Automated Decisions and Your Privacy Policy: What SMEs Must Do by 10 December
By Kesley Kernes · 28 October 2026 · 7 min read
From 10 December 2026, Australian businesses covered by the Privacy Act must explain in their privacy policy when they use a computer program to make, or substantially and directly inform, decisions that could significantly affect people. If your business uses software or AI to screen job applicants, approve credit, set prices or prioritise services, you will probably need to update your automated decision-making privacy policy wording before that date.
The good news: this is a disclosure obligation, not a ban. You don't have to stop using the tools. You do have to know where they are, what personal information they use and what kinds of decisions they shape, then say so in plain English. This guide walks through what the change means for established small and medium businesses (SMEs) and how to get it done in the six weeks or so that remain. For the wider picture of AI rules, policies and risk, see our complete guide to AI policy for Australian businesses.
This is general information only, not legal advice. Check your own situation with a privacy lawyer or adviser.
What is changing on 10 December 2026?
Three new clauses in Australian Privacy Principle 1, APP 1.7 to 1.9, start on 10 December 2026. They add certain automated decisions that could significantly affect people, often called automated decision-making (ADM), to the list of things a privacy policy must cover. The Office of the Australian Information Commissioner (OAIC) released guidance on 30 September 2026, including updated APP 1 Guidelines, a fact sheet and a flowchart.
Under the guidance, the obligation applies when all three of these are true:
- Your business has arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
- The decision could reasonably be expected to significantly affect someone's rights or interests.
- Personal information about that person is used in running the program.
When those conditions are met, your privacy policy must describe:
- the kinds of personal information used by those programs
- the kinds of decisions made solely by a program
- the kinds of decisions where a program does something substantially and directly related to the decision
It's a transparency rule. It doesn't give people a new right to challenge a decision, and it doesn't require you to notify each person individually.
Does this apply to your business?
It applies to businesses covered by the Privacy Act, which can include many established SMEs. Coverage depends on turnover and what the business does, not on headcount. The OAIC explains that a small business with an annual turnover of $3 million or less is generally exempt, but some are covered regardless of turnover, including businesses that provide health services or trade in personal information.
So an allied health group with 30 staff may be covered while a larger business under the threshold may not. If you aren't sure where you sit, that's the first question to settle with your adviser.
What counts as a "computer program"?
Almost anything. The OAIC's fact sheet lists rule-based processes, AI and machine learning, everyday software and apps, and generative AI tools such as chatbots. A spreadsheet with a scoring formula can count just as much as an expensive AI platform.
The guidance also puts the onus on the business using the tool, not the vendor. If your recruitment software ranks applicants, the disclosure is yours to make, even though someone else built the feature.
Which decisions "significantly affect" people?
A decision is significant when it has real potential to considerably affect a person's circumstances, not just a trivial effect. The OAIC's fact sheet gives examples that are generally in scope, several of which are common in SMEs.
| Common SME use | Likely in scope? | Why |
|---|---|---|
| Software that screens or ranks job applicants | Yes | Recruitment and hiring is listed |
| Rules that approve or decline customer credit | Yes | Loan or credit approval is listed |
| Personalised pricing for significant goods | Yes | Differential pricing is listed |
| Triage tools that prioritise health or disability services | Yes | Prioritising those services is listed |
| An AI tool that drafts marketing emails | Usually not | Little effect, unless it decides who sees job, credit or other significant offers, or what price they're offered |
Decisions can count whether the effect is good or bad, and refusing or failing to make a decision is still a decision. The OAIC also asks you to think about vulnerability: a decision may affect vulnerable people more heavily than everyone else.
One nuance for employers: the OAIC lists ranking employees and deciding pay, bonuses or promotions as examples, but the Privacy Act's employee records exemption can change how the rules apply to your current staff. That's a good one to raise with your adviser.
Does having a human check the output take a tool out of scope?
Usually not. The guidance says a program can bring a decision into scope even when a person reviews the result, and both advisory and determinative outputs are covered. A manager clicking "approve" on a list the software produced is still relying on the software.
The OAIC's examples suggest that genuinely independent review can make a difference: checking the underlying data, considering other evidence and recording why the decision departed from the program's output. If that isn't how your team actually works, assume the tool is in scope. The OAIC's own advice is that if you're unsure, include the information.
How to update your privacy policy: a five-step plan
In our experience, for a business with 10 to 200 staff this is often a few weeks of part-time effort across operations, HR and finance, rather than a major project, though it depends on how many systems you run.
- Map your decisions. List the decisions your business makes about people: hiring, customer approvals, pricing, service priority, account access. Ask each team leader, because ADM often hides inside software features nobody thinks of as AI.
- Find the programs behind them. For each decision, note which system, rule, spreadsheet or AI tool plays a part, and whether it decides alone or informs a person.
- Test each against the three conditions. Use the OAIC flowchart. Keep a short record of why each item is in or out of scope; it will help when the next tool arrives.
- Ask your vendors. Request plain-English information on how their software uses personal information in decisions. The OAIC expects vendors to provide high-level information so their customers can disclose it.
- Write the disclosure and keep it current. Group decisions into clear categories, name the kinds of personal information used, and call out any sensitive information such as health data or biometrics clearly. Technical detail and trade secrets aren't required.
If you already keep an AI register as part of your AI policy, steps 1 to 3 are mostly done.
What happens if you don't comply?
Privacy policies are already in the regulator's sights. Since the December 2024 reforms, the OAIC can issue infringement notices for some privacy policy failures, including not having a clearly expressed and up-to-date privacy policy. As at July 2026, the amount for a company is up to 60 penalty units, or $21,840, per contravention.
The bigger cost is usually trust. A customer or job applicant who finds out a program shaped a decision about them, and that your privacy policy said nothing, is unlikely to give you the benefit of the doubt.
Frequently asked questions
Do we need to explain how our algorithm works?
No. The OAIC guidance says you should avoid overwhelming detail and you don't have to disclose trade secrets or genuinely commercially sensitive information. You do need to describe the kinds of decisions and the kinds of personal information involved in a way a reasonable person can understand.
We only use ChatGPT or Copilot for drafting. Are we affected?
Probably not for drafting alone, because those outputs rarely shape a significant decision about a person. It changes if staff use generative AI to assess applicants, customers or patients. That's why knowing how your team actually uses AI matters.
Is this the same as the EU's GDPR rules on automated decisions?
No. The Australian rule is about transparency in your privacy policy. It doesn't create a GDPR-style right to contest an automated decision, and commentators note the Australian test can capture more tools.
Getting it right without the scramble
It's easy to use more automated decision-making than you realise, because it often sits inside software bought for another reason. Six weeks is tight but workable for many businesses to map it, update the privacy policy and set up a simple register (good practice rather than a legal requirement) so the next change isn't a scramble. If you'd like an experienced hand on AI governance across the business, our Fractional Chief AI Officer service is designed for exactly this kind of ongoing work.
Not sure where to start? Book a 15-minute Problem First Call and we'll talk through what your business uses today and what needs attention before 10 December.
Written by Kesley Kernes, Founder and Principal Consultant of NovoPro. Kesley holds an MBA and a Lean Six Sigma Black Belt, previously established an RPA Centre of Excellence, and helps small and medium businesses across Newcastle, the Hunter and Australia use AI and automation to make and save money.