From 10 December 2026, APP entities (organisations covered by the Privacy Act) must include new information in their privacy policy if they have arranged for a computer program to make a decision, or do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect someone's rights or interests, using that person's personal information.
On 30 September 2026 the OAIC published a fact sheet, a flowchart and updated APP 1 Guidelines to help businesses comply.
What the privacy policy must say
- The kinds of personal information used by those computer programs
- The kinds of decisions made solely by computer programs
- The kinds of decisions that computer programs substantially and directly help make
What counts
The OAIC fact sheet says a computer program can be rules-based software, AI or machine learning, configured off-the-shelf software, or generative AI including chatbots. Tools bought from a third party count. A decision can still be in scope when a person reviews the output.
The OAIC's non-exhaustive list of decisions generally in scope includes recruitment software that sorts candidates, loan or credit approvals, insurance eligibility, differential or personalised pricing by online retailers selling significant goods, and programmatic advertising relating to the decision to sell significant goods or services. Commercially sensitive information and trade secrets do not have to be disclosed.
Who is covered
The OAIC says most small businesses, those with annual turnover of $3 million or less, are not covered by the Privacy Act, but some are regardless of turnover, such as health service providers and businesses that trade in personal information. Use the OAIC's small business checklist or ask your adviser.
What to do before 10 December
- Confirm whether the Privacy Act applies to your business.
- List the AI and automated tools used across the business, including tools staff adopted themselves.
- Work out which of them make or shape decisions that could significantly affect customers, applicants or staff.
- Get your adviser to approve the privacy policy wording.
- Update the privacy policy on your website.
Ven can update the privacy policy page on your website once the wording is approved.
This is general information, not legal advice.
Also this week: Google Ads pulling promotions from your website and bot traffic and cleaner reporting.