Automated decisions and your privacy policy: what changes on 10 December 2026

The short answer: say which decisions your software makes

From 10 December 2026, a business covered by the Privacy Act has to explain in its privacy policy when it uses a computer program to make, or help make, decisions that could significantly affect people. The policy has to say what kinds of personal information those programs use and what kinds of decisions they make or substantially help with. It doesn't have to explain how the software works or reveal trade secrets.

The rule comes from the Privacy and Other Legislation Amendment Act 2024, which added three new subclauses, 1.7 to 1.9, to Australian Privacy Principle 1. The Act received Royal Assent on 10 December 2024, and the new rule starts two years after that, which gave businesses time to prepare. The OAIC published its guidance on 30 September 2026: an updated APP 1 chapter, a fact sheet and a flowchart.

The change applies to decisions made after 10 December, even if you set the system up years ago and the information it uses was collected long before. So the work is mostly an inventory of what you already run. This guide is general information for Australian businesses, not legal advice. If a decision in your business could seriously affect someone, check your wording with your adviser.

First, check whether the Privacy Act covers your business

The new rule only applies to APP entities, which means organisations covered by the Privacy Act. The OAIC says most small businesses, those with annual turnover of $3 million or less, aren't covered. Turnover here includes all income from all sources, not just sales. The OAIC's small business checklist also asks whether your turnover has been more than $3 million in any financial year since 2002, so if you once crossed that line, check carefully.

Some businesses are covered whatever their size. The OAIC's list includes the kinds of business at the end of this section. Health service providers is a wide category: it includes medical practitioners, pharmacists, allied health professionals, complementary therapists, child care centres and private schools.

If you aren't covered, the automated-decision rule isn't compulsory for you. A clear privacy policy is still good practice, and the OAIC suggests small businesses consider opting in to the Privacy Act. If you are covered, read on.

• Health service providers.
• Businesses that trade in personal information.
• Contractors providing services under a Commonwealth contract.
• Operators of residential tenancy databases and credit reporting bodies.
• Reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
• Businesses related to a business the Privacy Act covers, and businesses that have opted in.

Keep readingCheck the privacy basics for handling enquiry details

The three tests that bring a decision into scope

APP 1.7 applies when all three conditions listed at the end of this section are true. Each condition is broader than it first sounds.

A computer program isn't just AI. The OAIC's fact sheet says it includes pre-programmed rule-based processes, machine learning, ordinary software and apps, and generative AI tools such as chatbots. Its first worked example is a spreadsheet formula that scores and ranks clients for care. A decision includes refusing or failing to decide or act, so a tool that works out who not to contact counts as well.

A decision has to be one that could significantly affect someone's rights or interests, for better or worse. The OAIC says the impact must be "more than trivial" and able to considerably influence the person's circumstances. Its list of interests that would generally be in scope includes access to healthcare, aged care, education, banking and credit, telecommunications, essential utilities, employment and housing. Vulnerability matters too: a decision that barely affects most people can be significant for a child or a person experiencing vulnerability.

If you're unsure whether a use is in scope, the OAIC's advice is to "take a cautious approach" and include it in your policy.

• Your business has arranged for a computer program to make a decision, or to do something substantially and directly related to making it. Buying, configuring or relying on someone else's software counts.
• The decision could reasonably be expected to significantly affect the rights or interests of an individual.
• Personal information about that person is used in the program's operation.

A person signing off doesn't take it out of scope

Many businesses will assume they're fine because a person always makes the final call. The OAIC disagrees. A decision may be in scope "even where a computer program output does not replace the entire decision-making process or is subject to human review." A program is substantially related to a decision when it's a key factor in the person's decision, and directly related when it has a direct connection with making it.

The OAIC's examples show where the line sits. A scholarship panel that can ignore a program's ranking, but still considers it, is in scope. So is a manager using a generative AI report that suggests bonuses and pay rises, even with HR oversight and director sign-off, because the report is relied on to document the reasoning. The OAIC says that if staff interrogated the outputs, reviewed the underlying measures, used other evidence and recorded why they departed from the recommendation, the program might no longer be a substantial factor.

Its general position is that machine learning or generative AI outputs used in significant decisions will usually be in scope "unless subject to extensive human oversight and control." What isn't captured is software used for something other than the decision itself. A word processor used to type up a decision a person already made doesn't count.

Where an Australian business is likely to meet it

The OAIC's examples aren't all about banks and government agencies. Among the arrangements it says would generally count are buying an AI system that screens and ranks job applicants, letting staff use an AI chat tool to draft performance assessments that decide promotions, and contracting software to approve or decline refunds automatically. A case management system that automatically escalates certain complaints is on the list too. Its other examples include a rideshare program that suspends accounts and personalised pricing for significant goods.

For a typical service business, the places to look are anything that screens, scores, ranks, approves, declines or prioritises people. That covers online booking rules that decide who can book, eligibility or triage questionnaires, finance or payment-plan approvals, tenant or applicant screening, and recruitment tools. An AI assistant that decides which enquiries get a call back belongs on the list as well.

Not every automation reaches the significance test. A reminder text, or a form that routes a quote request to the right team member, is unlikely to considerably affect anyone. A chatbot that refuses refunds, a tool that decides who can book a health appointment, or a screen that filters out job applicants is different. Judge it by the effect on the person, not by how clever the software is.

Keep readingDecide what a website chatbot should hand to a person

What your privacy policy has to say

APP 1.8 asks for three things: the kinds of personal information used in the operation of those programs, the kinds of decisions made solely by them, and the kinds of decisions where they do something substantially and directly related to the decision. Keep fully automated decisions and computer-assisted ones separate, because the law treats them as different categories.

You can group similar decisions and types of information, but the OAIC says the detail must be "meaningful to a reasonable person." Write in plain language, avoid technical detail people don't need, and make clear when sensitive information such as health information or biometrics is used. Tell people how to ask for more information, and frame the section so a decision can be questioned or reviewed.

You don't have to publish commercially sensitive information or trade secrets, such as how a program weights each piece of information. That exclusion is narrow. The fact that you use personal information in automated decisions isn't commercial-in-confidence, and neither is information that would only embarrass you.

If you use someone else's software, the obligation still sits with you. The OAIC expects software providers to give clear, high-level information about how their products make decisions, so ask your vendors for it now. Once the rule starts, leaving the required information out of your policy can lead to an OAIC compliance notice or infringement notice.

Keep readingSet your team's rules for everyday AI tools

Worked example: a physiotherapy clinic's new policy section

Here's a made-up example to show what this can look like. A physiotherapy clinic in Geelong turns over well under $3 million, but as a health service provider it's covered by the Privacy Act anyway. New patients book online. Their answers to a short intake questionnaire are scored by rules in the booking software, which decides whether they can book online or are told to contact the clinic or seek urgent care first. The front desk uses the same score to decide who gets a call back first when the waitlist opens.

Access to health services is one of the interests the OAIC lists as significant, and the program both decides some outcomes and substantially informs others. So the clinic adds a short section to its privacy policy. It uses the points below as its draft and asks its adviser to check it before 10 December.

• Our online booking system uses the answers you give in our intake questionnaire, including your symptoms, injury history, age and contact details.
• Decisions made automatically: whether you can book an initial appointment online, and which appointment types you're offered.
• Decisions our staff make with the system's help: the order in which people on our waitlist are offered appointments.
• If you'd like to know more about how these decisions are made, or want a person to review one, contact our practice manager.

Get ready before 10 December

Start with an inventory rather than a rewrite: you can't describe decisions you haven't listed. Keep a short record of how you decided each one was in or out of scope, so you can explain your reasoning if a customer, applicant or the OAIC asks.

Demandify's AI Systems & Automation work starts with a free online snapshot, and in the workflows we build, people review important decisions and handle the exceptions. As the OAIC's guidance shows, that review doesn't remove the need to disclose a significant decision, so plan the policy wording alongside the workflow. Use the steps below to prepare.

• Confirm whether the Privacy Act covers your business, including the turnover history and the size-independent categories.
• List every program that screens, scores, ranks, approves, declines or prioritises customers, applicants or staff, including features inside software you subscribe to.
• For each one, note the personal information it uses, the decision it makes or informs, and how much staff rely on its output.
• Ask each vendor for a plain description of how their product uses personal information to make or support decisions.
• Decide which decisions are in scope, taking the OAIC's cautious approach where you're unsure, and record why.
• Draft the new privacy policy section, separating fully automated decisions from computer-assisted ones, and have it checked.
• Publish it before 10 December, and set a reminder to update it whenever you add or change a tool.

Keep readingPlan what happens when an automation gets a decision wrong