From 10 December 2026, Australian businesses covered by the Privacy Act must say in their privacy policy when a computer program makes, or largely makes, decisions that significantly affect people. It applies to old systems as well as new ones, and to simple rules as well as AI. If your software approves, declines, prices, ranks or screens people, this is the month to check it. This guide covers who is caught, what counts and what to change. If the software itself needs work, see custom software development.
What the law says
The change comes from the Privacy and Other Legislation Amendment Act 2024, which adds three clauses to Australian Privacy Principle 1. It applies when all three of these are true:
- You have arranged for a computer program to make a decision, or to do something “substantially and directly related” to making it.
- The decision “could reasonably be expected to significantly affect the rights or interests of an individual”.
- Personal information about that person is used.
When they are, your privacy policy must describe the kinds of personal information the program uses, the kinds of decisions made by a program alone, and the kinds where a program does a substantial part of the work. The rule covers decisions made from 10 December onward, even when the system was built years ago.
- Does a program make the decision, or do most of the work?For example a score, a rule or a ranking that staff mostly follow.
- Could the decision significantly affect the person?Their money, their work, their access to a service, or how they are treated.
- Does it use personal information about them?Their details, their history or their behaviour.
Three yes answers means that kind of decision belongs in your privacy policy.
It is not only about AI
The Act does not define “computer program”. Law firms that have summarised the privacy regulator’s September guidance, including Allens and Corrs, say it is read broadly. Rule-based tools, spreadsheets with formulas, machine learning and chatbots can all count. Having a person click “approve” at the end does not take you outside the rule if the program’s result was the key factor.
Decisions that are likely to count
- Approving or declining credit, a loan or a payment plan.
- Screening job applications or scoring interviews.
- Setting a price or premium for one person based on their details.
- Deciding who gets a service first, or whether they are eligible at all.
- Suspending or closing a customer’s account.
The test is a significant effect on someone’s rights or interests, so routine steps such as sorting a list or suggesting a product are much less likely to count.
| Decision | Likely to count? | Why |
|---|---|---|
| Approving a payment plan from a credit score | Yes | Affects access to credit |
| Ranking job applicants by keyword match | Yes | Affects someone’s chance of work |
| Quoting a different price by postcode | Yes | Changes what a person pays |
| Flagging an account for suspension | Yes | Can cut off a service |
| Suggesting a related product | Unlikely | Little effect on rights or interests |
| Sorting a support queue by time received | Unlikely | No judgement about the person |
Who is covered
The rule applies to organisations covered by the Privacy Act. Businesses with an annual turnover of $3 million or less are still generally exempt, but the exceptions catch more small businesses than most people expect: health service providers that hold health information, businesses that trade in personal information, contractors to the Commonwealth and credit reporting bodies. Since 1 July 2026, the real estate agents, lawyers, conveyancers and accountants brought under the anti-money laundering laws are covered for that part of their work too.
A wider reform that could change the small business exemption is still only a proposal. The government consulted on a draft bill in August and September 2026.
- 10 December 2024The amending Act becomes law
- 10 June 2025A new right to sue for serious invasions of privacy begins
- 1 July 2026More small businesses are covered through anti-money laundering rules
- 10 December 2026The automated decision rule beginsPrivacy policies need to be updated by then
What happens if you ignore it
Leaving the required information out of a privacy policy can attract a civil penalty of up to 200 penalty units under the amended Act, and the regulator can issue infringement notices without going to court. That is tens of thousands of dollars for a document most businesses can fix in a day.
What to do before 10 December
- List every place software makes or shapes a decision about a person, including supplier tools and spreadsheets.
- Put each one through the three questions above.
- Ask your software suppliers how their product reaches its result and what data it uses.
- Update your privacy policy to describe the decisions and the information used, in plain words.
- Make sure a person can review a decision when someone asks.
How to build software that is ready for this
Good decision software already does what the law now asks you to describe. When we build systems that assess, price or allocate, we record the inputs and the result of every decision, keep the rules in one place where they can be read and changed, give staff a way to override a result with a reason, and show a plain-English explanation of why. That makes the privacy policy easy to write, and it makes a complaint far easier to answer.
Facts checked on 12 November 2026. The quoted wording comes from the Act linked above. This article is general information, not legal advice, so ask a privacy lawyer about your own situation.
Not sure what your software decides on its own? Ask Notion Tech for a system review →
