Your privacy policy may need a new section by 10 December

From 10 December 2026, if your business is covered by the Privacy Act and uses software to make decisions about people, your privacy policy has to say so. It's a small change in the law, but it reaches further than most owners expect, because "software" includes the tools you bought off the shelf.

This is general information, not legal advice. If you're unsure whether it applies to you, ask your lawyer.

Does it apply to your business?

It applies to businesses covered by the Privacy Act. Most small businesses aren't. The OAIC, the privacy regulator, defines a small business as one with an annual turnover of three million dollars or less. But some are covered whatever their turnover, including health service providers, businesses that trade in personal information, Commonwealth contractors, credit reporting bodies and businesses that have opted in. If your turnover has been above three million dollars in any year since 2002, you're likely covered.

What counts as an automated decision?

The new rule, in Australian Privacy Principle 1.7, covers a computer program that makes a decision, or does something "substantially and directly related" to making one, where the decision could reasonably be expected to significantly affect someone's rights or interests, and personal information is used.

The OAIC's guidance, published on 30 September, reads "computer program" widely. It includes rule-based processes, AI and machine learning, ordinary software and apps, and generative AI such as chatbots. Three points in it surprise people:

• A person checking the result doesn't take it out of scope. A decision can be covered even when software only informs it, or a human reviews it.
• Bought software counts. If you buy or set up a third-party tool, the OAIC expects the obligation to stay with you, not the vendor.
• "Significantly" means more than trivial, with the potential to considerably change things for the person.

The OAIC's examples include recruitment software that sorts candidates, programs that approve or reject credit applications, personalised pricing for significant goods, programmatic advertising for significant goods or services, insurance eligibility checks, and AI reports used to rank staff or set bonuses. One example is an engineering firm using an AI tool to shortlist graduate applicants. Another is a tech sales team where AI suggests bonuses, which is in scope even though a director approves every one.

What your privacy policy has to say

Three things:

1. The kinds of personal information your programs use.
2. The kinds of decisions made by a program alone.
3. The kinds of decisions where a program does something substantially and directly related to making them.

You can group them into categories, as long as it makes sense to a reasonable reader. You don't have to reveal trade secrets or commercially sensitive detail. The OAIC's guidance includes a sample section headed "Decisions made by computer programs".

What I'd do this month

1. Check whether you're covered, using the OAIC's small business checklist.
2. List the software that makes or informs decisions about people: recruitment tools, credit or account approvals, pricing tools, any AI that ranks or screens people, and anything your CRM does automatically.
3. Ask of each one: could the decision significantly affect someone? If you're not sure, the OAIC says to take a cautious approach and include it.
4. Update your privacy policy before 10 December, and have your lawyer look over it.

The OAIC can issue infringement notices for a privacy policy that leaves this out. More to the point, buyers and staff are asking more questions about AI, and a clear answer in your policy is better than a vague one. I've written more about what's worth worrying about with AI in marketing.