Photo: Shixart1985, CC BY 2.0, via Wikimedia Commons. Cropped from the original.
Many organisations assume that privacy law only matters when data is breached. In reality, the Privacy Act also governs how personal information is used, and a new transparency obligation about automated decisions starts on 10 December 2026. It applies whether or not a decision involves what people would call AI.
There is also confusion in the other direction. Some commentary suggests every business using AI must update its privacy policy, which is not correct. The obligation applies only to organisations covered by the Privacy Act, and only to certain kinds of decisions.
This guide explains what the new rule requires, who it applies to, how it relates to everyday AI tools and what practical steps make sense now. It draws on guidance from the Office of the Australian Information Commissioner (OAIC). For a wider introduction to AI, see our guide to artificial intelligence.
What changes on 10 December 2026
The Privacy and Other Legislation Amendment Act 2024 added a transparency obligation to Australian Privacy Principle 1. From 10 December 2026, an organisation covered by the Act must include information in its privacy policy where three conditions are met.
First, the organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making one. Second, the decision could reasonably be expected to significantly affect the rights or interests of an individual. Third, personal information about that individual is used in the program’s operation. The OAIC notes that a decision can significantly affect someone whether the effect is adverse or beneficial.
Where those conditions apply, the privacy policy must describe the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions where a program does something substantially and directly related to the decision.
Who the Privacy Act covers
This is where scope matters most. According to the OAIC, most small businesses with an annual turnover of $3 million or less are not covered by the Privacy Act. Turnover here includes income from all sources.
Some small businesses are covered regardless of turnover. The OAIC’s list includes health service providers, businesses that trade in personal information, Commonwealth contracted service providers, residential tenancy database operators, credit reporting bodies, reporting entities under anti-money laundering law, and businesses that have opted in to the Act, among others. Businesses related to a covered business can also be covered.
If you are unsure, the OAIC’s small business checklist is the best starting point. Larger organisations and covered small businesses should assume the new obligation is relevant and review their systems.
> Key quote: the new rule applies to organisations covered by the Privacy Act, not to every business that uses AI.
What counts as an automated decision
The rule is written around computer programs rather than AI specifically. A simple rules-based system that automatically declines an application could be in scope, while a sophisticated AI tool used only to draft marketing copy probably would not be, because it does not make decisions about individuals.
Examples that may warrant review include automated credit or eligibility assessments, systems that set individual pricing or offers, tools that screen job applicants, and fraud checks that block accounts. The key test is whether the decision could significantly affect someone’s rights or interests. The OAIC has published guidance and an issues paper, and organisations with borderline cases should seek advice.
Everyday AI tools and personal information
Even where the new disclosure rule does not apply, everyday AI use still raises privacy questions for covered organisations. Entering customer details into a public AI tool is a use or disclosure of personal information, and the Australian Privacy Principles still govern it. Business plans of major AI tools often offer different data handling from free consumer plans, so check the settings and terms of any tool you use.
Government guidance on AI adoption also notes that privacy law imposes quality and accuracy obligations that can apply to AI outputs containing personal information. In practice, that means checking AI-generated content about real people before relying on it. We cover broader AI risks for organisations in AI for business, and agent-specific safeguards in AI agents explained.
Practical steps to take now
Start with an inventory. List the systems that make or support decisions about individuals, including vendor software, and note what personal information each uses. Many organisations find automated decisions inside tools they bought rather than built.
Next, assess which of those decisions could significantly affect people. For those that do, update the privacy policy with the required descriptions in plain language, and make sure staff can explain how a decision was reached if a customer asks. Finally, set a review cycle, because new tools and features can bring decisions into scope without anyone noticing.
| Step | Question to answer |
|—|—|
| Inventory | Which systems make or support decisions about individuals? |
| Assess | Could any of those decisions significantly affect someone? |
| Disclose | Does the privacy policy describe the information and decision types? |
| Review | Who checks new tools and features for automated decisions? |
Common mistakes
One mistake is assuming the rule does not apply because a system is not called AI. Rules-based software can be in scope. Another is the opposite assumption, that every use of AI requires disclosure, which leads to vague policy wording that helps nobody.
Some organisations also overlook vendor systems, even though a decision made by purchased software still counts. Finally, privacy policies written in dense legal language undermine the purpose of the rule, which is transparency for the people affected.
Where to start
The new automated decision rule is a transparency measure for organisations covered by the Privacy Act. Check whether your organisation is covered, identify any decisions that could significantly affect people, and describe them clearly in your privacy policy before 10 December 2026. For broader guidance on AI and visibility, see our AI SEO guide, and for marketing questions, contact us or email hello@thedigitalmarketingconsultants.com.au. This article is general information, not legal advice.
