From 10 December 2026, if the Privacy Act covers your business, your privacy policy may need a new paragraph. It applies where software uses personal information to make a decision, or to do something substantially and directly related to making it, and the decision could reasonably be expected to significantly affect someone. The paragraph names the kinds of personal information used and the kinds of decisions.
Many owners will assume it is somebody else's problem. For many it is. The ones it does apply to may not know it yet.
Does this rule apply to you?
Only if two things are true. The Privacy Act has to cover you, and software has to play a real part in decisions that could significantly affect people.
The Act generally leaves out businesses with an annual turnover of A$3 million or less. That exemption has holes in it. A health service provider is covered at any size, and so is a business that trades in personal information, a contractor on a Commonwealth contract, a residential tenancy database operator and a handful of others on the OAIC's list. Turnover means income from all sources, so use the number your accountant would use.
Not covered? Stop here.
What counts as a decision by software?
A decision counts when a program you have arranged to use makes it, or does something substantially and directly related to making it, using personal information, and the decision could reasonably be expected to significantly affect a person's rights or interests.
The Australian Privacy Principles carry that test from 10 December. The 2024 changes to the Privacy Act put it there, and the OAIC's May 2026 issues paper sets it out. Refusing counts. So does a decision that helps someone.
In a working business it looks like this:
- software that ranks or screens job applicants before anyone in the business reads a single application
- a credit check that knocks someone out
- a price set per customer from what you hold about them
- a booking tool that decides who is offered a health or care appointment, and who waits
The Explanatory Memorandum, as the OAIC quotes it, gives examples that include decisions affecting someone's rights under a contract and their access to a significant service. Differential pricing for significant goods and services is named too.
What goes in the policy?
From 10 December, three things. The kinds of personal information those programs use. The kinds of decisions a program makes on its own. And the kinds of decisions where a program does something substantially and directly related to the decision, while a person makes the call.
Notice the word kinds. You describe categories, in plain words. Nothing in the rule asks you to publish your settings.
Why act now?
The OAIC has started reading privacy policies one by one. In January 2026 it ran its first privacy compliance sweep: about 60 businesses in six sectors that collect personal information face to face, namely rental and property, chemists and pharmacists, licensed venues, car rental, car dealerships, and pawnbrokers and second-hand dealers (OAIC, 9 December 2025). Each policy was checked against APP 1.4, the list of what a privacy policy must contain, and the OAIC said a policy that falls short can draw notices and penalties of up to A$66,000.
That sweep read today's list. From 10 December the list grows.
The quieter cost is trust. A customer who finds out a program turned them down, then opens your privacy policy and finds nothing about it, now has two complaints instead of one.
What goes wrong?
In two opposite directions. Some owners list every tool they touch, down to the spell checker, and bury the one line that matters under forty that do not. Others copy a paragraph from a bank's policy describing decisions their business has never made. Both leave the reader knowing less than before. Write down what your software actually decides, and stop there.
One step for this week
Draw three columns on one page. In the first, every piece of software that touches customers, job applicants or your team. In the second, what it decides or feeds into. In the third, the personal information it reads to do that.
Then send each vendor one question in writing: what does your tool decide about people, and what does it use to decide? Their answer is the first draft of your new paragraph. It is the same habit as the five questions to ask before you hire anyone to automate: get it in writing, before it matters.
The OAIC consulted on guidance for this obligation until 15 June 2026 (its consultation page). The guidance itself was not out when we wrote this, so check the final wording with your lawyer.
Every system we build keeps a record of what it did and who sent it. That is what Accountable means to us.
