We automatically score leads / screen CVs / assess claims. Is that covered by the new rules?

Possibly — and it’s worth finding out before December.

The December 2026 Privacy Act changes apply to any computer program that uses personal information to make a decision that could significantly affect an individual’s rights or interests. The definition of “computer program” is deliberately broad. It covers rule-based systems and AI models equally. A scoring tool built years ago in a spreadsheet can be in scope; it doesn’t need to be sophisticated.

For your specific examples:

Lead scoring. The question is whether the score makes a significant decision or informs one that a human then makes. If a person reviews the score and exercises their own judgement, the obligation is less clear. If the tool automatically routes, deprioritises, or excludes people without human review, it’s more likely in scope.

CV screening. Employment decisions are squarely within the kind of significant decisions the new APPs are designed to cover. Automated screening that filters applicants before a human sees them is likely in scope.

Claims assessment. Financial and insurance decisions that affect people’s access to money are high-significance by nature. If your claims tool makes or heavily shapes that outcome automatically, this is almost certainly in scope.

Where most businesses land when they first look at this is “possibly.” The mapping exercise — what does this tool actually do, what data does it use, what’s the decision, how significant is it — is what turns “possibly” into a clear answer. It’s not a complex exercise, but it does need to happen before December.