Privacy Act changes on 10 December 2026: what Adelaide businesses need to know about automated decisions

Privacy Act Update · 10 December 2026

If your business uses software, AI or even a clever spreadsheet to help decide things about people, a change to Australia’s privacy law is worth a few minutes of your time.

From 10 December 2026, businesses covered by the Privacy Act must explain certain automated decisions in their privacy policy. This article sets out what is changing, who it applies to, some examples to think about and a few simple steps you can take before the date arrives.

What’s changing?

The Privacy and Other Legislation Amendment Act 2024 added new requirements to Australian Privacy Principle 1 (APP 1), the principle that deals with privacy policies. The Act received Royal Assent on 10 December 2024, and this part of it starts 24 months later, on 10 December 2026.

From that date, your privacy policy must include extra information if all three of these things are true:

If all three apply, your privacy policy needs to describe:

The rule applies to decisions made after 10 December 2026, even if you set the software up, or collected the personal information, before then.

It’s not just about AI

The Office of the Australian Information Commissioner (OAIC) says a “computer program” here is broad. It includes:

It also covers tools you didn’t build yourself. The OAIC says you may have “arranged for” a program if you use in-house software, buy a third-party tool, configure or customise off-the-shelf software, let a program make a decision, or rely on a program’s recommendations.

A human in the loop does not automatically take you out of scope. The OAIC notes that a decision can still be covered even where the program doesn’t make the whole decision or its output is reviewed by a person. What matters is whether the program’s output is a key factor with a direct connection to the decision.

On the other hand, using software purely to record a decision a person has made (such as typing it up in a word processor) is not captured.

What counts as “significant”?

The OAIC says the impact must be more than trivial and have the potential to considerably influence a person’s circumstances. A decision can count whether it helps or harms the person, and refusing or failing to do something can also be a decision. The person’s circumstances matter too: a decision may have a bigger effect on someone experiencing vulnerability.

The law gives examples of decisions that may affect a person’s rights or interests, including decisions that affect their rights under a contract or agreement, or their access to a significant service or support.

Examples a small business might come across

The OAIC has published a list of decisions that would generally be in scope. Some that may be relevant to Adelaide businesses include:

These are examples, not a complete list. Plenty of everyday tools will not be caught, because the decision isn’t significant or doesn’t use personal information. The point is to look at what your tools actually decide, and about whom.

Does this apply to small businesses?

The new obligation applies to “APP entities”, which are the organisations covered by the Privacy Act. According to the OAIC, most small businesses with an annual turnover of $3 million or less are not covered by the Privacy Act.

However, some small businesses are covered regardless of turnover. The OAIC’s list includes health service providers, businesses that trade in personal information, Commonwealth contractors, businesses related to a business the Act covers, and businesses that have opted in, among others. The OAIC has a Privacy Checklist for Small Business to help you work out where you stand.

If you’re not sure, it’s worth checking now rather than in December.

Simple steps to take before 10 December 2026

Sources