Automated Decisions and the Privacy Act: An SME Checklist for 10 December 2026
From 10 December 2026, Australian organisations covered by the Privacy Act must explain in their privacy policy when computer programs make, or substantially help make, decisions that significantly affect people. The change was introduced by the Privacy and Other Legislation Amendment Act 2024, and it applies to decisions made from that date, even if the personal information was collected years earlier.
Law firms have written plenty about the legal detail. This guide is for business owners and managers who want to know one thing: does this apply to us, and if so, what do we actually need to do before December?
What the new rule says
The rule sits in Australian Privacy Principle (APP) 1, which already requires a clear and up-to-date privacy policy. The new paragraphs, APP 1.7 to 1.9, add a transparency obligation for automated decisions. It is triggered when all three of these are true:
You have arranged for a computer program to make a decision, or to do something substantially and directly related to making it.
The decision could reasonably be expected to significantly affect an individual's rights or interests.
Personal information about that individual is used in operating the program.
When all three apply, your privacy policy must describe the kinds of personal information the programs use, the kinds of decisions made solely by computer programs, and the kinds of decisions where a program does something substantially and directly related to the decision.
The Office of the Australian Information Commissioner (OAIC) released its guidance on 30 September 2026, including a fact sheet, a flowchart and updated APP 1 guidelines. Links are at the end of this article.
Does it apply to your business?
This is the first thing to check, because many small businesses sit outside the Privacy Act altogether.
Generally, the Privacy Act applies to businesses with an annual turnover above $3 million.
Some smaller businesses are covered regardless of turnover, including health service providers, businesses that trade in personal information, contracted service providers to the Commonwealth, and credit reporting bodies. A business can also opt in.
If you are not sure whether you are covered, assume you might be and check with your adviser.
Even if the obligation doesn't strictly apply to you, it is worth doing the review below anyway. Larger clients, government buyers and insurers increasingly ask suppliers how they use AI and automation, and a clear answer is becoming part of winning work.
What counts as a "significant" decision?
The legislation gives three examples: decisions about a benefit under a law, decisions that affect rights under a contract or agreement, and decisions that affect access to a significant service or support. In everyday business terms, that can include:
Approving or declining an application, claim or credit request
Setting prices, premiums or payment terms for an individual
Suspending, restricting or closing a customer's account
Screening, scoring or ranking job applicants
Deciding who gets access to a significant service, or how quickly
An automated order confirmation email or a calendar reminder is unlikely to be covered. The test is whether the decision could significantly affect someone's rights or interests.
Two things that catch businesses out
"A person signs off, so it's not automated"
Human review does not take a decision outside the rule. If a program's output is a key factor in the decision a person then makes, such as a score, ranking, recommendation or flag, it is likely to be "substantially and directly related" to the decision, even when a person makes the final call.
"We don't use AI for decisions"
The rule is about computer programs, not just AI. According to the OAIC guidance, it can capture rule-based tools, everyday software such as spreadsheets, machine learning and generative AI tools and chatbots. It also covers third-party software you use, not just systems you built. If a scoring formula in a spreadsheet decides who gets approved, it counts.
Your checklist before 10 December
List every tool that uses personal information. Include your CRM, finance and payments systems, HR and recruitment tools, customer service platforms and chatbots, spreadsheets and any AI tools staff use.
For each one, ask: does its output feed into a decision about a person? Note what goes in, what comes out, and what happens next.
Ask whether the decision could significantly affect that person. Use the examples above as a guide, and pay particular attention to decisions that could affect vulnerable people differently.
Classify each decision. Is it made solely by the program, or does the program do something substantial and direct while a person decides?
Talk to your software providers. Ask how their tools reach their outputs, and whether those outputs are used to make or support decisions. Clarify in your contracts who is making the decision.
Update your privacy policy. Describe, in plain English, the kinds of personal information used and the kinds of decisions involved. A vague line saying "we use AI" will not meet the requirement.
Give someone ownership. Assign a person to keep the list current, check new tools before they are adopted, and answer questions from customers about automated decisions.
Keep a register and review it regularly. An AI and automation register, reviewed at least yearly or whenever you add a tool, keeps your privacy policy accurate as your systems change.
What the privacy policy wording might look like
Every business is different, so treat this as an illustration of the level of detail involved, not wording to copy:
We use computer programs to help assess applications for trade credit. These programs use information you provide, such as your business details, trading history and payment history, to generate a risk score. A member of our team reviews the score and makes the final decision. We do not use computer programs to make decisions about you without human involvement.
Notice that it names the kind of decision, the kinds of information used, and the role the program plays. It doesn't need technical detail or commercially sensitive information about how the system works.
What the rule doesn't require
This is a transparency obligation. It doesn't give individuals a right to contest automated decisions, and it doesn't require you to notify each person directly when a decision is made. The core requirement is that your privacy policy accurately describes what you do. That said, a short explanation at the point of decision, and a simple way for people to raise concerns, are good practice and will make the policy easier to stand behind.
How ValiDATA AI can help
If your list of tools is longer than you expected, or you are not sure which decisions are in scope, we can help. Our AI Readiness Assessment maps the AI and automated tools in use across your business and flags the decisions likely to fall under APP 1.7, and our AI Policy & Governance service puts the register, ownership and policy wording in place so you stay compliant as your systems change.
Sources and further reading
This article is general information only and is not legal advice. For advice on your specific obligations, speak to a qualified legal adviser.
Comments