Privacy Act Automated Decision-Making Rules From 10 December 2026: What Australian Businesses Must Disclose

From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policy when a computer program makes, or substantially helps make, decisions that could significantly affect a person, and what kinds of personal information those programs use. It isn't only about AI. The OAIC says it includes pre-programmed rules, ordinary software and spreadsheets, as well as AI and machine learning, and a person checking the result doesn't automatically take a decision out of scope. So the practical job for most businesses is an inventory: list every process where software approves, declines, ranks, prices or flags something about an individual, decide which ones meet the test, and describe them plainly in your privacy policy. This article explains who the rule applies to, which everyday processes may count, what to write, and how to keep a simple register. It's general information, not legal advice.

What changed, and when

The Privacy and Other Legislation Amendment Act 2024 added three new parts to Australian Privacy Principle 1 (APP 1.7 to 1.9). APP 1 already requires a privacy policy that explains how you handle personal information. The new parts add automated decisions to that policy, and they start on 10 December 2026.

On 30 September 2026 the Office of the Australian Information Commissioner (OAIC) released its guidance resources on the new transparency obligation: a fact sheet, a flowchart and a supplementary fact sheet for government agencies. Read the fact sheet first. It's short and it's the regulator's own view.

It's a transparency rule. It doesn't ban automated decisions or require a person to approve each one. It requires you to be open about them. The same 2024 Act also gave the OAIC power to issue infringement notices, without going to court, when a privacy policy doesn't contain what APP 1 requires (JWS summary). Once the new parts start, a policy that leaves out required automated-decision information is exposed to that.

Who it applies to

The obligation applies to APP entities: organisations and Australian Government agencies covered by the Privacy Act. For a private business, the main question is the small business exemption.

• If your annual turnover is more than $3 million, you're generally covered by the Privacy Act, and this new rule applies to you.
• If your annual turnover is $3 million or less, you're generally exempt, but not always. The OAIC's small business page lists the businesses covered regardless of turnover. They include health service providers, businesses that trade in personal information, contractors providing services to Australian Government agencies, credit reporting bodies, reporting entities under anti-money laundering law, businesses related to a larger company that is covered, and businesses that have chosen to opt in.

Two more points that matter for business-to-business firms:

• It's about individuals. The test is about decisions affecting a person and using their personal information. If your customers are companies, some automated decisions may involve no personal information at all. But sole traders, partnerships, directors who personally back an account (guarantors) and named contacts are people. Don't assume a business-to-business firm is out of scope without checking.
• Current staff may fall under the employee records exemption. The OAIC's employee records page explains that private-sector employers are exempt for handling directly related to a current or former employment relationship. It also says the exemption doesn't cover unsuccessful job applicants, contractors or volunteers. So automated screening of job applications is a different matter from rostering your existing team.

If you're unsure whether you're covered, or whether a particular process counts, the OAIC's material is the place to check, and a privacy lawyer is the right person to ask. We're not lawyers. Our part is the process side: finding the decisions and describing them accurately.

The three-part test

According to the OAIC fact sheet, you're in scope where all three are true:

1. You've arranged for a computer program to make a decision, or to do something substantially and directly related to making it. "Arranged for" includes software you built, software you bought, and off-the-shelf software you configured.
2. The decision could reasonably be expected to significantly affect a person's rights or interests. "Significantly" means more than trivial, with the potential to change their circumstances considerably.
3. Personal information about that person is used in the program's operation.

Three details catch businesses out:

• Simple tools count. The fact sheet lists pre-programmed rule-based processes, software and apps, AI and machine learning, and generative AI. A spreadsheet formula that decides who gets offered terms may count just as much as an AI model.
• Human review doesn't automatically remove it. If the program's output is a key factor with a direct connection to the decision, it's in scope, whether the output is advice or the final answer. The OAIC says machine learning or generative AI outputs used in significant decisions would generally be in scope unless there's extensive human oversight and control.
• Not deciding is a decision. The fact sheet treats failing or refusing to act as a decision too.

The OAIC also says that if you're in doubt, take a cautious approach and include the information.

Which of your automated processes might count

The OAIC's own examples include recruitment software that sorts candidates, programs that approve or reject loan or credit applications, personalised pricing for significant goods, insurance eligibility, and AI reports that rank employee performance or set bonuses. Most growing businesses won't run facial recognition or a loan book, but they do run plenty of quiet automation. Here's where to look:

• Credit and account decisions. Automatic credit limits, credit holds that stop orders when an account is overdue, or a rule that refuses trade terms to new applicants. These matter most where the customer is a sole trader or an individual guarantor. Our post on customers on stop across systems shows how often these rules sit in more than one place.
• Pricing. Rules that give different prices or discounts to different people based on their history or profile.
• Approvals. Approval workflows that automatically approve, decline or escalate requests about a person, such as a refund, a claim, a rebate or a hardship request. Routing a purchase order for internal sign-off usually isn't a decision about an individual, but a rule that refuses a customer's request might be. Our page on automating routine decisions covers how these rules are usually built.
• Recruitment and onboarding. Tools that screen, score or shortlist job applicants, or that reject an application automatically. Remember that unsuccessful applicants aren't covered by the employee records exemption.
• Contractors and subcontractors. Rules that suspend a contractor, withhold payment or block them from new work because a document has expired. Contractors aren't employees, so the employee records exemption doesn't cover them.
• Rostering and allocation. Systems that allocate shifts, jobs or runs. For your own employees this may sit inside the employee records exemption. For labour hire workers placed with clients, contractors or volunteers, check carefully.
• AI screening of anything about a person. An AI tool that reads applications, claims or complaints and recommends an outcome is the case the OAIC is clearest about.

A good way to find these is to follow the process, not the software list. Many of these rules live between systems: a flag in the accounting software that the order system reads, a spreadsheet that feeds the job system, a vendor setting nobody remembers switching on. That's why an inventory of software alone usually misses some.

What to put in your privacy policy

APP 1.8 asks for three things:

• the kinds of personal information used by those programs
• the kinds of decisions made solely by a program
• the kinds of decisions where a program does something substantially and directly related to the decision, such as recommending an outcome a person then accepts.

The OAIC says you don't need technical detail, and you can group similar decisions and similar information into categories, as long as the result is meaningful to a reasonable person. Call out more sensitive information, such as health information, clearly. Trade secrets and commercially sensitive information are excluded, but the fact sheet says avoiding embarrassment or criticism isn't a reason to leave something out.

For example, a hypothetical wholesale distributor's section might read:

Automated decisions. We use software to help make some decisions about customers and job applicants. Our accounting and ordering systems automatically place an account on hold when payments are overdue, using your account and payment history. Our credit application process uses software to recommend a credit limit, based on the details you provide and credit information, and a member of our credit team makes the final decision. Our recruitment system ranks applications against the selection criteria, using the information in your application, before a person decides who to interview. To ask about a decision, contact our privacy officer.

That wording is an illustration only. Your policy needs to describe what your systems actually do, and a privacy lawyer should review it.

How to keep a register of automated decisions

The policy wording is the last step. The useful work is the register behind it, which lets you answer questions and keep the policy accurate when systems change. A spreadsheet is fine. For each process, record:

1. Process name and the business owner.
2. The decision, in one sentence ("account placed on hold when overdue").
3. Who it affects: customers, applicants, contractors, staff.
4. The program: which system, rule, spreadsheet or AI tool, and whether it was built, bought or configured.
5. The personal information used.
6. Solely automated, or assisting a person? And how much the person actually checks.
7. Could it significantly affect someone? Your reasoning, briefly.
8. In scope? Yes, no or unsure (treat unsure as yes, following the OAIC's advice).
9. Where it's described in the privacy policy.
10. Last reviewed, and what triggers a review (a new system, a rule change, a new vendor feature).

If you're also using AI, the National AI Centre publishes a free AI register template as part of its Guidance for AI Adoption. Its definition of an AI system excludes simple spreadsheet formulas and rule-based automations, though, and the privacy rule doesn't. Keep one list that covers both, or add a column to mark which entries are AI. Our AI policy for staff template covers the AI side, with a register kept next to the policy.

The OAIC also expects the obligation to stay with you even when a vendor's software makes the decision. Ask your software providers for a plain description of any automated decisions their products make with your data, and record it.

A plan to get there by 10 December

1. Now: confirm with your adviser whether you're an APP entity, and name one person to own the work.
2. Weeks 1 to 2: walk through your main processes (order to cash, credit, recruitment, contractor management, pricing, claims and refunds) and list every point where software decides, flags or recommends something about a person.
3. Week 3: apply the three-part test to each, using the OAIC flowchart, and ask vendors about their automated features.
4. Week 4: draft the privacy policy section and get it reviewed.
5. Week 5: publish the update, and make sure staff know who answers questions about a decision.
6. After that: add "does this change an automated decision?" to your checklist for every new system, rule or AI tool.

Frequently asked questions

Does the automated decision-making rule apply to small businesses?

Generally not, if your annual turnover is $3 million or less and none of the exceptions apply. The exceptions include health service providers, businesses that trade in personal information, Commonwealth contractors, and businesses related to a larger covered company. The OAIC's small business page lists them all. Check your position with the OAIC or an adviser rather than assuming.

Is it only about AI?

No. The OAIC fact sheet includes pre-programmed rule-based processes, ordinary software and generative AI. An old rule in your accounting or ordering system can be in scope if it meets the test.

If a person approves every decision, are we out of scope?

Not automatically. If the program's output is a key factor that directly shapes what the person decides, the OAIC treats it as in scope, whether the output is advice or the final answer. Extensive human oversight and control can change the picture, but a quick click of "approve" may not.

Do we have to explain how the algorithm works?

No. The policy must describe the kinds of personal information used and the kinds of decisions, in terms a reasonable person can understand. You can group similar decisions, and trade secrets are excluded.

What if a vendor's software makes the decision?

The OAIC generally expects the obligation to stay with the business using the personal information. Ask your vendors for a plain description of what their software decides, and include it in your register and policy.

Where we can help

Finding automated decisions is a process job. They hide in hand-offs between systems, in configured settings and in spreadsheets that quietly feed other systems. Our $5,000 Process & Systems Audit maps how your key processes run across your systems, and it can include a list of the points where software makes or shapes decisions about people, ready for your privacy adviser to review. If you're planning more automation or AI, our AI readiness assessment builds the register in from the start, and our AI workflow automation work keeps a person in charge of the decisions that matter. Kenomont was founded by Aaron Chambers and brings 20+ years of building business systems, including a purchase order approval system a large retirement living provider has used every day since 2014.

To talk through your processes before 10 December, book a free initial chat.