy a disclosure about fully automated rejection just because another employer uses it. Keep technical implementation details in the internal record where they help maintain the public text.
Workstream four: validate operation and ownership
Run a walkthrough with a recruiter, an operator and the privacy owner. Compare the written process with the screens the recruiter actually sees, and the permissions and actions behind them. Check whether a reviewer can correct an output, record a reason and seek help when source evidence is missing. These are recommended governance controls, not a claim that the new provisions prescribe one universal workflow.
Where an AI output contributes to consequential decisions, give reviewers the authority, information and time to question it. Test disagreement, not only approval. Document how a candidate question or correction request reaches someone able to investigate, and keep the response grounded in the specific record rather than an explanation invented after the event.
Before commencement and after change
Assign a release owner for the policy update. Confirm the public page is reachable, the approved wording is actually published and staff know which version applies. Save the dated approval, the inventory used and any outstanding follow-up items. Don’t mark the project complete just because a draft exists in a shared folder.
After rollout, review changes to models, scoring rules, data categories and candidate decisions against the inventory. A new feature may change the facts the earlier assessment depended on. Make the owner responsible for bringing those changes back to the privacy adviser, instead of assuming the original review covers every future use.
Sources and reading
Primary sources checked 9 October 2026. The practical evaluation steps in this article are editorial recommendations, not measured customer outcomes.
