Does your business use software to assess applications or decide who can access a service? From 10 December 2026, some businesses will need to explain certain automated decisions in their privacy policies. A useful first step is to check whether the rule covers your business and the decisions its software supports. OAIC’s September 2026 update.
A legislated change with a future start date
This is a Commonwealth reform relevant to businesses operating in Victoria. It was enacted in the Privacy and Other Legislation Amendment Act 2024, assented to on 10 December 2024. The automated-decision provisions start on 10 December 2026; they have not started as at this article’s preparation on 11 November 2026. Other parts of the Act have different commencement dates. Amending Act, section 2 and Schedule 1, Part 15.
Which businesses need to check?
The new rule sits within the Australian Privacy Principles. Start by establishing whether your business is subject to those principles. Most businesses with annual turnover of $3 million or less are exempt from the Commonwealth Privacy Act, but exceptions apply. Some smaller businesses, including private health service providers, can be covered. Turnover alone does not settle the question. OAIC’s small-business checklist.
Coverage is a separate question from what your software does. Being subject to the Privacy Act does not mean every routine computer task needs a new automated-decision disclosure.
Look at the decision, not just the product’s label
For a covered business, three conditions must coincide: it has arranged for the program to decide or perform work substantially and directly related to deciding; the program uses that individual’s personal information for this purpose; and the decision could reasonably be expected to significantly affect their rights or interests. A staff member making the final decision does not automatically remove the obligation. Ordinary rules-based software can be relevant alongside AI. The OAIC’s updated guidance explains these distinctions. APP 1 Guidelines, paragraphs 1.35–1.63.
For example, consider a recruitment system that ranks applicants before a person chooses the shortlist. Check what information creates the ranking, how strongly it influences selection and what the decision means for applicants. This is an illustrative review question, not a conclusion that every recruitment tool triggers the rule.
Prepare a short record before changing your policy
Bring the person responsible for your privacy policy together with the staff who actually use the software. A practical review can start with four questions:
- Which programs screen, score, recommend, approve or refuse something about an individual?
- What personal information goes into each program, and where does it come from?
- What decision follows, and what do staff do with the output?
- Could the result significantly affect the person’s access to a service, contractual position or employment opportunity?
Ask suppliers to describe the features your business uses. Keep their explanation with your own workflow notes so the review reflects actual practice. Include existing systems: the legislation can apply to decisions after commencement even where the software arrangements or information predate it. Schedule 1, item 89.
Explain the relevant information and decisions
Where the rule applies, the policy must explain the information categories used and two decision categories: those made entirely by a program, and those where a program performs work substantially and directly related to deciding. The aim is a meaningful account of the business’s practices. Check the proposed wording against your completed record before approving it. OAIC’s transparency fact sheet, page 3.
This article provides general information. Whether a particular business or decision is covered depends on its circumstances. Seek advice before relying on a general checklist for your business.