The Privacy Act's new rule on automated decisions starts 10 December 2026. What it means for your business

From 10 December 2026, Australian organisations covered by the Privacy Act must explain in their privacy policy when a computer program uses personal information to make, or do something substantially and directly related to making, a decision that could significantly affect a person's rights or interests. The policy must describe the kinds of personal information used, the kinds of decisions the program makes on its own, and the kinds of decisions it helps a person make.

Covered organisations are generally those with annual turnover over A$3 million, plus some smaller businesses such as health service providers. The regulator, the OAIC, says the rule covers rule-based software, spreadsheet formulas and generative AI, and that a decision can still be in scope when a person reviews the output. The rule is new Australian Privacy Principles 1.7 to 1.9, added by the Privacy and Other Legislation Amendment Act 2024.

This article explains the rule. Whether it applies to your business, and what your policy should say, are questions for your own lawyer.

What changes on 10 December 2026?

The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Its commencement table sets the start of the automated decisions part 24 months later: 10 December 2026.

The Act adds three clauses to APP 1, the privacy policy principle. Under new APP 1.7, the policy must say more when three things are true:

• The business "has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision".
• The decision "could reasonably be expected to significantly affect the rights or interests of an individual".
• Personal information about that person is used in the program's operation.

Under APP 1.9, refusing or failing to decide counts, and the effect on the person can be good or bad.

The rule covers decisions made from 10 December 2026, whenever the program was set up and whenever the personal information was collected. A scoring spreadsheet built years ago is treated like a new one.

Does it apply to my business?

The Privacy Act generally covers businesses with annual turnover over A$3 million. The OAIC's small business guidance lists twelve kinds of business it covers regardless of turnover:

• health service providers
• businesses that trade in personal information
• contractors that provide services under a Commonwealth contract
• operators of a residential tenancy database
• credit reporting bodies
• reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006
• employee associations registered or recognised under the Fair Work (Registered Organisations) Act 2009
• businesses that conduct protected action ballots
• businesses accredited under the Consumer Data Right system
• businesses related to a business the Privacy Act covers
• businesses prescribed by the Privacy Regulation 2013
• businesses that have opted in to the Privacy Act.

The OAIC's guidance on the employee records exemption says it covers a private employer's records about current and former employment. It "does not cover future employment relationships", so it does not apply to information about unsuccessful job applicants. Nor does it cover volunteers, or contractors handling another organisation's staff records.

That makes hiring tools a concrete example. The OAIC lists software that sorts candidate profiles to make hiring decisions among the uses it would generally treat as in scope. In Example 5 of its fact sheet, the OAIC says an employer's privacy policy must cover a tool that ranks applicants into a shortlist.

For tools about current staff, such as a rostering rule or a performance report, whether the exemption applies is a question for your lawyer.

What counts as a program making or helping make a decision?

The OAIC's APP 1.7-1.9 Transparency Obligation Fact Sheet (September 2026) reads "computer program" widely. It includes "pre-programmed rule-based processes", "artificial intelligence and machine learning processes", "software, apps or word-processing tools" and generative AI, "including chatbots". So ChatGPT and Copilot count. See also Is it safe to put business data into ChatGPT? and Copilot, ChatGPT or Claude.

A business has "arranged for" a program, the fact sheet says, if it builds, buys or configures one, lets it make a decision outright, or relies on its advice.

The program also has to be "substantially and directly related" to the decision. Substantially means "a key factor in facilitating the human's decision making". Directly means "a direct connection with making the decision". The output can be advice or a final answer.

In the fact sheet's Example 1, a care provider's spreadsheet formula scores and ranks people's need for care, and staff use the ranking to decide whom to contact. The OAIC says that is in scope. At the other end, the OAIC's May 2026 issues paper quotes the Act's Explanatory Memorandum: a spreadsheet "only used for the purpose of adding numbers to arrive at a given sum" would not be "substantially related" to a decision.

What does "significantly affect" mean?

The fact sheet says the impact "must be more than trivial and must have the potential to considerably influence the circumstances or outcomes for the individual concerned".

APP 1.9's examples are a decision under a law to grant or refuse a benefit, a decision affecting rights under a contract, and one affecting "access to a significant service or support". The OAIC's APP guidelines illustrate these with a housing benefit, a life insurance policy and healthcare.

The OAIC's list of uses it would generally treat as in scope also includes:

• personalised pricing by online retailers selling significant goods
• programs that approve or reject a loan or credit application
• programs that assess eligibility for insurance
• AI reports used to rank staff performance, decide promotions or set bonuses and pay.

Small amounts can count. In its postcode-pricing example, the OAIC says the pricing is significant "regardless of whether the price difference is small or large".

If a person makes the final call, does the rule still apply?

Often, yes. The fact sheet says: "A decision may be within scope of the transparency obligation even where a computer program output does not replace the entire decision-making process or is subject to human review."

For machine learning and generative AI, the OAIC says outputs used for decisions that significantly affect people "would generally fall within scope of the transparency obligation unless subject to extensive human oversight and control".

In Example 3, managers at a technology company use a generative AI program to suggest each salesperson's bonus and salary adjustment. HR has oversight, and a director approves every final pay decision in writing. The OAIC still finds the output substantially and directly related to the decision, because managers use it "as a key factor".

The OAIC says further steps, such as questioning the outputs and using other evidence, "could indicate" the output was not substantially related. The director's sign-off alone was not enough.

Coverleo's own approach is that AI prepares and people decide. That is good practice for decisions about people. It is also the arrangement in the OAIC's bonus example. A person's approval is not an exemption.

What must the privacy policy say?

If APP 1.7 applies, APP 1.8 requires the policy to set out:

• the kinds of personal information used in the operation of the programs
• the kinds of decisions made solely by the programs
• the kinds of decisions where a program does something substantially and directly related to making the decision.

The policy can group decisions and kinds of information, but the OAIC says the detail "must be meaningful to a reasonable person". Example 6 in the fact sheet shows a short policy section, headed "Decisions made by computer programs", that the OAIC says complies.

Buying the software generally leaves the duty with you. The OAIC "generally expects" the obligation to "typically remain with the APP entity" using the information. Vendors "should provide clear, high-level information about how their software can be used to make decisions", so ask each one for it.

What happens if a privacy policy gets it wrong?

The 2024 Act added APP 1.7 to section 13K(1) of the Privacy Act, headed "Civil penalty provision for which infringement notices or compliance notices can be issued". The OAIC can issue those notices without first going to court.

The OAIC's first compliance sweep, announced in December 2025, covered about 60 businesses in six sectors. It checked their policies against APP 1.4, the existing contents rule. In a keynote on 4 May 2026, Privacy Commissioner Carly Kind said the sweep "found instances of non-compliance in a significant proportion".

How to find the software that touches decisions about people

Decisions about people rarely sit in a tool labelled "AI". They sit in a rostering rule, a credit limit, a discount setting, a spreadsheet or an AI summary pasted into a review.

Walk each process from first contact to final outcome. Stop wherever a person gets a yes or a no, a price, a shift, a limit or a ranking, and ask what produced it. Places to look:

• hiring tools, and anything that sorts, scores or ranks job applicants
• rostering rules that allocate shifts
• credit checks and limits for sole-trader customers, who are individuals (see also What AI can do with Xero and MYOB right now)
• pricing or discount engines
• customer scores, such as priority or risk scores
• fraud flags and expense-claim flags
• spreadsheets with formulas that score or rank people
• AI summaries used in performance, pay or credit reviews.

For each one, write down what it decides or helps decide, the personal information it uses, whether a person makes the final decision, and who reviews the tool.

Give the list to whoever owns your privacy policy, and to your lawyer, who decide what is in scope and how to word it. Update it whenever a tool changes, including when a vendor update adds an AI feature.

Weighing a consultant, an in-house hire or ongoing support such as an AI Business Specialist +? See how the three compare.

Related reading: Why most Australian businesses aren't getting value from AI yet