# Your privacy policy has a new deadline: automated decisions from 10 December 2026

> From 10 December 2026, many Australian businesses must explain in their privacy policy where software, AI or even a spreadsheet makes significant decisions about people. Here is who it applies to and what to do before the deadline.

- Source: https://webdivine.agency/insights/privacy-policy-automated-decisions-december-2026
- Author: Fady Ilias, Director, Web Divine
- Published: 2026-10-05
- Updated: 2026-10-07

---

From **10 December 2026**, businesses covered by Australia's Privacy Act must explain in their privacy policy where a computer program makes, or substantially helps make, decisions that significantly affect people. That includes AI tools, but it also includes far more ordinary software: rules in a booking system, a pricing engine, a fraud filter, even a scoring spreadsheet.

The privacy regulator, the Office of the Australian Information Commissioner (OAIC), published its final guidance on 30 September. With roughly nine weeks to go, this is the moment to work out whether it applies to you, because the fix is usually a few clear paragraphs, and getting it wrong now carries a fine.

*General information, not legal advice. Checked against the legislation and OAIC guidance as at 6 October 2026.*

## Where this comes from

The requirement was introduced by the Privacy and Other Legislation Amendment Act 2024, which passed in late 2024 with a two-year runway for this part. It adds three new paragraphs to Australian Privacy Principle 1, the principle that governs privacy policies. Most of the 2024 reforms are already in force; this is the piece with a hard date still ahead of it.

It also applies to decisions made after 10 December using systems you set up, and information you collected, long before. There is no exemption for tools you already had.

## Does it apply to you?

![Does the automated-decision rule apply to you? Four questions: are you covered, is software involved, is the effect significant, and is personal information used](https://vtsswbfzioalwmcwkzbo.supabase.co/storage/v1/object/public/portfolio/blog-diagrams/adm-four-questions.jpg)

**First, are you covered by the Privacy Act at all?** Most businesses with an annual turnover of $3 million or less are exempt. But a number of smaller businesses are covered regardless of size, including:

- **health service providers** (which captures many clinics and allied-health practices)
- businesses that **trade in personal information**
- **contractors to the Commonwealth**
- credit reporting bodies and residential tenancy database operators
- businesses that are **reporting entities under anti-money-laundering laws**, which since 1 July 2026 includes many lawyers, accountants and real estate agents, at least for that information
- businesses related to a covered business, and any that have opted in

**If you are covered, the rule applies where all three of these are true:**

1. A computer program makes a decision, or does something substantially and directly related to making it.
2. The decision could reasonably be expected to significantly affect a person's rights or interests.
3. The person's personal information is used in the program.

The law is explicit that refusing or failing to make a decision counts as a decision, and that significant positive effects count as well as negative ones.

## What the OAIC counts as a "computer program"

The regulator reads this broadly. Its guidance covers rules-based tools, machine learning, generative AI including chatbots, and ordinary software, all the way down to a spreadsheet that ranks or scores people.

![Decisions the OAIC says can be in scope, from loan approvals and job-applicant screening to automatic refunds and fraud tools](https://vtsswbfzioalwmcwkzbo.supabase.co/storage/v1/object/public/portfolio/blog-diagrams/adm-examples.jpg)

A few points from the guidance are worth highlighting:

- **A human in the loop does not automatically take you out of scope.** Tools that only recommend, or whose output a person reviews, can still count, particularly where staff tend to follow what the system suggests.
- **AI outputs are generally in scope** unless there is genuine, extensive human oversight.
- **"Significantly" means more than trivial**, and effects on vulnerable people weigh more heavily.
- **Using a vendor's tool does not shift the responsibility.** If a third-party platform makes the call on your behalf, it is still your decision to disclose.
- **If you are unsure, disclose.** That is the OAIC's own advice.

What is generally out of scope is software that simply records or formats a decision a person made, such as a word processor used to write up a manager's decision.

## Where this shows up on your website

Many of these decisions happen through your website or the systems behind it, which is why we are writing about it. Common examples we see:

- **Online application and eligibility forms** that automatically approve, decline or filter people, such as finance pre-approvals, tenancy applications, NDIS or program intake, or insurance quotes.
- **Pricing engines** that show different people different prices for significant goods or services.
- **Checkout fraud screening** that blocks or allows transactions. For an ordinary retailer, whether this is "significant" depends on the effect; for a lender it clearly is.
- **Automated refund, warranty or claims decisions**, including those handled by a chatbot.
- **Recruitment portals** that screen or rank applicants before a person sees them.
- **Triage or priority scoring**, for example in health or aged-care booking flows.
- **Account suspensions** triggered automatically.

Ordinary marketing segmentation and simple form validation are not named in the guidance, and in our reading are unlikely to be caught unless they lead to different prices or affect access to significant goods, services or jobs. If in doubt, take advice.

![Automated tools that decide outcomes for people now need to be explained in plain English](https://webdivine.agency/images/insights/1677442136019-21780ecad995.jpg)

## What your privacy policy needs to say

The new principle asks for three things, described in kinds rather than in technical detail:

1. **The kinds of personal information** used in these programs.
2. **The kinds of decisions made solely by a computer program.**
3. **The kinds of decisions where a program does something substantially and directly related** to the decision.

You do not have to reveal trade secrets or how your fraud model works. You do need to be clear that personal information feeds those decisions. Plain English is the standard: a short, well-labelled section such as "Decisions made using computer programs" is far better than a paragraph buried in legal boilerplate.

## The cost of getting it wrong

A non-compliant privacy policy can now attract an **infringement notice**, a fine the regulator can issue without going to court. Under the current penalty unit of $364 (from 1 July 2026), that is up to **$21,840 per contravention for a company**, or $72,800 for a listed company. Larger penalties are available through the courts.

The OAIC is also actively checking. Earlier this year it ran a sweep of around 60 privacy policies across sectors including real estate, pharmacies, licensed venues, car rental and dealerships. Privacy policies are no longer documents nobody reads.

## What to do before 10 December

1. **Confirm whether you are covered**, checking the exceptions above, not just your turnover.
2. **List every tool that decides or recommends outcomes about people**: forms with eligibility logic, booking or CRM rules, pricing tools, fraud screening, recruitment software, chatbots and scoring spreadsheets.
3. **Run each one through the three-part test** and note why it is in or out. Keep the notes.
4. **Ask your software vendors** for a plain-English description of what personal information their tool uses and what it decides.
5. **Add a clearly headed section to your privacy policy** covering the three required points.
6. **Review the rest of the policy while you are there.** The OAIC's sweep focused on the basics: what you collect, why, and how people can access or correct it.
7. **Publish it before 10 December**, linked from your website footer and anywhere you collect information.
8. **Make it a habit.** Any new tool, AI feature or form that decides something about people should trigger a privacy policy review.

## Our take

This is a disclosure rule, not a ban. Nobody is being told to stop using automation. But it does force a useful question: do you actually know which of your website's forms and tools are making decisions about your customers, and on what information?

When we build [custom web apps and portals](https://webdivine.agency/app-development-melbourne) and conversion-focused sites for regulated fields such as [finance](https://webdivine.agency/industries/finance), [healthcare](https://webdivine.agency/industries/healthcare) and property, we map these decision points as part of the build, so the privacy policy can describe them accurately. If you are a clinic, our guide to [website requirements for medical and allied-health practices](https://webdivine.agency/insights/website-requirements-medical-allied-health-practices) covers the wider picture, and our explainer on the [draft tranche 2 privacy reforms](https://webdivine.agency/insights/privacy-act-tranche-2-draft-websites) covers what may come next.

**Not sure what your website is deciding?** [Talk to us](https://webdivine.agency/lets-talk). We can audit your forms, tools and integrations and give you a clear list to take to your lawyer or privacy adviser.

## Sources

- [Privacy and Other Legislation Amendment Act 2024](https://www.legislation.gov.au/C2024A00128/asmade/text), Federal Register of Legislation
- [New resources on transparency for use of AI and automated decision-making](https://www.oaic.gov.au/news/media-centre/new-resources-on-transparency-for-use-of-ai-and-automated-decision-making), OAIC, 30 September 2026
- [APP 1.7 to 1.9 transparency obligation fact sheet](https://www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF), OAIC
- [Infringement notices](https://www.oaic.gov.au/about-the-OAIC/our-regulatory-approach/privacy-regulatory-action-policy/infringement-notices), OAIC
- [Small business and the Privacy Act](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business), OAIC
- [Privacy compliance sweep of privacy policies](https://oaic.gov.au/news/media-centre/privacy-compliance-sweep-to-put-privacy-policies-under-the-spotlight), OAIC

---

Web Divine is a web design and development studio in Melbourne, Australia. More articles: https://webdivine.agency/insights. Site index for AI assistants: https://webdivine.agency/llms.txt