2026-10-30

Privacy Act, 10 December 2026: does your privacy policy need an automated decisions section?

From 10 December 2026, if your business is covered by the Privacy Act, your privacy policy must say when software uses personal information to make, or help make, decisions that could significantly affect someone. Most shops under A$3 million turnover aren't covered, but clinics, allied health and some other small businesses are, at any size.

The change comes from the Privacy and Other Legislation Amendment Act 2024, which added three new rules (APP 1.7 to 1.9) to the Australian Privacy Principles. They start on 10 December 2026, six weeks from now. The OAIC published its guidance on them in September, and lawyers reading it say the scope is wider than "robots making decisions": ordinary software that scores, filters or flags people can count.

This is general information, not legal advice.

Check if the rule covers you first

The new rules apply to "APP entities": businesses that already have to follow the Australian Privacy Principles. If you don't have to follow them today, the 10 December change doesn't add anything for you.

You're generally covered if:

• your annual turnover is over A$3 million (all income, from all sources), or
• you provide a health service and hold health information, at any turnover. That includes GPs, dentists, physios, chiropractors, psychologists, pharmacies, complementary therapists and many gyms or clubs that help members with injuries or fitness, or
• you trade in personal information (selling or buying customer lists), or you're a contractor to the Commonwealth.

So a café or a small online store under A$3 million usually isn't covered. A two-chair physio clinic is. If you're not sure about your turnover or whether you provide a "health service", the OAIC's small business checklist walks through it.

List the decisions your software makes

If you're covered, the next question is whether you use a computer program that:

1. makes a decision itself, or does something "substantially and directly related" to making one (for example, a score or a flag that a person then follows),
2. uses personal information to do it, and
3. could reasonably be expected to significantly affect someone's rights or interests.

Write down every tool that decides something about a customer, patient or job applicant. For a store or clinic, the usual places are:

• Order and fraud screening that cancels or holds orders automatically based on a customer's details.
• Account rules that suspend, block or limit a customer without a person looking first.
• Credit, trade account or payment plan approvals that a system grants or declines.
• Booking rules that refuse appointments, for example after missed visits, or decide who gets a waitlist slot.
• Recruitment screening that ranks or rejects applicants before anyone reads the application.

Things that don't usually count: a spam filter on your contact form, a stock alert, or product recommendations that don't change what a customer can buy or the price they pay. The test is the effect on the person, not how clever the software is. When a tool from a payment provider or platform makes the decision, ask them what it does; you still describe the kinds of decisions in your own policy if you arranged for it to be used.

Add one plain section to your privacy policy

The policy must describe three things:

• the kinds of personal information your programs use (for example: name, email, delivery address, order history, payment outcome, appointment history),
• the kinds of decisions the program makes on its own, and
• the kinds of decisions where the program does something substantially and directly related to a decision a person then makes.

You don't have to publish how the software works or its settings. A short section is enough, as long as it's specific. For example:

Automated decisions. We use software that checks orders for signs of fraud. It uses your name, email, delivery and billing addresses, order history and the payment result. It can hold or cancel an order automatically. If your order is held or cancelled, contact us and a person will review it.

A last line telling people how to reach a person isn't required by these rules, but it's what customers look for, and it takes the sting out of an automatic "no".

Put the section in the privacy policy that's linked from your site's footer and checkout, and update the date on the page. If your booking system, store platform or patient portal shows its own privacy page, check that one too.

Tidy the rest of your site while you're in there

A policy update is a good moment to check the other customer-facing pages that are written once and rarely re-read. Since 1 October 2026, card surcharges on eftpos, Mastercard and Visa are banned, and old surcharge lines often sit on the same terms and policy pages. Our free card surcharge check reads up to 20 pages and 3 PDF menus on your site in about 30 seconds and lists every mention it finds.

Sources

• Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024- OAIC, Small business and the Privacy Act
• OAIC, APP guidelines, Chapter B: key concepts
• Allens, Mandatory automated decision-making disclosure requirements are coming: key takeaways from the OAIC guidance (October 2026)
• Corrs Chambers Westgarth, Transparency in automated decision-making: what the OAIC guidance means for your business

FAQ