Credit approvals, insurance pricing, fraud flags, rental applications, job screening: a growing share of decisions that shape people’s lives are now made, or heavily shaped, by software. From 10 December 2026, Australian businesses covered by the Privacy Act 1988 will have to say so.

The new transparency obligation was introduced by the Privacy and Other Legislation Amendment Act 2024, the first tranche of the government’s privacy reforms, and was given a two-year lead time. That runway is nearly gone.

What the law requires

The obligation sits in Australian Privacy Principle 1. Under APP 1.7, an entity must update its privacy policy if three conditions are met:

  • it has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision
  • the decision could reasonably be expected to significantly affect an individual’s rights or interests, and
  • personal information about the individual is used in the program’s operation.

Where those conditions apply, APP 1.8 requires the privacy policy to set out the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions where a program does something substantially and directly related to the decision.

The rule is technology-neutral. It is not limited to artificial intelligence. A rules-based credit scorecard or an automated eligibility filter can be caught just as readily as a machine-learning model.

Fresh guidance from the regulator

On 30 September 2026, the Office of the Australian Information Commissioner published a fact sheet, a decision flowchart and an updated chapter of its APP guidelines on the new rule. The OAIC said the resources reflected 90 written submissions from academia, civil society, government and industry.

Its guidance indicates that entities in genuine doubt about whether a decision is caught should lean towards disclosure. Commercially sensitive details need not be revealed, but disclosures must still be meaningful and understandable to an ordinary reader. A vague reference to “using technology to improve our services” is unlikely to be enough.

Where businesses are most exposed

Financial services firms are the obvious candidates: automated credit decisioning, hardship triage, fraud and anti-money laundering monitoring, and insurance underwriting can all significantly affect a customer’s interests. But the rule reaches much further. Examples include:

  • recruitment platforms that automatically rank or reject applicants
  • tenancy and property platforms that score rental applications
  • telcos and utilities that automate credit checks or disconnection decisions
  • online businesses that use automated tools to suspend accounts or refuse service.

Businesses using third-party software are not excused. If an entity has “arranged for” a vendor’s program to make or inform decisions about its customers, the disclosure obligation is the entity’s own.

A tougher privacy landscape overall

The deadline arrives as privacy risk rises on several fronts. The statutory tort for serious invasions of privacy, also introduced by the 2024 Act, commenced on 10 June 2025. In Kurraba Group Pty Ltd v Williams [2025] NSWDC 396, decided on 7 October 2025, the NSW District Court granted an interlocutory injunction relying in part on the new cause of action, the first published judgment to consider it.

Penalties are also arriving. On 8 October 2025, the Federal Court ordered Australian Clinical Labs to pay $5.8 million over a 2022 data breach at its Medlab Pathology business, the first civil penalties ever imposed under the Privacy Act. The OAIC’s civil penalty proceedings against Medibank and Optus are continuing. The 2024 reforms also gave the regulator an infringement notice power for certain lower-level breaches, including deficiencies in privacy policies, so a non-compliant policy carries real financial risk.

Further changes are coming. A Children’s Online Privacy Code is due by December 2026, and a second tranche of reforms, which could include removing the small business exemption, has yet to be legislated.

A practical checklist

  • Inventory your decisions. List the automated or software-assisted decisions that affect customers, employees or applicants, including those run by vendors.
  • Apply the significance test. Focus on decisions affecting access to credit, insurance, housing, employment, essential services or legal rights.
  • Map the data. Identify the kinds of personal information each program uses.
  • Draft in plain English. Use the OAIC flowchart to test your conclusions, then update the privacy policy before 10 December.
  • Brief the board. Automated decision-making is now a governance issue as well as a technology one.

This article is general information only and is not legal advice. Readers should seek advice specific to their circumstances.