Automated Decisions and Your Privacy Policy: What Changes on 10 December 2026

This article is general information, not legal advice. Get advice from a qualified privacy or legal professional about your situation.

If your business uses software to make, or help make, decisions about people, there's a privacy change worth knowing about. From 10 December 2026, organisations covered by the Privacy Act must include extra information in their privacy policy when a computer program uses personal information to make, or substantially help make, a decision that could significantly affect someone.

This guide sets out what the law says, who it applies to and how to take stock of the automated decisions in your workflows, using the legislation and guidance from the Office of the Australian Information Commissioner (OAIC). It's written for Australian businesses. New Zealand businesses are governed by a different law, the Privacy Act 2020, so this specific change doesn't apply to them in the same way.

What changes on 10 December 2026

The change comes from the Privacy and Other Legislation Amendment Act 2024. Schedule 1, Part 15 of that Act, headed "Automated decisions and privacy policies", inserts three new provisions into Australian Privacy Principle 1: APP 1.7, 1.8 and 1.9. The Act received Royal Assent on 10 December 2024, and this part starts 24 months later, on 10 December 2026.

The OAIC summarises the obligation like this. APP 1.7 applies when all three of these are true:

• The entity has arranged for a computer program to make a decision, or to do a thing that is substantially and directly related to making a decision.
• The decision could reasonably be expected to significantly affect the rights or interests of an individual.
• Personal information about that individual is used in the operation of the computer program.

When those conditions are met, APP 1.8 says the privacy policy must include:

• The kinds of personal information used in the operation of those computer programs.
• The kinds of decisions made solely by the operation of those computer programs.
• The kinds of decisions where a computer program does a thing that is substantially and directly related to making the decision.

APP 1.9 adds some definitions. Making a decision includes refusing or failing to make one. A decision can affect someone's rights or interests whether the effect is adverse or beneficial. The examples given include decisions about a benefit under law, decisions affecting rights under a contract, agreement or arrangement, and decisions affecting access to a significant service or support.

In short, it's a transparency obligation. It's about telling people, in your privacy policy, what kinds of decisions your software makes or substantially informs, and what personal information it uses.

What doesn't change on that date

You may have read that the small business exemption is being removed in December 2026. According to the OAIC, that isn't the case right now. The OAIC's small business guidance still says most small businesses with an annual turnover of $3 million or less are not covered by the Privacy Act, although some are. The 10 December 2026 date belongs to the automated decision transparency rule, not to a change in who the Act covers.

Further privacy reform is under consultation, so this could change. If you rely on the exemption, check the current position with your adviser.

Who the new rule applies to

APP 1.7 applies to APP entities. In broad terms, that means Australian Government agencies and organisations covered by the Privacy Act.

The OAIC lists a range of businesses that are covered regardless of turnover. Some of the most relevant to the small and medium businesses we work with are:

• Health service providers, including allied health professionals.
• Businesses that trade in personal information.
• Contractors providing services under a Commonwealth contract.
• Reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
• Businesses related to a business the Privacy Act covers.
• Businesses that have opted in to the Privacy Act.

The anti-money laundering point is new for some readers. The OAIC's guidance for reporting entities explains that from 1 July 2026, AML/CTF obligations apply to certain services typically provided by real estate professionals, lawyers, conveyancers, accountants and trust and company service providers. Those businesses must comply with the Privacy Act when handling personal information in connection with their AML/CTF obligations, even if they're small businesses.

Whether your business is an APP entity, and for which activities, is a question for your adviser.

What counts as a "computer program"

This is where many owners underestimate how far the rule reaches. The OAIC's APP 1 guidelines say "computer program" is intended to be interpreted broadly. It covers pre-programmed rule-based processes as well as artificial intelligence and machine learning. Generative AI tools, including chatbots, fall within it too.

So the rule isn't just about AI. A simple "if this, then that" rule in a workflow tool could be a computer program for this purpose, if the other conditions are met.

The guidelines also say a decision can be in scope even when a person reviews the program's output, if the program does something substantially and directly related to making the decision. Using software for something unrelated to the decision itself, such as typing it up in a word processor, isn't captured.

The OAIC gives examples of the kinds of arrangements it has in mind, including an entity that contracts a software company to automatically approve or decline refunds, and a case management system that automatically escalates particular types of complaints. It also notes the obligation can apply when a third party operates the software on your behalf, because the test is whether you "arranged for" the program to be used.

How to take stock of automated decisions in your workflows

You can't describe your automated decisions until you know what they are. That means an inventory, which is useful whether or not the rule applies to you.

List every place software acts on personal information

Walk through your systems and automations and note anywhere a program uses information about a person to do something. Common places to look:

• Online forms and booking tools that accept, decline or route requests.
• CRM and workflow rules that score, qualify, assign or prioritise people.
• Approval rules for refunds, credit, discounts or applications.
• Tools that screen or rank applicants, tenants or customers.
• Chatbots or AI assistants that answer, triage or decide what happens next.
• Integrations between systems that change someone's status automatically.

Note what each one does with the result

For each item, write down in plain language:

• What personal information it uses.
• What it produces: a decision, a recommendation, a score, a flag or just a notification.
• Whether a person reviews it, how often they override it and how much they rely on it.
• What the outcome means for the individual, such as access to a service, a price, a refusal or a delay.
• Who operates the program, whether that's you, a vendor or a contractor.

Many automations simply move information or notify a person. Workflows like the one in our real estate workflow automation case study, where an enquiry is connected to the right record and the right person is notified, are still worth listing so your adviser can see the full picture. Whether any particular workflow is in scope is a judgement for you and your adviser to make.

Bring the list to your adviser

With the inventory in hand, your adviser can help you work out which items meet the APP 1.7 conditions and what your privacy policy should say. Questions you may want to ask them:

• Is our business an APP entity, and for which activities?
• Which of the decisions on our list could reasonably be expected to significantly affect someone?
• Which are made solely by a program, and which does a program substantially and directly help make?
• Do any of our vendors operate programs on our behalf that we need to account for?

Good practice beyond the policy wording

The OAIC's guidance on commercially available AI products describes using AI for decisions that may have a legal or similarly significant effect on someone as likely to be a high privacy risk activity. It recommends things like clear human oversight, a person who can verify outputs and overturn decisions, staff training and ongoing monitoring.

Those are also good design principles for any automation. When we build AI workflow automation, we start by mapping where a decision is actually made and who can step in. That makes a workflow easier to explain, fix and describe accurately. For the wider questions about connecting systems, see our guide to what to do when your business software doesn't integrate.

When changing your automation isn't the answer

The new rule is about transparency. It doesn't, on its own, ban automated decisions, so for many businesses the right response may be to describe what they already do accurately, rather than pull out automations that work well. But if a workflow makes significant decisions and nobody can explain or override it, that's worth redesigning for operational reasons anyway.

Frequently asked questions

If a person reviews every decision, are we out of scope?

Not necessarily. The OAIC says a decision may be within scope even when a person reviews the program's output, if the program does something substantially and directly related to making the decision. Factors include how much the person relies on the output and how likely they are to override it. Ask your adviser how this applies to your workflows.

We use a vendor's software. Is that our responsibility?

It can be. The OAIC's guidelines explain that the test is whether your organisation "arranged for" the computer program to be used, and that this can apply where another entity operates it for you. Check your contracts and ask vendors how their software makes or informs decisions.

Can 23Labs tell us whether we're compliant?

No. We're not lawyers and this isn't legal advice. What we can do is help you map your workflows and systems so you have an accurate inventory to take to a qualified adviser, and build or adjust automations with clear human oversight.

Map your automated decisions before you update your policy

If you're not sure where software is making or shaping decisions in your business, a workflow map is a sensible first step. We can help you document what each automation does, what information it uses and where people step in, so your adviser has what they need.

Get in touch if you'd like a hand mapping your workflows.

This article is general information, not legal advice. Get advice from a qualified privacy or legal professional about your situation.