Of the three markets, only Australia is about to get a binding rule written for automated decisions. From 10 December 2026, privacy policies there must describe the personal information that feeds computer-assisted decisions with a significant effect on people. Singapore has binding general law, the PDPA, plus the regulator's advisory guidelines on how it applies to AI. New Zealand has no AI-specific rule, but since 1 May 2026 it has a new duty to tell people when you collect their information from someone else. HyreTech is registered in Singapore, so the Singapore column is the regime we operate under ourselves.
The three sit on different timelines, and that is the practical point. What an Australian hiring team has to finish before December is not what a Singapore team has to do this quarter.
Checked against the primary sources on 25 September 2026. This is a plain-language summary, not legal advice. Have counsel in each jurisdiction review anything you publish to candidates.
The Comparison
| Singapore (PDPA) | Australia (Privacy Act 1988) | New Zealand (Privacy Act 2020) | |
|---|---|---|---|
| Binding rule written for automated decisions? | No. The PDPA applies; the PDPC's AI guidelines are advisory | Yes, APP 1.7 to 1.9 | No |
| In force | PDPA now; AI guidelines issued 1 March 2024 | 10 December 2026 | Not applicable |
| Hiring named? | Once, as an example of the business improvement exception | No. Covered if the decision could significantly affect someone | No |
| Consent needed to screen applicants? | Usually not, under the evaluative purpose exception. Notifying the purpose is still required | Not by APP 1.7, which is a privacy-policy disclosure | No consent rule; IPP 3 sets what you tell people at collection |
| What you have to do | Tell candidates the purpose. The guidelines encourage explaining the AI step and the data it uses | Say in your privacy policy what kinds of personal information feed the decisions and what kinds of decisions they are | Check accuracy before use (IPP 8), keep to the original purpose (IPP 10), notify indirect collection (IPP 3A) |
| Most recent change | Advisory guidelines on generative AI, 20 July 2026 | Detailed OAIC guidance consulted on to 15 June 2026, not yet published | IPP 3A in force 1 May 2026 |
| Regulator | PDPC | OAIC | Office of the Privacy Commissioner |
Singapore: Binding Law, Advisory AI Guidance
The binding law is the PDPA. Its consent, notification and accountability obligations apply whether a person or a model reads the resume. On top of it sit the PDPC's Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems, issued 1 March 2024.
They explain how the PDPC reads the PDPA for AI systems, and they state that they are not legally binding on the Commission or on any other party. Treat them as the regulator's published expectations rather than a separate law.
Two points matter for screening. First, consent is usually not the question. The PDPA defines an evaluative purpose as determining a person's suitability, eligibility or qualifications for employment, and the First Schedule allows collecting and using personal data for that purpose without consent.
What does not go away is section 20: before you collect or use the data in connection with entering an employment relationship, you have to tell the candidate the purpose.
Second, the guidelines ask for more than the statute does. They encourage telling people what the system does, which types of personal data it uses and which features weigh most in the result, and they encourage a data protection impact assessment where one is useful. Neither is a legal requirement, and both are what the PDPC will look for if a complaint arrives.
Hiring appears in the guidelines once, and not where most summaries put it. Internal HR systems that recommend job candidates by providing a first cut are listed as a case where the business improvement exception may allow using personal data to build or improve the system without consent.
Two newer documents are worth knowing. The PDPC issued advisory guidelines on personal data in generative AI on 20 July 2026; they build on the 2024 guidelines and are also advisory.
The Workplace Fairness Act 2025 covers hiring decisions but has not commenced, and TAFEP expects it to take effect in end-2027. Singapore's Model AI Governance Framework is a separate, voluntary document about AI governance in general. For the PDPA and hiring in more depth, see our PDPA and AI hiring guide.
Australia: in Force 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024 and gave its automated-decision provisions a 24-month runway, which ends on 10 December 2026.
On the date we checked, that was 76 days away. From then, APP 1.7 to 1.9 require your privacy policy to describe the kinds of personal information used in, and the kinds of decisions made by, computer programs, where a decision could reasonably be expected to significantly affect an individual's rights or interests.
The detail most summaries miss is APP 1.8(c). The rule covers a program that makes the decision, and also one that does a thing "substantially and directly related to making the decision".
Scoring or ranking applicants so a recruiter can decide who to interview is very likely that kind of thing. A person making the final call does not take the screening step outside the rule.
Hiring is not one of the examples in the Act. APP 1.9 lists decisions about benefits under a law, rights under a contract, and access to a significant service or support. The employment link comes from the Explanatory Memorandum, which the OAIC quotes in its May 2026 issues paper: discussing targeted content, it treats limiting someone's access to employment opportunities as a significant effect. Whether your screening crosses the threshold is a question for counsel. Planning as if it does is the safer reading.
The OAIC's APP 1 guidelines cover the new obligations at a high level and say detailed guidance on automated decisions is coming in 2026. The OAIC consulted on that guidance until 15 June 2026. When we checked, the final version had not been published.
Three scoping points decide whether any of this applies to you:
- Most businesses with an annual turnover of A$3 million or less are, though some are not, including businesses that trade in personal information.
- The employee records exemption does not cover unsuccessful job applicants, so applicant data is in scope even where staff records are not.
- A foreign organization is covered if it carries on business in Australia. Since December 2022 that is the test; holding information about people in Australia is not enough on its own.
On AI regulation more broadly, Australia proposed mandatory guardrails for high-risk AI in 2024 and set them aside in its National AI Plan in December 2025, relying on existing laws instead. For hiring, the privacy disclosure is the rule with a date on it.
New Zealand: No AI rule, One New Notice Duty
The Privacy Act 2020 has no equivalent of APP 1.7 or of Singapore's AI guidelines. The Office of the Privacy Commissioner's guidance on AI and the information privacy principles, published in September 2023, explains how the existing principles apply rather than adding new obligations.
Three of the information privacy principles do most of the work for AI screening. IPP 8 requires reasonable steps to check that personal information is accurate and up to date before you use it, which matters when a model scores a candidate on an old or wrong CV. IPP 10 limits using information for a purpose other than the one it was collected for. IPP 3 sets what you tell people when you collect information from them.
The change this year is IPP 3A, in force since 1 May 2026. When you collect personal information about someone from a source other than that person, you now have to tell them, subject to exceptions.
The OPC says it applies to information collected indirectly from any source, so referrals, sourcing from third-party sites and candidate lists shared by another organization are the recruiting cases to review. The publicly available exception can cover a public social media page, but not a profile you can only see as a connection or follower.
There is pressure for more. In November 2025 the OPC called for the Privacy Act to be modernised, including stronger protections for automated decision making. That is the regulator asking, not a government commitment: the government's AI strategy describes a light-touch, principles-based approach.
One link runs across the Tasman. A New Zealand organization that carries on business in Australia can be caught by the Australian Privacy Act, including APP 1.7 from December.
Hiring Across More Than One of These Markets
Work to each market's own timeline rather than applying the strictest rule everywhere. In Singapore, your candidate notices should already state the purpose, and the PDPC's guidelines suggest describing the AI step as well.
In Australia, if you are in scope, the privacy policy update is due on 10 December: draft it now so legal review fits before the deadline. In New Zealand, check how you notify candidates whose details reach you from someone else, which IPP 3A has required since May.
If you are also writing the job ads for these markets, the pay transparency rules differ too. See writing job ads for Singapore, Australia and New Zealand.
What The Disclosure Wording Can Look Like
These are illustrative starting points, not legal advice. Have counsel in each jurisdiction review them before you publish.
Singapore: a Notice of Purpose
The legal minimum is telling candidates the purpose. A notice that also follows the PDPC's guidelines says that an automated system evaluates the application, what it evaluates, and who makes the decision.
For example: "We use software to compare your application with the requirements of this role and rank it for our recruiters. It looks at your stated experience and skills. A member of our hiring team reviews the ranking and makes every hiring decision." Wording such as "we may use technology in hiring" does not tell the candidate the purpose.
Australia: a Privacy Policy Entry, From 10 December 2026
APP 1.7 asks for kinds of information and kinds of decisions, not an explanation of the algorithm. For example: "We use computer programs to help screen job applications.
They analyze the content of your resume, your stated experience and role-related criteria against the requirements of the position, and we use their output when deciding whom to invite to interview." Name the decision the output feeds, because assisted decisions are in scope.
New Zealand: Good Practice
No format is mandated. Saying plainly at collection that AI-assisted tools are used in screening, and that a person makes the final decision, is a reasonable baseline under IPP 3. If some candidate details come from third parties, add the notice IPP 3A requires.
Where HyreTech Fits
HyreTech Pte. Ltd. is registered in Singapore, and the application and database run in Singapore (asia-southeast1). The providers that receive resume text are named in our privacy policy, and the help centre sets out where candidate data is processed, which covers the "where does the data go" part of a notice. More on the Singapore setup is on the Singapore page.
Every score comes with reasoning for each criterion, which makes it easier to describe the kinds of personal information the screening step uses. HyreTech has no auto-reject: advancing or rejecting a candidate is always an action someone on your team takes.
In Australia that does not take you outside APP 1.7, for the reason above. It does mean the decision you disclose is your team's, made with a ranked and explained list in front of it.
Check Your Own Setup
If you want to see what the scoring uses before you write the disclosure: Start free and read the reasoning on a real role.
If you hire across more than one of these markets: Book a demo and we will walk through what the AI step does and where the data goes, so your counsel has what they need.
FAQ
Is AI resume screening legal in Australia?
Yes. No Australian law bans it. From 10 December 2026, organizations covered by the Privacy Act must describe in their privacy policy the kinds of personal information used in, and the kinds of decisions made with, computer programs where a decision could significantly affect someone. Most businesses with an annual turnover of A$3 million or less are outside the Act.
When does Australia's automated decision-making rule start?
On 10 December 2026. The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024 and delayed the APP 1.7 to 1.9 obligations by 24 months.
If a human makes the final hiring decision, does APP 1.7 still apply?
Very likely, yes. APP 1.8(c) covers a program that does something substantially and directly related to making the decision, not only a program that decides. Scoring or ranking applicants for a recruiter is the kind of step it describes. Confirm your own case with counsel.
Do I need candidate consent to use AI screening in Singapore?
Usually not. The PDPA's evaluative purpose exception covers using personal data to decide whether someone is suitable for employment without consent. You still have to tell candidates the purpose under section 20, and the PDPC's advisory guidelines encourage explaining what the AI step does and which data it uses.
Are the PDPC's AI guidelines legally binding?
No. The guidelines state that they are advisory and not legally binding on the Commission or any other party. The PDPA they interpret is binding.
Do I need a data protection impact assessment to use AI in hiring in Singapore?
Not as a legal requirement. The PDPC's guidelines encourage impact assessments, including DPIAs, where they are useful. For high-volume screening, one is a practical way to show you have thought through the risks.
Does New Zealand have an AI hiring law?
No. The Privacy Act 2020 has no rule written for automated decisions. The existing principles apply, most relevantly IPP 8 (accuracy), IPP 10 (limits on use) and, since 1 May 2026, IPP 3A (notice when you collect information about someone from another source). A New Zealand organization that carries on business in Australia can also be caught by APP 1.7.