The 10 December Privacy Change Most Teams Haven't Mapped

From 10 December 2026, an organisation covered by the Privacy Act has to say in its privacy policy when a computer program makes, or plays a direct part in making, a decision that could significantly affect a person. The regulator finalised its guidance on 30 September. That leaves about eight weeks.

This is general information, not legal advice. If you think you are covered, ask your lawyer to confirm.

What the rule actually asks for

It is a disclosure rule. It does not ban automated decisions, and it does not give people a new right to challenge them. It asks you to describe, in plain terms, three things in your privacy policy: the kinds of personal information a program uses, the kinds of decisions made solely by the program, and the kinds of decisions where the program does something directly related to making them.

It applies when three things are true together. A computer program makes the decision or does something substantially and directly related to making it. The decision could reasonably be expected to significantly affect someone's rights or interests. And personal information about that person is used by the program. Law-firm summaries of the guidance note that the program does not have to be yours. A vendor's tool that you have arranged to use can count (Allens).

Is your organisation covered at all?

Many small businesses and not-for-profits with annual turnover of A$3 million or less are not covered by the Privacy Act, unless an exception applies. Health service providers, businesses that trade in personal information, and organisations that have opted in are the usual ones. Confirm which side of the line you sit on before you spend money on anything.

Where it might bite without anyone noticing

The decisions that matter are the ones that affect a person's access to something: a service, a benefit, a job, a tenancy, a loan. Examples of in-scope decisions in the commentary include refusing a benefit, affecting contract rights, affecting access to a significant service, and targeted employment advertising. A screening tool that ranks applicants, a form that auto-declines a request, or a scoring feature built into software you already pay for can all qualify. Nobody chose to deploy "an automated decision system". It arrived as a feature.

A first step that costs nothing

Make a list. For each tool your team uses, ask three questions: does it decide or recommend anything about a person, does that matter to them, and does it use their personal information? Most tools will answer no. The ones that answer yes need a line in your privacy policy, and a conversation with the vendor about how the decision is made.

If nobody in your organisation can say which tools those are, that is the finding. It is also the same gap that sits under most AI governance questions: use has run ahead of oversight.

Not sure whether this applies to you? Start with our free AI tools assessment, or reply to any of our posts and ask.

Sources: the OAIC's updated APP 1 Guidelines and APP 1.7–1.9 fact sheet, released 30 September 2026, as summarised in Allens. Check the OAIC's own pages for the authoritative text.