--- title: What the 10 December Privacy Act Changes Mean for Businesses Using Automation and AI description: From 10 December 2026, Australian businesses must explain how software and AI are used in significant decisions about people. Here's what's changing. image: https://www.hzempower.com.au/hubfs/10%20December%20Privacy%20Act.png --- [Skip to main content](https://www.hzempower.com.au/blog/privacy-act-automated-decisions#main-content) ![primary\_colour](https://www.hzempower.com.au/hubfs/primary_colour.svg) ![primary\_colour](https://www.hzempower.com.au/hubfs/primary_colour.svg) - [Home](https://www.hzempower.com.au) - Show submenu for Services Services - [Strategy](https://www.hzempower.com.au/strategy) - [Deliver](https://www.hzempower.com.au/deliver) - [Operate](https://www.hzempower.com.au/operate) - [90-day Sprint](https://www.hzempower.com.au/nexus90) - [Vibe Check](https://www.hzempower.com.au/vibe-check) - [CAVE System](https://www.hzempower.com.au/the-cave-framework) - [Contact](https://www.hzempower.com.au/contact-us) Open main navigation Close main navigation - [Home](https://www.hzempower.com.au) - Show submenu for Services Services - Services - [Strategy](https://www.hzempower.com.au/strategy) - [Deliver](https://www.hzempower.com.au/deliver) - [Operate](https://www.hzempower.com.au/operate) - [90-day Sprint](https://www.hzempower.com.au/nexus90) - [Vibe Check](https://www.hzempower.com.au/vibe-check) - [CAVE System](https://www.hzempower.com.au/the-cave-framework) - [Contact](https://www.hzempower.com.au/contact-us) - Search - [Client Login](https://os.hzempower.com.au) [Client Login](https://os.hzempower.com.au) Search # What the 10 December Privacy Act Changes Mean for Businesses Using Automation and AI ![Zac Harrington](https://app.hubspot.com/settings/avatar/7c522e75c09854c18d36c163c42a60a8) by [Zac Harrington](https://www.hzempower.com.au/blog/author/zac-harrington) From 10 December 2026, businesses covered by the Privacy Act will need to explain in their privacy policy how they use software in decisions that significantly affect people. The change came in with the Privacy and Other Legislation Amendment Act 2024, and it applies to AI tools as well as plenty of everyday software that most businesses wouldn't think of as automated decision-making. We're working through it with our clients at the moment, so we've put together a plain-English summary of what's changing, who it applies to and what's worth doing before the deadline.   ### What the new rule says The change adds new requirements to APP 1 (Australian Privacy Principle 1), which is the part of the Privacy Act that covers what goes in a privacy policy. It applies when all of these are true: 1. The business has arranged for a computer program to make a decision about a person, or to do something that's a key part of making that decision. 2. The decision could reasonably be expected to significantly affect the person's rights or interests. 3. Personal information about that person is used by the program. When they are, the privacy policy has to describe the kinds of personal information the software uses, the kinds of decisions it makes on its own, and the kinds of decisions it plays a substantial part in.   ### The OAIC is reading it broadly The Office of the Australian Information Commissioner (OAIC), Australia's privacy regulator, released its final guidance on 30 September 2026. A few points in it are worth knowing, because they make the rule wider than it first looks. The definition of a computer program is very broad. It covers machine learning, generative AI, chatbots and rules-based automation, and it also covers ordinary software such as apps and spreadsheets. One of the OAIC's own examples is a spreadsheet formula used to rank people for access to health services. Having a person in the loop doesn't automatically take a decision out of scope. The OAIC's view is that AI outputs used in significant decisions will generally be caught unless there's extensive human oversight and control, such as checking the inputs, weighing other evidence and recording why a decision differs from what the system suggested. Using a vendor's software doesn't pass the obligation to the vendor either. If you've chosen, configured or rely on a tool, the disclosure is yours to make, so you need to be able to get the right information from whoever supplies it. The OAIC has also said generic, high-level statements won't be enough, so a general line about automated processing is unlikely to meet the requirement.   ### Who it applies to The rule applies to APP entities, which broadly means businesses with annual turnover above $3 million. Some smaller businesses are covered too, including health service providers and businesses that trade in personal information. If you're under $3 million and none of the exceptions apply, the small business exemption means this rule generally won't apply to you yet. That exemption is under review as part of the next round of privacy reform, so it's still worth knowing where your systems stand.   ### What kind of decisions count The OAIC's examples include: - recruitment software that sorts or ranks candidates - approving or declining loan and credit applications - AI reports used to rank staff performance or set pay and promotions - personalised pricing by online retailers selling significant goods - facial recognition used in stores or stadiums It also lists access to things like healthcare, housing, employment, banking, utilities, telecommunications and education as interests that will generally be in scope. Businesses also need to think about how a decision lands for vulnerable people, because the same outcome can have a much bigger impact on someone in a difficult situation. Decisions about other businesses usually aren't caught, because the rule is about individuals. A sole trader is an individual though, so a supplier or customer who trades in their own name may still count.   ### Penalties Leaving the required details out of your privacy policy is a breach of the Privacy Act. The OAIC can issue compliance and infringement notices, civil penalties can reach $660,000 per contravention, and serious or repeated breaches can attract much larger penalties.   ### What to do before 10 December 1. **Map where software is involved in decisions about people.** Look across HR, finance, sales, marketing and customer service, because these tools are often built into everyday processes. It can help to start with the decisions that matter most to people and work back to the systems that feed into them. 2. **Talk to your vendors.** Ask how their tools use personal information in decisions, and check your contracts give you the right to get that information. 3. **Update your privacy policy.** Be specific about the kinds of personal information and decisions involved. You can generally keep the detail of how a system works confidential, though you still need to disclose that you use it. 4. **Check your internal policies.** Make sure staff aren't using unapproved AI tools in decisions about hiring, pay, pricing or account suspensions, because that can bring a decision into scope without anyone realising.   ### Where HZEG fits in A lot of what we build for clients involves automation and AI, so we're preparing a fact sheet for each system we've built or manage. Each one sets out the personal information the system uses, the decisions it makes or supports, and where people stay in control, which gives our clients and their lawyers what they need to update their privacy policies. If you'd like help working out where automated decision-making shows up across your business, get in touch at [hello@hzempower.com.au](mailto:hello@hzempower.com.au).   ### Also worth watching The OAIC must also register the Children's Online Privacy Code by 10 December 2026, though a start date hasn't been confirmed yet. It will matter for any business whose apps or websites are likely to be used by children. *This article is general information and isn't legal advice. Speak to your lawyer about how the changes apply to your business.*   --- ### Sources - [Corrs Chambers Westgarth: Transparency in automated decision-making, what the OAIC guidance means for your business](https://corrs.com.au/insights/oaics-childrens-online-privacy-exposure-draft-from-consultation-to-code) (29 October 2026) - [Macpherson Kelley: Automated decision making and franchises, what you need to know before December 2026](https://mk.com.au/automated-decision-making-and-franchises-what-you-need-to-know-before-december-2026/) (30 April 2026) - [Corrs Chambers Westgarth: OAIC's Children's Online Privacy exposure draft, from consultation to code](https://corrs.com.au/insights/oaics-childrens-online-privacy-exposure-draft-from-consultation-to-code)(09 April 2026) ## Comments ![11 - Mmmeditation--](https://www.hzempower.com.au/hs-fs/hubfs/11%20-%20Mmmeditation--.png?width=2000&name=11%20-%20Mmmeditation--.png) ### Your Technology Team, Without The Headcount. Tech tools multiply. AI hype grows daily. The subscriptions pile up. Yet somehow, the work gets harder. Sound familiar? That's where we come in.   ©2026 HZ Empowerment Group Pty Ltd (ACN 690 555 483). All rights reserved. [Privacy Policy](https://www.hzempower.com.au/privacy) | [Terms of Use](https://www.hzempower.com.au/terms) | [Cookies](https://www.hzempower.com.au/cookies) | [Blog](https://hzempower.com.au/blog) - - - Cookie Settings ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Zac Harrington", "url" : "https://www.hzempower.com.au/blog/author/zac-harrington" }, "dateModified" : "2026-11-06T02:21:23.877Z", "datePublished" : "2026-11-06T02:16:30.000Z", "headline" : "What the 10 December Privacy Act Changes Mean for Businesses Using Automation and AI", "image" : [ "https://www.hzempower.com.au/hubfs/10%20December%20Privacy%20Act.png" ], "mainEntityOfPage" : { "@id" : "https://www.hzempower.com.au/blog/privacy-act-automated-decisions", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.hzempower.com.au/hubfs/primary_colour.svg" }, "name" : "HZ Empowerment Group" } } ```