Using software or AI to make decisions about people? Your privacy policy may need updating by 10 December 2026.

From 10 December 2026, Privacy Act–covered businesses must explain in their privacy policy when computer programs make, or substantially help make, significant decisions about people. Here is how to work out whether that is you, and what to write.

This is general information for Australian businesses, not legal advice. Whether a particular decision is in scope depends on your facts, and the wording in your policy should be checked by your adviser.

What is changing

New obligations in the Australian Privacy Principles, APP 1.7 to 1.9, come into effect on 10 December 2026. They are transparency obligations: they do not stop you using software or AI to make decisions, but they require your privacy policy to tell people when you do.

The OAIC’s fact sheet says the term “computer program” is broad. It covers pre-programmed rule-based processes, AI and machine learning, ordinary software, apps and word-processing tools, and generative AI including chatbots. The OAIC’s own worked example is a health and aged care provider whose spreadsheet formula scores and ranks people for contact. That is in scope, even where the rankings are used to decide who not to contact. A booking system’s automatic rules and a recruitment platform’s ranking are computer programs too; whether they are in scope depends on the decision they affect.

Does this apply to us?

Two questions, in order.

First: is the business covered by the Privacy Act at all?

The OAIC’s small business page explains that most businesses with an annual turnover of $3 million or less are not covered by the Privacy Act, but there are exceptions. Health service providers are covered regardless of turnover, which generally brings in small medical, allied-health and other health practices. Other exceptions include businesses that trade in personal information and Commonwealth contractors, and a small business can also choose to opt in. If you are not sure, start with the OAIC small business page. If the Privacy Act does not apply to you, the rest of this article is still a sensible habit, but it is not an obligation.

Second: does a decision meet the OAIC’s three conditions?

The fact sheet sets out three conditions. A decision is in scope where all three are met:

1. You have arranged for a computer program to make a decision, or to do something substantially and directly related to making it. “Arranged for” is wide: building software in-house, buying a third-party program, configuring off-the-shelf software, authorising a program to make a determinative decision, or relying on its advisory outputs all count.
2. The decision could reasonably be expected to significantly affect the rights or interests of an individual. The OAIC reads “significantly” as more than trivial, with the potential to considerably influence the person’s circumstances or outcomes. The vulnerability of the people affected is relevant.
3. Personal information about the individual is used.

The OAIC has published a one-page flowchart that walks through the same conditions. Print it and keep it next to the inventory below.

For a sense of what the OAIC thinks lands on the “in scope” side, its non-exhaustive list of decisions generally in scope includes recruitment software that sorts candidate profiles; programs that prioritise health or disability services; approving or rejecting loan or credit applications; assessing insurance eligibility; differential or personalised pricing by online retailers for significant goods; and AI reports that rank employee performance or decide bonuses.

Start with a decision inventory

You cannot write the policy section until you know where programs are touching decisions. The simplest way to find out is a table that one person fills in, walking through each stage of the customer, patient, applicant and staff journey and asking: what software runs here, and what does it decide, rank or recommend about a person?

Here is a template to copy. Keep rows short; it is a map, not a report.

Below is the same table filled in for Harbourline Physio, a fictional physiotherapy clinic invented for this article. As a health service provider, it is covered by the Privacy Act whatever its turnover.

Notice the third row. Not every use of AI is a decision about a person. A tool that drafts words a staff member reviews, with no bearing on what the person gets, is a different thing from a tool that decides who waits longer. Keep that distinction in mind and the inventory stays honest in both directions.

What the privacy-policy section might look like

The fact sheet says the privacy policy must include three things: the kinds of personal information used in the operation of these programs; the kinds of decisions made solely by such programs; and the kinds of decisions where a thing substantially and directly related to making the decision is done by such programs. Information can be grouped, but it must be meaningful to a reasonable person, and where more sensitive information such as health information or biometric templates is used, that should be clear.

The section below is written for Harbourline Physio and follows the structure the OAIC uses in a worked example in its fact sheet: a heading, the kinds of personal information, then the kinds of decisions. It is an illustration of structure, not legal wording. Your adviser should review whatever you adopt.

Decisions made using computer programs
We use computer programs, including rule-based software and artificial intelligence tools, to make or help make some decisions about our patients, people who enquire about our services and people who apply to work with us.

The kinds of personal information these programs use
– Contact and identity details, such as your name, date of birth and contact information.
– Health information you provide in our intake and screening forms, including the condition you are seeking treatment for, your symptoms, pain levels and how your condition limits your daily activities.
– Appointment and account information, including attendance history and any unpaid balance.
– Information in job applications, such as work history, qualifications and responses to application questions.

Decisions made solely by computer programs
– Whether online booking is available on a patient account with an unpaid balance more than 60 days old. Our practice software applies this rule automatically. You can still book by phone, and our reception team can restore online booking.

Decisions where a computer program does something substantially and directly related to the decision
– Prioritising patients on our waitlist. Our online intake form scores the health information you provide, and our clinicians use that score, together with their own judgement, to decide who is offered the next available appointment.
– Shortlisting job applicants. Our recruitment platform ranks applications against the criteria for the role, and our hiring team uses that ranking to decide who to interview.

If you have questions about how these programs are used, contact our practice manager at [contact details].

Two things to notice. The health information is named plainly rather than buried in “information you provide”, because the OAIC says the use of more sensitive information should be clear. And the booking rule and the waitlist scoring are described in enough detail to be meaningful without saying how the formula works. The fact sheet excludes commercial-in-confidence information about the programs, such as commercially sensitive information and trade secrets, so you do not have to publish your scoring weights or your vendor’s model details. You do still have to say that you use personal information this way.

What does not change the answer

These are the points on which it is easiest to talk yourself out of scope. The OAIC’s fact sheet addresses each.

• “A person reviews it, so it is not automated.” A decision may be in scope even where the program’s output does not replace the whole decision or is subject to human review. The OAIC says that outputs of machine learning or generative AI used to make decisions that significantly affect people would generally be in scope “unless subject to extensive human oversight and control”. A quick glance at a score before following it is hard to describe as extensive oversight.
• “It only recommends; we decide.” Output can be advisory or determinative. Relying on advisory outputs is one of the ways the fact sheet says you can have “arranged for” a program to do something related to a decision.
• “We did not build it; we just subscribe.” Procuring a third-party program and configuring off-the-shelf software both count as arranging for it. The OAIC generally expects the obligation to remain with the business that uses the personal information to make the decision, and it expects third-party software providers to give their customers clear, high-level information for that purpose. Ask your vendors for it.
• “We cannot reveal how the tool works.” You do not have to. Commercially sensitive details and trade secrets are excluded. The fact that personal information is used in these decisions, and what kinds, is not.
• “We are not sure it counts.” The OAIC’s advice is to take a cautious approach and include the information.

A related but separate question is what staff should paste into general-purpose AI tools in the first place. That is covered in our guide on removing customer details before using AI tools.

A five-step plan before 10 December

This is a practical sequence for a small or mid-sized business. The first two steps are internal work. The rest depends on how quickly vendors and advisers reply, which is why it pays to start early.

1. Build the inventory. One person, the template above, a walk through each journey: enquiry, intake, booking, payment, follow-up, recruitment, staff management. Include spreadsheets and the automation rules inside your practice or business software, not just tools with “AI” in the name.
2. Check each row against the three conditions. Use the OAIC flowchart. Mark each row yes, no or unsure, and write the reason in one line so you can explain it later. Where you are unsure, the OAIC’s advice is to lean towards including it.
3. Ask vendors for the high-level description. For each in-scope tool you did not build, ask the provider for a plain-language statement of what personal information the tool uses and what it decides or recommends. Keep the replies with your inventory.
4. Draft the policy section. Heading, kinds of personal information, decisions made solely by programs, decisions programs substantially help with. Group sensibly, name sensitive information plainly, leave out trade secrets.
5. Have it reviewed and publish it. Your adviser checks the wording against your actual practices. Then update the published policy wherever it lives: website, intake forms, onboarding packs.

Then keep it current. The inventory is only accurate until the next tool is adopted or the next automation rule is switched on. Add a question to your process for new software: does this decide, rank or recommend anything about a person, and have we updated the inventory and the policy?

If the hard part is step one, because nobody is quite sure what the software is doing underneath the workflows, that is a mapping job rather than a legal one. AppliedAgents does this kind of workflow and systems mapping for Australian businesses, so you can hand your adviser an accurate picture of where programs are making or shaping decisions. The legal view of that picture is your adviser’s.

Sources

• Office of the Australian Information Commissioner, APP 1.7–1.9 Transparency Obligation fact sheet (September 2026)
• Office of the Australian Information Commissioner, APP 1.7–1.9 Transparency Obligation flowchart
• Office of the Australian Information Commissioner, New resources on transparency for use of AI and automated decision-making
• Office of the Australian Information Commissioner, Small business

This article is general information, not legal advice. Sources were checked on 26 October 2026. Harbourline Physio is fictional, and the policy section shown is an illustration of structure only. Whether a decision in your business is in scope, and the wording you publish, should be confirmed with your adviser.