---
title: "Automated Decision-Making and the Privacy Act: What Changes on 10 December 2026 | Croissant & Baguette"
description: "From 10 December 2026, your privacy policy must say when software makes decisions about people. Who is covered, what counts, the penalties and a checklist."
url: "https://croissantbaguette.com.au/guides/automated-decisions-privacy-policy/"
---

# What changes on 10 December 2026 if software makes decisions about your customers?

https://croissantbaguette.com.au/guides/automated-decisions-privacy-policy/

From 10 December 2026, your privacy policy must say when software makes decisions about people. Who is covered, what counts, the penalties and a checklist.

## What changes on 10 December 2026 if software makes decisions about your customers?

Your privacy policy has to say so. From that day, a business the Privacy Act covers must describe the personal information its computer programs use and the kinds of decisions they make or inform, when those decisions could significantly affect someone. Spreadsheet rules count as much as AI, and a person signing off does not always take a decision out. Who is covered, what counts, the penalties, and a checklist.

**Quick answer**

- **Starts** 10 December 2026
- **The rule** APP 1.7 to 1.9, Privacy Act
- **Who** over $3m turnover, or an exception
- **Covers** decisions that could significantly affect a person
- **Asks for** three things in the privacy policy
- **Per notice** $21,840 for a company

Our reading of the Act and the OAIC's guidance of 30 September 2026, not legal advice.

## Three things in the privacy policy, for decisions made from 10 December 2026.

From 10 December 2026, new Australian Privacy Principles 1.7 to 1.9 require a business the Privacy Act covers to state in its privacy policy when it has arranged for a computer program to make a decision, or to do something substantially and directly related to making one, that could reasonably be expected to significantly affect a person's rights or interests, using their personal information. The policy must then list three things: the kinds of personal information those programs use, the kinds of decisions they make on their own, and the kinds where they inform a decision a person makes. The rule comes from the Privacy and Other Legislation Amendment Act 2024 and applies to every decision made from that day, even by a system switched on years earlier. Rule-based software counts as much as AI, and in the OAIC's guidance of 30 September 2026 a person approving the output does not take a decision out of scope unless the oversight is extensive. Businesses with annual turnover of $3 million or less are outside the Act unless an exception applies, and the exceptions include health services, gyms, childcare and anyone trading in personal information. A missing section can draw an infringement notice of $21,840 per contravention for a company at today's $364 penalty unit, $72,800 for a listed one. It adds no ban on automated decisions and no right to an explanation; it is a disclosure duty, and the work is knowing what your systems decide.

## Five questions, in the order the OAIC asks them.

- **Is your business an APP entity?** Turnover above $3 million in any financial year since 2002, or an exception. Health services, including gyms, weight-loss clinics, childcare and private schools; trading in personal information; Commonwealth contracts; a related company that is covered; or opting in.
- **Does a computer program use personal information?** A program in the ordinary sense, from a rule in a spreadsheet to a machine-learning model or a chatbot, reading anything that identifies a person.
- **Does it decide, or do something substantially and directly related?** A score, a ranking or a recommendation that is a key factor in a decision counts. A word processor recording a decision someone else made does not.
- **Could the decision significantly affect someone?** More than trivial: access to a significant service, a contract, money, a job, housing, credit or insurance. Refusing or failing to decide counts, and so does a favourable outcome.
- **Then the privacy policy must say so.** The kinds of personal information used, the kinds of decisions made by the program alone, and the kinds it informs. In place before 10 December 2026.

## Everyday automations, and whether APP 1.7 reaches them.

- **Application checks** Reads an application as it arrives, checks it against the rules and records, and holds back the ones that fail until a person looks. | Likely covered when the check can stop or delay an application. Name the details it reads and the kind of decision.
- **Approvals and eligibility** Scores a loan, insurance, rental or scholarship application, or decides who qualifies for a programme. | Covered when the output is a key factor. The OAIC lists all four as generally in scope.
- **Refunds and account limits** Approves or declines refunds, or suspends an account when a rule trips. | Covered in the OAIC's view; both appear in its own examples.
- **Personalised or postcode pricing** Sets a different price for different customers of significant goods or services. | Covered. The OAIC treats a small price difference as significant because it compounds.
- **Recruitment screening** Sorts, ranks or shortlists job applicants. | Covered. Applicants are not employees, so the employee-records exemption does not help.
- **Lead scoring and enquiry routing** Scores enquiries or routes them to a person, a queue or an automatic reply. | Depends on what the score controls. Who replies first, probably not; who gets an offer, a price or a service, treat as covered.
- **Spam and triage filters** Sorts incoming messages into genuine, spam and urgent. | Rarely significant alone. Record it anyway, and check what happens to the messages it rejects.

Disclose. The OAIC's own advice is to take a cautious approach and include the program in the privacy policy, and a line too many costs nothing.

## What a missing section can cost.

- **$21,840 per infringement notice** — a company, 60 penalty units at $364
- **$72,800 per notice, listed company** — 200 penalty units
- **$4,368 per notice, an individual** — a sole trader the Act covers, 12 penalty units
- **$364,000 court maximum, a company** — 1,000 penalty units under s 13K

From 10 December 2026 APP 1.7 joins the obligations the OAIC can enforce with compliance and infringement notices (s 13K of the Privacy Act). Penalty units are fixed by the date of the contravention; the $66,000 and $330,000 in older articles use the $330 unit that applied until 30 June 2026.

## Eight steps before 10 December 2026.

- **List every automation that touches personal information.** Your own builds and the vendor tools that score, rank, approve or route. The duty stays with the business that uses the output, not with the software company.
- **Write down what each one reads.** Name, contact details, purchase history, location, documents, and anything sensitive such as health information, which the OAIC says should be named plainly.
- **Mark what it decides, and who acts on it.** Decisions the program makes alone go on one list; decisions a person makes on its score, ranking or recommendation go on the other.
- **Test each one against "significantly affect".** Money, access to a significant service, a contract, a job, housing, or a vulnerable customer. Treat a close call as covered.
- **Draft the section in plain language, grouped.** The kinds of personal information, the decisions made by programs alone, the decisions they inform. Then have a lawyer check the wording.
- **Check the notices around it.** The collection notice under APP 5, APP 8 if the model provider is overseas, and APP 11's rule to destroy what you no longer need.
- **Keep a person, and a record, where it matters.** APP 1.7 does not require either, but a complaint, a regulator or the statutory privacy tort will ask what the system did and why.
- **Review the section whenever an automation changes.** A new rule, a new model or a new vendor can mean a new line in the policy. Put the review in the change process, not the calendar.

## Who builds automations in Australia, and what to ask them.

- **Every decision the system makes or informs, in writing.** Not a feature list. A plain list of what it decides, approves, ranks or routes, and for whom.
- **The personal information behind each one.** Field by field, including what comes from other systems. That list becomes the first part of your privacy policy section.
- **Where a person signs off, and what they see first.** The OAIC asks how much the person relies on the output, so the approval screen matters as much as the approval.
- **A record of why each decision went the way it did.** The inputs, the rule or score, the outcome and who approved it. Without it, a complaint has no answer.
- **Which providers see the data, and where.** Model, hosting and database providers by name and region, because an overseas recipient is an APP 8 question you answer for.
- **We do.** Croissant & Baguette is a small Sydney studio with a network of Australian specialists. Application checking, lead qualification and enquiry triage are automations we run for clients, each in accounts the client owns, a person deciding the doubtful cases, and each with a written list of the providers that see its data. — Built in Sydney, never offshored. The free assessment starts with the list of what your systems decide.

## What we charge.

**Why the paperwork is part of the build** Because the questions APP 1.7 asks, what a system reads and what it decides, are the questions we answer to build it. Writing them down as we go costs a few hours; reconstructing them from a system that is already running is the expensive way, and it usually happens the week a complaint arrives.

- **Automation Opportunity Assessment** free (one meeting · a written proposal, priced)
- **Automation build** from $8,000 (one process end to end, 30 days of hypercare)
- **Managed** from $250/month (monitoring, fixes, monthly report · changes quoted)
- **Internal tool / dashboard** typically $8–20k (on top of the systems doing the work)

What moves a build within those ranges:

- how many decisions the system makes or informs, and for how many kinds of customer
- how much a person reviews, and what they see before they decide
- the record each decision leaves, and how long it is kept
- where the data may go, and which providers are allowed to see it
- how many systems it reads from and writes to

Indicative. Fixed price after the free assessment. We are not lawyers, and your privacy policy wording should be checked by one.

## Ask away.

Nine things people ask about the new rule. Still one missing? [Ask us](https://croissantbaguette.com.au/contact/).

- **What is automated decision-making?** Under the Privacy Act from 10 December 2026, it is a computer program using personal information to make a decision, or to do something substantially and directly related to one, such as a score, a ranking or a recommendation a person relies on, where the decision could significantly affect someone. A rule in a spreadsheet counts as much as AI. A program used for something else, like a word processor recording a decision, does not.
- **Does the Privacy Act apply to AI?** Yes, to every use of AI involving personal information by a business the Act covers. The OAIC's guidance on commercially available AI products says the obligations apply to what goes into an AI system and to personal information in what comes out. From 10 December 2026 a covered business must also say in its privacy policy when AI or other software makes or informs significant decisions about people. Australia has no separate AI Act.
- **Does a person signing off mean it doesn't count?** Not necessarily. The Act covers a program that recommends or guides a decision when its output is a key factor, and the OAIC's guidance of 30 September 2026 says AI outputs are generally in scope unless subject to extensive human oversight and control. In one of its own examples, written director approval of bonuses an AI tool suggested still counted, because the decisions relied on the recommendation.
- **Does it apply to small businesses?** Mostly not: a business with annual turnover of $3 million or less is outside the Privacy Act unless an exception applies. The exceptions catch more than people expect. Health services, which the OAIC says include gyms, weight-loss clinics, childcare and private schools; businesses that trade in personal information; Commonwealth contractors; companies related to a covered business; and any business that has had turnover above $3 million in a financial year since 2002.
- **What must the privacy policy say?** Three things, under APP 1.8: the kinds of personal information your programs use, the kinds of decisions made solely by a program, and the kinds where a program does something substantially and directly related to a decision a person makes. The OAIC asks for plain language, sensible grouping and enough detail to be meaningful. The Explanatory Memorandum says commercial-in-confidence detail about how a system works is not expected.
- **What happens if we don't update it?** From 10 December 2026, a missing or incomplete section is a breach the OAIC can answer with a compliance notice or an infringement notice: $21,840 per contravention for a company and $72,800 for a listed company, at the $364 penalty unit in force since 1 July 2026. A court can impose up to $364,000 on a company. The OAIC describes its approach as risk-based and proportionate, starting with guidance.
- **Does it apply to decisions made before 10 December 2026?** No, only to decisions made from that day, but it reaches back into how they are made. A system switched on years earlier is covered for every decision it makes after the date, and so is personal information collected before it. So the new section has to be in the privacy policy before 10 December 2026, not after the first decision it describes.
- **Is lead scoring an automated decision?** It can be. No regulator example covers lead scoring, so it turns on what the score controls. If it only decides who gets a reply first, the effect is probably not significant. If it decides who is offered a price, credit, a service or a place, treat it as covered. For anyone in doubt, the OAIC's advice is to include the program in the privacy policy.
- **Do customers get a right to an explanation or a human review?** Not from this change. APP 1.7 to 1.9 add three things to a privacy policy and nothing more: no ban on automated decisions, no right to an explanation of one, and no right to have a person review it. The government agreed in 2023 to a right to request meaningful information about substantially automated decisions, but it is in neither the 2024 Act nor the 2026 draft bill.

## Sources

Read on 11 October 2026. This page is our reading of these documents, not legal advice.

- **[Privacy and Other Legislation Amendment Act 2024, Schedule 1, Part 15](https://www.legislation.gov.au/C2024A00128/asmade/text)** Federal Register of Legislation · APP 1.7 to 1.9 and the 10 December 2026 start
- **[Privacy Act 1988, current compilation](https://www.legislation.gov.au/C2004A03712/latest/text)** Federal Register of Legislation · s 6D small business test, s 13K penalties
- **[Explanatory Memorandum to the Bill](https://parlinfo.aph.gov.au/parlInfo/download/legislation/ems/r7249_ems_a01fc1bd-4aa3-4fc2-87d7-ed8aa84ab564/upload_pdf/JC014082.pdf;fileType=application%2Fpdf)** Parliament of Australia · paragraphs 332 to 344
- **[APP Guidelines, Chapter 1, updated 30 September 2026](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information)** OAIC · paragraphs 1.35 to 1.78 on automated decisions
- **[APP 1.7 to 1.9 transparency obligation fact sheet](https://www.oaic.gov.au/__data/assets/pdf_file/0021/269013/APP-1.7-1.9-Transparency-Obligation-Fact-Sheet.PDF)** OAIC · September 2026, with worked examples
- **[APP 1.7 to 1.9 transparency obligation flowchart](https://www.oaic.gov.au/__data/assets/pdf_file/0019/269011/OAIC-APP-1.7-1.9-Transparency-Obligation-Flowchart_v4.pdf)** OAIC · the order of the questions above
- **[Small business and the Privacy Act](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business)** OAIC · the $3 million test and its exceptions
- **[Infringement notices](https://www.oaic.gov.au/about-the-OAIC/our-regulatory-approach/privacy-regulatory-action-policy/infringement-notices)** OAIC · amounts at the $364 penalty unit
- **[Guidance on privacy and the use of commercially available AI products](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/guidance-on-privacy-and-the-use-of-commercially-available-ai-products)** OAIC · October 2024, updated January 2025

- **[Document processing.](https://croissantbaguette.com.au/guides/automating-document-and-application-processing/)** What it costs to automate applications and documents, and what the system must get right.
- **[AI automation costs.](https://croissantbaguette.com.au/guides/how-much-does-ai-automation-cost-in-australia/)** What it costs to take one process off your team, with a real system itemised.
- **[Enquiries and bookings.](https://croissantbaguette.com.au/guides/automating-enquiries-and-bookings/)** Booking tool, answering service, AI receptionist or a built system, priced side by side.
- **[AI Automation.](https://croissantbaguette.com.au/ai-automation/)** The jobs we automate, and how the work is done.

## Book a free assessment.

One meeting about the automations you run or plan, then a written proposal. It lists what each system decides and the personal information it reads, flags the ones the new rule is likely to reach, and prices anything worth building.