Last updated 18 October 2026. This is general information, not legal advice.
From 10 December 2026, Australian businesses covered by the Privacy Act must explain in their privacy policy when software makes, or substantially helps make, decisions that significantly affect people. The new rules for automated decision-making under the Privacy Act reach much further than AI. The regulator’s final guidance confirms they can capture rule-based tools, everyday business software, spreadsheets and chatbots, even where a person signs off the final decision.
Most guides cover the legal wording. This one covers the practical work: how to find the systems in your business that make or shape decisions, what to ask your software vendors, how to describe it all in your privacy policy, and a week-by-week plan to be ready in time.
In this guide
What changes on 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 added three new Australian Privacy Principles, APP 1.7 to 1.9. Your privacy policy must include extra information if all three of these are true:
- Your business has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision.
- The decision could reasonably be expected to significantly affect an individual’s rights or interests.
- Personal information about that individual is used by the program in the process.
When those conditions are met, your privacy policy must describe:
- the kinds of personal information the programs use;
- the kinds of decisions made solely by the programs; and
- the kinds of decisions where the programs do something substantially and directly related to the decision, such as scoring, ranking or recommending, while a person makes the final call.
A decision includes refusing or failing to decide, and it counts whether the outcome helps or harms the person. The law gives three examples of decisions that can affect someone’s rights or interests: granting or refusing a benefit under legislation, decisions that affect a person’s rights under a contract or agreement, and decisions that affect access to a significant service or support.
This is a transparency obligation only. Unlike Europe’s GDPR, it doesn’t give people a right to contest an automated decision, and it doesn’t require you to notify each person directly. But your privacy policy has to be accurate, and that means knowing what your systems actually do.
What the OAIC’s final guidance says
The Office of the Australian Information Commissioner (OAIC) published its final guidance on 30 September 2026: an updated APP 1 guideline, a fact sheet and a flowchart. The points that matter most for your systems:
- “Computer program” is broad. It covers rule-based tools, AI and machine learning, generative AI and chatbots, and everyday software, including spreadsheets.
- A human in the loop doesn’t take a tool out of scope. If the program’s output is a key factor in a person’s decision, it’s likely to be caught. The OAIC looks at how much staff rely on the output, how often they override it, whether it is advisory or decisive, whether it can be explained, and how deeply it’s built into the process.
- “Significant” covers everyday areas of life, including health, housing, finance, employment and utilities. Outcomes that differ markedly for vulnerable people are a warning sign. Targeted advertising can be caught where it leads to personalised pricing or affects access to significant goods, services or job opportunities.
- You are responsible, not your software vendor. The obligation sits with the business using the program, including features built into third-party products.
- You don’t need to reveal technical detail. Describing categories of decisions is acceptable, but separate processes with different purposes or data should be described separately, and sensitive data such as health or biometric information should be called out clearly.
Who the rules apply to
The obligation applies to “APP entities”: Australian Government agencies and organisations with annual turnover above $3 million, plus some smaller businesses that are covered regardless of size. These include private health service providers, businesses that trade in personal information, and contracted service providers to the Commonwealth. Since 1 July 2026, small businesses that became anti-money laundering reporting entities must also follow the APPs for personal information handled for those purposes.
The government released an exposure draft of the next tranche of Privacy Act reforms on 31 August 2026, which revisits the small business exemption and automated decision-making. Even if you’re exempt today, building the records described below now will save rework later.
Systems that are likely to be caught
Whether a system is in scope depends on how you use it, so treat this table as a list of systems to assess, not a final answer.
| System or feature | The decision it makes or shapes | Why it may be caught |
|---|---|---|
| Credit, payment or buy-now-pay-later checks | Approve, decline or set limits | Affects access to finance |
| Tenant or applicant screening tools | Shortlist or reject applicants | Affects access to housing |
| Recruitment software that ranks or filters CVs | Who gets an interview | Affects employment opportunities |
| Insurance quoting and claims triage | Price, cover or claim outcome | Affects rights under a contract |
| Fraud and risk rules | Block an account, payment or order | Can refuse service to a person |
| Eligibility rules in booking or enrolment systems | Accept, waitlist or refuse | Affects access to a service |
| Dynamic or personalised pricing | The price a person is offered | Differential pricing is specifically flagged |
| AI chatbots with authority to act | Approve or refuse refunds, returns or requests | Makes decisions under a contract |
| Spreadsheets with scoring formulas | Rank or prioritise customers or staff | Spreadsheets can count as computer programs |
Systems are less likely to be caught when their output has no real bearing on a decision about a person, for example a spell-checker, or software that routes enquiries to the right team without affecting the outcome.
A 7-step plan to get ready
1. Build an inventory of decision points
List every place where software accepts, declines, scores, ranks, prices, flags or prioritises a person. Include your own systems, SaaS products, features switched on inside platforms you already use, and spreadsheets. Ask each team what they check before saying yes or no to a customer, applicant or staff member. That question usually surfaces systems that IT doesn’t know about.
2. Map the personal information each one uses
For each decision point, record the data fields that feed it: identity, contact, financial, location, behavioural and any sensitive information such as health or biometric data. You’ll describe these as categories in your privacy policy, so group them as you go.
3. Classify each decision
Mark each decision point as one of three types: made solely by the program, substantially shaped by the program with a person deciding, or not significant. For the middle group, use the OAIC’s factors. Do staff usually follow the recommendation? How often do they override it? Could they explain the output to a customer? Write down your reasoning, because it’s your evidence if your assessment is ever questioned.
4. Ask your software vendors the right questions
The obligation is yours even when the decision logic sits inside someone else’s product. Ask each vendor:
- Which features in your product score, rank, filter or decide about individuals?
- What personal information do those features use?
- Are any decisions made with no human review?
- Will you tell us before you add or change automated decision features?
Update contracts so they state clearly who makes each decision, and require notice of changes.
5. Add decision logging to your own systems
The law doesn’t require logging, but you can’t describe your decisions accurately, or answer a complaint, without it. For systems you control, record for each automated decision: the type of decision, the categories of data used, the rule set or model version, the output, and whether a person overrode it. Override rates also tell you whether a tool is really advisory or effectively decides.
6. Write the privacy policy section
Add a clearly headed section that describes, in plain English, the kinds of decisions and the kinds of personal information involved. Group similar decisions, keep different processes separate, and name sensitive data explicitly. Have a lawyer review it before you publish.
7. Keep it current
Your disclosure becomes inaccurate the day someone switches on a new AI feature. Add an automated decision-making check to your software release process, your procurement checklist and your annual privacy review.
Example privacy policy wording
Every business is different, so treat this as a starting structure for your lawyer to adapt, not wording to copy:
Automated decision-making. We use computer programs to help us make some decisions that may significantly affect you.
Decisions made solely by computer programs: approving or declining online payment plans up to a set limit. These use your identity details, payment history with us and information from credit reporting bodies.
Decisions where computer programs substantially help our staff: assessing rental applications and prioritising service requests. These use your contact details, application information, rental history and the information you provide in your request. A member of our team makes the final decision.
A 7-week timeline to 10 December
| When | What to do |
|---|---|
| Weeks 1–2 (by 1 November) | Build the inventory of decision points and map the personal information each uses |
| Weeks 3–4 (by 15 November) | Classify each decision, send vendor questions, start adding logging to your own systems |
| Weeks 5–6 (by 29 November) | Draft the privacy policy section and get legal review |
| Week 7 (by 9 December) | Publish the updated policy, brief customer-facing staff, add the check to your release and procurement processes |
What happens if you get it wrong
Since December 2024, the OAIC has been able to issue infringement notices when a privacy policy doesn’t contain required information, currently up to $21,840 for each contravention by a company and $72,800 for a listed company. Failing to comply with an OAIC compliance notice can attract a penalty of up to $330,000 for a company. Law firms expect missing automated decision-making disclosures to be enforced the same way. The bigger risk is reputational: an inaccurate privacy policy is hard to defend after a complaint about a refused application or a blocked account.
How Microweb Global can help
Privacy policy wording is a job for your lawyer, but the evidence behind it comes from your systems. Microweb Global builds and maintains custom software and AI tools for Australian businesses, and we can help you:
- review your software, integrations and AI features to find where decisions are made or shaped;
- document the personal information each decision point uses, ready for your lawyer;
- add decision logging, override tracking and plain-English explanations to systems you own; and
- build new AI features and custom software with transparency designed in from the start.
If your development team is offshore, our guide to outsourcing software development from Australia covers the related Privacy Act rules on sending personal information overseas.
Automated decision-making and the Privacy Act: frequently asked questions
When do the automated decision-making rules start?
On 10 December 2026. From that date, APP entities must include the required information about automated decision-making in their privacy policy.
Does this only apply to AI?
No. The OAIC guidance says it covers rule-based tools, AI and machine learning, generative AI and chatbots, and everyday software including spreadsheets, where they make or substantially help make significant decisions about people.
If a person makes the final decision, are we still covered?
Often, yes. If the software output is a key factor with a direct connection to the decision, such as a score or recommendation staff usually follow, it is likely to be caught even with human review.
Does my small business need to comply?
It applies to APP entities, which generally means turnover above $3 million, plus some smaller businesses such as private health service providers, businesses trading in personal information and AML/CTF reporting entities for that information. Proposed reforms may extend coverage, so check with your adviser.
Do we have to explain how our algorithm works?
No technical detail is required. You must describe the kinds of decisions and the kinds of personal information involved, separating different processes and calling out sensitive data such as health or biometric information.
Our software vendor makes the decision logic. Who is responsible?
Your business is. The obligation sits with the organisation that uses the program, so ask vendors what their features decide and what data they use, and set this out in your contracts.
Talk to us about your systems
With seven weeks to go, the inventory is the step that takes longest. Tell us which systems you use, and we’ll help you work out where automated decisions happen.
Sources
- New resources on transparency for use of AI and automated decision-making, OAIC, 30 September 2026
- APP Guidelines, Chapter 1: APP 1, OAIC
- Infringement notices, OAIC
- Key takeaways from the OAIC guidance, Allens, 2 October 2026
- Changes to Australian privacy laws now in force, Johnson Winter Slattery
- Privacy obligations under tranche 2 of the AML/CTF reforms, HWL Ebsworth
- Exposure draft for the second tranche of Privacy Act reform, Global Law Experts