Privacy Act Automated Decision Rules: December 2026

From 10 December 2026, covered businesses need to explain qualifying automated decision making in their privacy policies. The practical job is to identify where software uses personal information to make, recommend or guide decisions with significant effects on people. I'd start with those workflows before rewriting the policy.

This article provides general information, not legal advice. Use the linked OAIC guidance and get advice on how the rules apply to your business.

When Do the Privacy Act Automated Decision Rules Start?

The commencement date is 10 December 2026. The Privacy and Other Legislation Amendment Act 2024 introduced APPs 1.7, 1.8 and 1.9. The OAIC confirms that the amendments apply to decisions made from that date, regardless of when the software arrangement began.

So an existing system belongs in your review. Buying or configuring software before December does not, by itself, put later decisions outside the rules.

The OAIC's May 2026 issues paper said guidance was intended by September 2026. When I checked on 24 September 2026, I couldn't find the OAIC's final guidance on its site, so check its current material before finalising your policy.

Which Automated Decisions Do the New Rules Cover?

The OAIC sets out three conditions. All must apply:

1. The APP entity has arranged for a computer program to make a decision, or do something substantially and directly related to making a decision.
2. The decision could reasonably be expected to significantly affect an individual's rights or interests.
3. The program uses personal information about that individual to make the decision or do the related thing.

AI is only part of the scope. The issues paper includes ordinary software, apps, word-processing tools and generative AI within its discussion of computer programs.

The OAIC also says decisions can be beneficial or adverse, and include refusing or failing to decide. I'd therefore review favourable decisions and stalled applications alongside refusals.

What Must a Privacy Policy Say About Automated Decisions?

Where the conditions apply, APP 1.8 requires three kinds of information:

A sentence saying you use AI tells the reader very little about those matters. In its 8 September 2026 commentary, Corrs Chambers Westgarth warns that generic statements about using technology to improve services will not suffice.

I'd prepare a plain description of each relevant workflow first, then have the policy wording reviewed against what the system actually does.

Does the Small Business Exemption Apply to the New Rules?

The new rules apply to APP entities. The OAIC says most small businesses are not covered by the Privacy Act, but some are covered regardless of turnover.

The OAIC's exceptions include health service providers, businesses trading in personal information, contractors providing services under a Commonwealth contract, credit reporting bodies and AML/CTF reporting entities. The page also lists other exceptions and businesses that have opted in.

For a law firm, accounting practice or conveyancer that has become an AML/CTF reporting entity, I'd make the OAIC's small business checklist an early stop. A small team or modest turnover is not enough to settle coverage.

Does Using AI to Draft Emails Count as an Automated Decision?

Drafting an email does not settle the question either way. Check what the draft does in the decision process against the three conditions.

As an illustration, polishing the wording of an appointment confirmation differs from recommending that someone be refused a significant service. If the recommendation uses personal information and becomes a key factor in the decision, a person clicking approve does not automatically remove the workflow from scope.

The OAIC's issues paper explains that software can recommend or guide a human decision-maker. It describes "substantially" as being a key factor in facilitating the decision and "directly" as having a direct connection with making it.

For client intake automation, I'd examine what happens after the enquiry summary: who gets accepted, prioritised or referred, and how much the software influences that choice.

What Should a Business Do Before December 2026?

1. Establish coverage. Work through the OAIC's small business checklist and resolve uncertainty before assuming an exemption.
2. Map decisions. Record the personal information used, the software's output, the decision-maker and the possible effect on the individual.
3. Include supplier products. Ask what embedded scoring and recommendations do. Norton Rose Fulbright's commentary recommends reviewing third-party arrangements because the obligation concerns entities that have arranged for automated decision making.
4. Review policy wording. Describe the relevant information and decision categories, using the workflow map as the starting point.
5. Assign ongoing ownership. I'd nominate someone to review the description when inputs, rules or approval steps change.

Truespeak is built for Australian service businesses that want automation designed, built and then run for them, with a person approving anything sensitive.

Through managed AI operations, Truespeak monitors systems, reviews exceptions and records outcomes. Human approval and workflow records make the process easier to describe in a privacy policy. Neither replaces a legal assessment.