Australian privacy rules require automated decision disclosures from December

Australian organisations subject to the Privacy Act must update their privacy policies by 10 December 2026 to reveal how computer programs make or guide consequential decisions about people.

Legal firms including Hamilton Locke and Ironbridge Legal issued practical advisories on 30 October 2026, warning companies that the upcoming changes demand internal auditing rather than a quick wording adjustment. The rules stem from Australian Privacy Principles 1.7 to 1.9, enacted under the Privacy and Other Legislation Amendment Act 2024.

Under guidance released by the Office of the Australian Information Commissioner, the rules reach beyond generative artificial intelligence. The obligations cover any software, rules-based engine, scoring mechanism or algorithm that makes decisions or does work directly and substantially related to making them.

Broad scope across business operations

The regime applies whenever a program uses personal information to make or shape an outcome that could reasonably be expected to have a major impact on an individual's rights or interests. Retaining a person in the workflow does not exempt an organisation. If staff rely on software recommendations, rankings or scores to reach a conclusion, the process falls within the rules.

Common business activities captured by the regime include automated CV filtering in recruitment, credit assessment tools, dynamic pricing algorithms and insurance eligibility software. Privacy policies must specify the kinds of personal information fed into these tools, as well as the types of decisions produced solely or partly by automated systems.

What this means for Australian businesses

Small and medium enterprise owners need to review where automated software interacts with customer or employee data before the December deadline.

• Map your automated systems by cataloguing all platforms that screen job candidates, assess customer credit, calculate customised prices or approve service applications.
• Speak with software providers to identify which tools rely on automated scoring or decision logic behind the scenes.
• Understand that having staff approve results is not an automatic exemption, and treat any system as covered if staff follow its recommendations as standard practice.
• Make sure your public privacy policy clearly describes what personal information feeds into those programs and what types of decisions the software helps make.