Automated decision-making and your privacy policy: what changes on 10 December 2026

By the ITLAW Team · General information, not legal advice

One of the most practical changes from the first tranche of privacy reforms takes effect on 10 December 2026. The Privacy and Other Legislation Amendment Act 2024 inserted new transparency requirements into Australian Privacy Principle 1 for businesses that use automated decision-making (ADM). With weeks to go, many businesses have not yet worked out whether they are affected.

Who is affected?

The obligations apply to APP entities, which are generally businesses with annual turnover above $3 million plus certain smaller businesses (see our privacy law guide). They are triggered when all of the following are true:

• you have arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision
• the decision could reasonably be expected to significantly affect the rights or interests of an individual
• personal information about the individual is used in the operation of the program

The obligations apply to decisions made on or after 10 December 2026, regardless of when the system was built.

What counts as a “significant” decision?

The explanatory material points to decisions that affect access to significant services or support, rights under contracts or arrangements, or legal rights. Common business examples include:

• credit, finance and buy-now-pay-later approvals
• insurance pricing and claims triage
• tenancy and rental application scoring
• recruitment screening and shortlisting tools
• fraud flags that block payments or close accounts
• eligibility checks for discounts, services or memberships

A recommendation engine suggesting products is unlikely to be significant. A system that automatically refuses an application or suspends an account is far more likely to be.

What your privacy policy must say

Where the obligations apply, your APP privacy policy must include information about:

• the kinds of personal information used in the operation of the computer programs
• the kinds of decisions made solely by the operation of computer programs
• the kinds of decisions for which a thing substantially and directly related to making the decision is done by computer programs

The requirement is for plain descriptions of kinds of information and decisions, not source code or trade secrets. But vague statements such as “we may use technology to make decisions” are unlikely to be enough.

Why it matters

A privacy policy that does not meet APP 1 can attract an infringement notice, and the OAIC has started proactive compliance sweeps of privacy policies. The disclosure will also be read by customers and journalists, so accuracy matters for consumer law as much as privacy law. See our AI law guide for the broader picture.

Five steps to take now

• List every system that makes or shapes decisions about individuals, including vendor tools.
• For each, record what personal information it uses and whether a human meaningfully reviews the outcome.
• Decide which decisions could significantly affect individuals.
• Draft privacy policy wording describing the kinds of information and decisions.
• Brief customer-facing teams so they can answer questions about automated decisions.

Frequently asked questions

When do the automated decision-making rules start?

10 December 2026. They apply to decisions made on or after that date.

Do the rules only apply to AI?

No. They apply to any computer program used to make, or substantially help make, a significant decision using personal information, including simple rule-based systems.

Does a small business have to comply?

Only if it is an APP entity, for example because its turnover exceeds $3 million or it falls into an exception such as providing a health service.