Reference page · Privacy
The 10 December 2026 rule, by business type
From 10 December 2026, a business covered by the Privacy Act whose systems make or shape decisions about people has to say so in its privacy policy. Here is what counts as a decision, and what it looks like for a clinic, an agency, a firm and a shop.
Updated 9 September 2026Sources linked in textGeneral information, not legal advice
The one-minute version
- The rule sits in Australian Privacy Principle 1, added by the Privacy and Other Legislation Amendment Act 2024. It commences on 10 December 2026. It is enacted, not proposed.
- It applies to businesses the Privacy Act already covers. If you are under $3 million and not a health provider or in another covered category, it does not reach you yet. Check which side of the line you are on.
- It is a disclosure rule. It does not ban automated decisions. It says your privacy policy must state what kinds of personal information your systems use to make them, and what kinds of decisions they make.
- It covers decisions made solely by a computer program, and decisions where a program does something substantially and directly related to making the decision, when the decision could reasonably be expected to significantly affect a person's rights or interests.
The trap
Owners hear "automated decision" and picture a bank's loan algorithm. The wording is wider than that. A booking system that auto-declines a patient, a screening tool that shortlists tenants, a pricing tool that quotes one customer more than another, an AI that triages which enquiries get a reply: each of these can be a decision the rule reaches, if the effect on the person is significant.
What it looks like in four businesses
| Business | Where an automated decision hides | What the privacy policy has to say |
|---|---|---|
| Allied health clinic (covered at any size) | Online booking that blocks certain patients, automated triage of intake forms, AI-drafted treatment recommendations a practitioner rubber-stamps | The kinds of health and contact information used, and that booking and triage decisions are made or substantially assisted by software |
| Real estate or property agency | Tenant application scoring, automated rent-arrears escalation, AI-ranked buyer enquiries | The kinds of financial and identity information used, and that tenancy and priority decisions are made or assisted by software |
| Professional services firm over $3M | AI screening of job applicants, automated credit checks on new clients, AI that decides which client emails get escalated | The kinds of employment and financial information used, and that recruitment and client-onboarding decisions are assisted by software |
| Retailer or e-commerce over $3M | Dynamic pricing per customer, automated refund approval or refusal, fraud scoring that blocks orders | The kinds of purchase and identity information used, and that pricing, refund and fraud decisions are made by software |
What to do before December
- List every place software decides something about a person. Include the AI features inside tools you already pay for. If you cannot list them, you cannot disclose them.
- Decide which ones significantly affect someone. Declining a booking is different from suggesting a time slot. Be conservative. The OAIC consulted on an issues paper in 2026 and has not yet published final guidance; an over-disclosure costs nothing.
- Write the paragraph. Three sentences in the privacy policy: what information, what decisions, and that a person can ask for human review. The last part is not strictly required by this rule, but it is what a client expects and it is cheap.
- Date the change. When someone asks in 2027 whether you were ready, the dated policy is the answer.
The one thing to do next
The Exposure Check asks whether any software in your business makes or shapes decisions about people. If the answer is yes, this page is your December deadline.
Where to check for yourself
- Privacy and Other Legislation Amendment Act 2024
- OAIC: Australian Privacy Principles
- OAIC: does the Privacy Act apply to my small business?
What changed on this page
9 Sep 2026: first published. Next check: the day the OAIC publishes its guidance on the automated decision provisions, and again on 10 December 2026.
9 Sep 2026: first published. Next check: the day the OAIC publishes its guidance on the automated decision provisions, and again on 10 December 2026.