From December 2026, if software makes decisions about people, your privacy policy must say so
New Privacy Act rules from 10 December 2026 make businesses disclose automated decision-making. Who's caught, what to write, and how to get ready in time.
From 10 December 2026, Australian privacy law requires businesses to disclose when computer programs make significant decisions about people. If software scores, filters, approves or prices anything involving humans in your business, this applies to you.
Buried in Australia's 2024 privacy reforms is an obligation with a long fuse: from 10 December 2026, privacy policies must explain the automated decision-making a business uses. It sounds bureaucratic. It is actually one of the first legal obligations in Australia that forces businesses to take stock of what their software — increasingly, their AI — decides on its own.
What exactly has to be disclosed?
From 10 December 2026, Australian businesses covered by the Privacy Act must disclose automated decision-making (ADM) in their privacy policy: the kinds of personal information their computer programs use, and the kinds of significant decisions those programs make, or substantially and directly help a person make. The rule sits in new Australian Privacy Principles 1.7 to 1.9, added by the Privacy and Other Legislation Amendment Act 2024, and it applies wherever a decision could reasonably be expected to significantly affect someone's rights or interests. It covers businesses already bound by the Act — generally those with over $3 million turnover, plus smaller businesses in certain categories like health services.
The regulator has already shown how it reads the rule. On 30 September 2026 the Office of the Australian Information Commissioner (OAIC) released a fact sheet, a flowchart and updated APP 1 Guidelines on it. Three points matter most for a typical business: a "computer program" includes rule-based software and even a ranking formula in a spreadsheet, not just AI; a decision can still be in scope when a person reviews the output; and if you are unsure, the OAIC's advice is to take a cautious approach and disclose.
What counts as an automated decision in a normal business?
More than most owners assume. Likely candidates hiding in everyday tools:
Finance and lending
credit scoring, loan pre-approvals, automated risk pricing.
Recruitment
software that screens, ranks or filters candidates before a human looks.
Real estate
automated tenant screening and rental application scoring, worth checking in any real estate agency's leasing software.
Insurance and advice
algorithmic pricing and eligibility checks.
Health and care
software or spreadsheet formulas that triage patients or decide who is contacted first (an example straight from the OAIC's fact sheet). Healthcare practices that hold health information are covered whatever their turnover.
Retail
personalised pricing on significant purchases, and facial recognition that matches shoppers against a watchlist.
Anything with an AI layer
if an AI tool recommends who gets a callback, a discount or a decline, and a human rubber-stamps it, that is "substantially assisted" territory.
How do you get your privacy policy ready by 10 December 2026?
Getting ready is a stocktake, a policy update, and a judgement call on human review:
Inventory the decisions.
List where software scores, ranks, filters, prices or approves anything involving a person — including spreadsheets with ranking formulas and AI tools adopted informally by staff. (This inventory is the same one good AI governance needs anyway; do it once, use it twice.)
Classify significance.
A spam filter is not a significant decision about a person's rights; declining a rental application is. When in doubt, list it.
Update the privacy policy.
Plain-English descriptions of the information used and decision types — not vendor names or algorithm details. The OAIC says you can group similar decisions, but the detail must be meaningful to a reasonable person, any health or biometric information should be called out clearly, and trade secrets and commercially sensitive details can stay out.
Add a human path.
The reform's direction of travel is people being able to question automated outcomes. Building a review path now is cheap; retrofitting one under complaint is not.
Frequently asked questions
We're under $3 million turnover — can we ignore this?
Mostly, unless you are in an always-covered category (health services being the big one) or trade in personal information. But if larger clients rely on your processing, expect their contracts to push the obligation down to you regardless.
Does using ChatGPT or Copilot trigger this?
Not by itself. The trigger is software making or substantially assisting decisions that significantly affect people's rights or interests — drafting an email does not; auto-ranking job applicants does.
Does it still count if a person makes the final decision?
Often, yes. Human review does not automatically take a decision out of scope. The OAIC expects machine-learning or generative AI outputs used for significant decisions to be covered unless there is extensive human oversight and control. If staff usually go with the score or ranking, list it.
Isn't this our software vendor's problem?
No. The OAIC generally expects the obligation to stay with the business using personal information to make the decision, not the company that built the tool. Vendors should give you clear, high-level information about how their software makes or informs decisions, so ask for it now rather than in the first week of December.
What should an ADM statement in a privacy policy say?
Name the kinds of personal information and the kinds of decisions, in plain English. A real estate agency might write: "We use software to score rental applications using the income, rental history and references you provide. A property manager reviews each score before an application is approved or declined."
What happens if we just don't update the policy?
Transparency breaches sit inside the Privacy Act's beefed-up penalty framework, and the regulator has been signalling a more active enforcement posture across 2026. The fix costs an afternoon; being an example costs considerably more.
Who should own this internally?
Whoever owns privacy generally — but they need IT's help for the inventory, because the decisions live inside systems. We produce exactly this software-and-AI inventory as part of our governance work.
Start with the stocktake
The deadline is now weeks away, not months. Key IT helps Melbourne businesses inventory their automated and AI-assisted decisions as part of Using AI safely & securely — the same exercise that keeps AI adoption sane also gets your privacy policy ready. Not sure where AI is already making calls in your business? Our free AI readiness self-check is a quick first look. And if Microsoft Copilot is already in the building, our managed Microsoft Copilot service handles the governance side of that rollout too.
More insights
Australia's new privacy tort
Australia's statutory privacy tort lets people sue any business, however small, over a serious…
Read article →ScamsThe $25M deepfake phone call
AI voice cloning lets scammers fake your voice to authorise payments. Here's how Melbourne…
Read article →Cyber insuranceCyber insurance renewal checklist
Cyber insurance renewal checklist for 2026: the six controls Australian insurers check, the…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.