Automated decisions and your privacy policy: what changes on 10 December 2026

The short answer: from 10 December 2026, organisations covered by the Privacy Act that use a computer program to make — or substantially and directly help make — decisions that could significantly affect a person, using that person's information, must describe that in their privacy policy. It doesn't stop you using the software. It requires you to know where it is and say so in plain language.

The change came in through the Privacy and Other Legislation Amendment Act 2024 and sits in Australian Privacy Principle 1, the principle that governs your privacy policy. It applies to decisions made from 10 December 2026, regardless of when the information was collected.

This is orientation, not legal advice. Whether and how it applies to your business turns on specifics, and a privacy policy update should be reviewed by a qualified person.

Does it apply to your business?

The obligation applies to organisations already bound by the Privacy Act — APP entities. Most businesses with an annual turnover of $3 million or less are generally exempt from the Act, which means many small businesses won't be caught.

"Generally" is doing real work in that sentence. Some businesses are covered regardless of turnover, and the one that matters most for our readers is that health service providers are covered whatever their size. The definition is broader than many clinics and care providers assume. Others covered regardless of size include businesses that trade in personal information and contracted service providers to the Commonwealth.

If you already maintain a privacy policy because you're required to, assume this applies and check. If you're under the threshold and none of the exceptions fit, the obligation probably doesn't reach you — but the inventory below is still worth doing, because larger clients, funders and insurers increasingly ask the same questions.

What counts as an automated decision

Paraphrasing the new principle, three things need to be true together:

1. A computer program is involved in the decision — either making it alone, or doing something substantially and directly related to it, such as producing a score, ranking or recommendation a person relies on.
2. The decision could reasonably be expected to significantly affect someone's rights or interests.
3. The person's own personal information is used by the program in doing it.

Two points get missed. First, it isn't limited to fully automated decisions: a tool whose output is a key factor in a person's decision can count. Second, the test turns on the decision, not on whether "AI" is in the product name. A rules-based system in your practice software can be in scope; a chatbot drafting a marketing email generally isn't.

In small and mid-sized businesses, the places worth looking closely include recruitment software that screens or ranks applicants, tenancy application scoring in property management, systems that approve or refuse payment plans or credit, tools that suspend or restrict a customer's account, and any software that triages people into or out of a service. Whether a particular use is in scope is a question for advice; whether you know it exists is a question for you.

What the privacy policy has to say

Where the obligation applies, the policy needs to describe, in plain language, the kinds of personal information used by these programs, the kinds of decisions made solely by a program, and the kinds of decisions where a program does something substantially and directly related to the decision.

It's a description of kinds, not a technical explanation of how your software works. In practice that's closer to a clear paragraph or two than a white paper. The Office of the Australian Information Commissioner has published guidance on the requirement; read the primary source at oaic.gov.au rather than a summary of it, including this one.

The regulator has also been reviewing privacy policies for compliance this year, and a non-compliant policy can attract regulator action, including infringement notices. "We didn't know the feature was on" is not a strong position to be in.

The real work is the inventory

Writing the paragraph is quick. Knowing what to write is the hard part, because automated features arrive in recruitment platforms, CRMs, practice management and property software through routine updates, often switched on by default. The people who'd notice are rarely the people who'd know it matters.

The same discipline answers this and every other AI question in a small business: which tool, which account, what information goes into it, and what comes out. Finding out what your team already uses is the starting point, and questions to ask any AI vendor and the vendor checklist cover what to ask of the software itself. Meeting transcription tools are a common blind spot — AI note-takers in client meetings covers them separately.

Keep the two documents distinct. Your published privacy policy tells the public how you handle their information. Your internal one-page AI policy tells your team what they're allowed to do. You need both, and the inventory feeds both.

What to do between now and December

1. Confirm whether the Privacy Act applies to your business, and get advice if you're not sure.
2. List every tool that touches information about clients, customers, tenants, patients, participants or applicants — including features inside software you already use.
3. Run the five questions above against each one.
4. Draft a plain-language description of anything that meets the test.
5. Have the privacy policy update reviewed by a qualified person before 10 December.
6. Put a review date on it, because the software will change again.

For the wider picture of privacy obligations when a business starts using AI tools, start with privacy basics for small business. In regulated work, audit readiness is the lever explains why the inventory comes before any training.

Reviewed October 2026. This article names a commencement date and regulator guidance, both of which can move, so it carries a review date.