In October we asked whether your website needs a privacy policy (spoiler: probably) and promised more on the new rules arriving in December. Here they are.
From 10 December 2026, some businesses must tell people when software helps make important decisions about them. That software might be a chatbot, a booking system, a pricing tool or a humble spreadsheet. This guide explains what counts, who it applies to, what your privacy policy needs to say, and a five week plan to get ready.
If your website, booking system, chatbot or even a spreadsheet helps make important decisions about people using their personal details, your privacy policy may need to say so by 10 December 2026.
Translator’s note: gravity pulls everything down eventually, and deadlines are no different. You have about five weeks.
From 10 December 2026, covered businesses must add a new kind of information to their privacy policy: how computer programs are involved in decisions that matter to people.
The rule came in with the Privacy and Other Legislation Amendment Act 2024, which gave businesses a two year runway. That runway is nearly gone. On 30 September 2026, the privacy regulator, the Office of the Australian Information Commissioner (OAIC), released its guidance: a fact sheet, a flowchart and updated APP 1 Guidelines. So we now know how it reads the rule.
The rule sits in Australian Privacy Principle 1 (APP 1), the principle about being open and transparent. It is about telling people, not asking permission. It does not give anyone a new right to challenge a decision, and you do not need to contact customers individually. It is about what your privacy policy says.
In plain English: your privacy policy already explains what you do with people’s information. From December, it also has to explain when a robot is doing some of the deciding.
According to the OAIC, the rule applies when all three of these are true:
Translator’s note: a computer helps decide something important about a real person, using their details. If that sentence describes something your business does, keep reading.
The OAIC says a computer program includes rule-based processes, AI and machine learning, ordinary software and apps, word-processing tools and generative AI, chatbots included. One of its own worked examples is a spreadsheet: a health and aged care provider uses spreadsheet formulas to score and rank clients, and that ranking decides who receives support. That counts. Your humble spreadsheet is now a suspect.
From its list of examples (which is not exhaustive):
Refusing or failing to make a decision counts as a decision too. A tool that quietly never offers someone a booking is still deciding.
Not automatically. The OAIC says a decision can be in scope even when the program does not replace the whole process, or when a person reviews the result. Its view is that machine learning or generative AI outputs used for significant decisions generally fall in scope unless there is extensive human oversight and control.
In one OAIC example, a business uses a generative AI tool to suggest staff bonuses. Even with HR review and sign-off, it stays in scope. A team that actively interrogates the outputs and documents where and why it disagreed with the program is in a much better position to argue it falls outside.
A contact form that emails you, a newsletter sign-up, or a chatbot that answers questions about opening hours. No significant decision is being made about anyone. That is our reading, not an OAIC ruling, so check anything borderline.
Only if your business is covered by the Privacy Act. For many small businesses, the answer is no.
The Act covers Australian Government agencies and organisations with annual turnover above $3 million. Smaller businesses ($3 million or less) are also covered if, for example, they are:
There is one newer group. Since 1 July 2026, businesses brought into the anti-money laundering rules, such as real estate agents, lawyers, accountants and dealers in precious metals and stones, are covered by the Privacy Act for the personal information they handle for anti-money laundering purposes, even if they are small. Whether the new rule touches any of those activities is worth asking your adviser.
If none of that sounds like you, the new rule probably does not bind you today. Two reasons not to shrug it off:
Not sure whether you are covered? A privacy lawyer can usually confirm it in one conversation, and the OAIC’s small business page has a checklist.
The tools to check are the ones that score, rank, approve, decline, price or filter people. On a typical business website that can include:
The OAIC says you have “arranged for” a program to make or inform decisions if you built it, bought it, configured off-the-shelf software, or relied on its recommendations. That includes software you cannot customise and cannot see inside. The responsibility sits with the business using the tool, not the software supplier.
The OAIC also expects suppliers to give their customers clear, high-level information about how their software can be used to make decisions. So the first step is simple: ask them. Then put it in writing. Law firm Allens suggests your contracts should be clear about who actually makes each decision, you or the software.
Three things, and the law is specific about them:
The OAIC’s guidance on how to say it:
Here is how that might read in plain English. It is an example only, so change it to match what your tools really do:
Decisions made by computer programs
Our online rental application system automatically declines applications that are incomplete or do not meet the minimum requirements we publish for each property. For all other applications, the system produces a ranking that our property managers use to help decide who is offered the property.
To do this, the system uses the details you give us in your application: your contact details, employment and income details, rental history and references.
For a covered business, a privacy policy without the required information does not comply with APP 1 from 10 December 2026. Nobody is arriving at your door on 11 December with a clipboard, but the regulator now has sharper tools than it used to.
There is also a quieter risk. If something goes wrong later, such as a complaint or a data breach, an inaccurate or incomplete privacy policy makes everything else harder to defend.
There are about five weeks until 10 December 2026. That is enough time if you start now.
If you are genuinely torn on a tool, the OAIC’s own advice is to take the cautious approach and include it.
The Children’s Online Privacy Code. The OAIC must register this code by 10 December 2026, the same day the automated decision rule starts. As at early November, it has not been registered yet; the final round of public consultation closed on 5 June 2026. It will apply to covered businesses running social media, apps, websites and other online services that are likely to be used by children. If that is you, watch for the final version and its start date.
The second round of Privacy Act reforms. On 31 August 2026, the government released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 with 41 proposed reforms. Submissions closed on 18 September. As at early November it has not been introduced to Parliament, so nothing changes yet. We will keep an eye on it and post an update when it moves.
Do small businesses need to follow the new automated decision rules?
Only if they are covered by the Privacy Act. Most businesses with turnover of $3 million or less are exempt, but health service providers, businesses that trade in personal information, Commonwealth contractors and a few other groups are covered regardless of size.
My business isn’t covered. Should I add it anyway?
It is optional, but worth considering. It keeps your privacy policy accurate, it builds trust, and it gets you ready if the small business exemption is ever removed. If you do not have a privacy policy at all yet, start with our guide: Does your website need a privacy policy?
Does a chatbot on my website count?
Only if it helps make significant decisions about people using their personal information, such as approving refunds or declining applications. A chatbot that answers general questions is unlikely to count.
Do I have to explain how my software works?
No. You need to describe the kinds of information used and the kinds of decisions involved. Trade secrets and detailed logic can stay private.
My software supplier says it’s their problem. Is it?
No. The obligation sits with the business using the tool. Your supplier should give you the information you need, but your privacy policy is your responsibility.
This article is general information only and is not legal advice. Whether these rules apply to your business depends on your circumstances, so check with a privacy lawyer or the OAIC. Last updated November 2026.
Let's discuss how Gravity Projex can help accelerate your business growth.
Launch Projex