Privacy Act Automated Decision-Making Rules: What Australian Sites Must Change

By Eoin Villarin, 2026-10-29

From 10 December 2026, Australian businesses must disclose automated decisions in their privacy policy. Here is what counts, the penalties and how to comply.

Australia's Privacy Act automated decision-making rules start on 10 December 2026, and they apply to far more software than AI. From that date, businesses covered by the Privacy Act must explain in their privacy policy when a computer program makes, or substantially helps make, decisions that could significantly affect people, and what personal information it uses. The Office of the Australian Information Commissioner (OAIC) published its guidance on 30 September 2026, and it reads the rule broadly enough to catch pricing engines, fraud tools, recruitment software and AI chatbots.

This guide is for Australian businesses, online stores and agencies, plus overseas companies that serve Australian customers. You get the three-part test, what the OAIC says counts, the penalties, and a checklist for updating your privacy policy and website before the deadline.

Facts come from the OAIC's announcement, its APP 1.7 to 1.9 fact sheet and its updated APP 1 guidelines, linked throughout. Dollar amounts are in Australian dollars. This post is general information, not legal advice.

Automated Decision-Making Rules at a Glance

What Are the New Automated Decision-Making Rules?

The Privacy and Other Legislation Amendment Act 2024 added three new paragraphs to Australian Privacy Principle 1, which already requires a clearly expressed and up-to-date privacy policy. From 10 December 2026, according to the OAIC, your privacy policy must cover:

• the kinds of personal information used in the operation of such computer programs
• the kinds of decisions made solely by those programs
• the kinds of decisions where the program does something substantially and directly related to making the decision

The OAIC says the guidance reflects 90 written submissions from industry, academia, government and civil society.

Does the Rule Apply to Your Business?

First check whether you are an APP entity. The OAIC says organizations with annual turnover over $3 million are covered, along with some smaller businesses regardless of turnover, including private health service providers, gyms and weight loss clinics, businesses that trade in personal information and Commonwealth contractors.

If you are covered, the OAIC fact sheet sets a three-part test. You are in scope when all of these are true:

1. You have arranged for a computer program to make a decision, or to do something substantially and directly related to making one.
2. The decision could reasonably be expected to significantly affect an individual's rights or interests.
3. Personal information about that individual is used in the program to make the decision or do that related thing.

A computer program is not just AI

The OAIC's definition covers rule-based processes, AI and machine learning, ordinary software, apps and spreadsheets, and generative AI including chatbots. One of its examples is a spreadsheet formula that ranks clients for health and aged care support. If a tool sorts, scores, ranks or filters people and that output drives a decision, it can count.

Human review does not take you out of scope

The OAIC says a decision can be in scope even when the program only recommends an outcome or a person reviews the output. "Arranged for" includes buying third-party software, configuring off-the-shelf tools and relying on advisory outputs. The OAIC considers that machine learning or generative AI outputs used in significant decisions would generally be in scope unless subject to extensive human oversight and control.

What counts as a significant effect?

The effect must be more than trivial and have the potential to considerably influence a person's circumstances. The OAIC's list of decisions that would generally be in scope includes several that sit on business websites:

• differential or personalized pricing by online retailers selling significant goods
• programmatic advertising related to the sale of significant goods or services
• recruitment software that sorts candidates and makes hiring decisions
• programs that approve or reject loan or credit applications or assess insurance eligibility
• facial recognition used in retail stores or stadiums for watchlist matching

The ecommerce pricing example

The fact sheet's ecommerce example is the one online store owners should read. A grocery platform changes prices by postcode and demand, and two customers discover one has paid more for baby formula over a year. The OAIC says the pricing is significant regardless of whether the difference is small or large, because "even a small difference can compound over time". It also matters that the goods were essentials such as food and medication.

What Must the Privacy Policy Say?

The OAIC wants information that is specific, readable and useful, not a technical manual. Its guidance says you can group decisions and kinds of information, but the detail must be meaningful to a reasonable person, and the use of more sensitive information such as health data or biometric templates should be clear. Commercially sensitive details and trade secrets, such as how a fraud model weights each data point, can be left out. The fact that you use personal information for fraud detection cannot.

The fact sheet includes sample wording. A lender's version lists the kinds of information used (identity details, geolocation, biometric templates, employment records, credit information) and the kinds of decisions made (granting or denying account access, transactions and loan applications). That format works for most businesses.

Your software vendor does not carry the obligation

The OAIC expects the obligation to stay with the business that uses personal information to make the decision. It says vendors should give their customers clear, high-level information about how their software can be used to make decisions, but contracts do not move the duty off your plate.

What Are the Penalties?

The OAIC can issue infringement notices when a business fails to have a clearly expressed and up-to-date privacy policy under APP 1.3, or fails to include required information under APP 1.4. As at July 2026, with a penalty unit worth $364, the maximum per contravention is 12 penalty units ($4,368) for an individual, 60 ($21,840) for a body corporate and 200 ($72,800) for a listed corporation. Serious privacy breaches can still go to court for much larger civil penalties.

Other reforms on the way

• Children's Online Privacy Code: the OAIC must register it by 10 December 2026. It will apply to social media, relevant electronic services and designated internet services likely to be accessed by children.
• Tranche 2 privacy reform: on 31 August 2026 the Attorney-General released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026, which proposes a fair and reasonable test for handling personal information. It is a draft, not law.

What the Automated Decision-Making Rules Mean for Your Website

For Australian online stores and service businesses, most in-scope programs sit behind the website: pricing apps, checkout fraud filters, quote calculators and AI assistants. Here is the checklist I am using with Australian clients before 10 December.

1. Confirm you are an APP entity. Check turnover and whether you fall into a covered small business category.
2. List every program that touches decisions about people. Dynamic or personalized pricing apps, fraud screening that cancels orders, buy now pay later or finance eligibility you control, automated account suspensions, AI chatbots that approve refunds or quotes, careers page screening tools and ad targeting for significant goods.
3. Run each through the OAIC flowchart. Record your reasoning. The OAIC says that if you are in doubt, take a cautious approach and disclose.
4. Ask your vendors. Request a plain description of what personal information each app or plugin uses and what decisions it makes or supports.
5. Write a new privacy policy section with a heading such as Decisions made by computer programs, grouping information types and decision types, and flagging any health or biometric data.
6. Publish it properly. Keep the privacy policy as a real HTML page linked from every footer and checkout, readable on mobile and by screen readers, rather than a PDF.
7. Add a review trigger. Any new app, plugin, AI feature or pricing rule should prompt a privacy policy check, because APP 1.3 requires the policy to stay up to date.
8. Check AI features you add next. If you sell into Europe too, the EU AI Act transparency rules add separate chatbot disclosure duties, and California has similar automated decision rules from January 2027.

Frequently asked questions

When do Australia's automated decision-making privacy rules start?

The new APP 1.7 to 1.9 obligations start on 10 December 2026. They were introduced by the Privacy and Other Legislation Amendment Act 2024. From that date, APP entities must describe in their privacy policy the kinds of personal information used and the kinds of decisions made by or with computer programs that could significantly affect individuals.

Does the rule only apply to AI?

No. The OAIC's guidance says a computer program includes pre-programmed rule-based processes, AI and machine learning, ordinary software and apps, spreadsheets and generative AI tools including chatbots. What matters is whether the program makes or substantially and directly contributes to a decision that could significantly affect someone, using their personal information.

Does dynamic pricing on an online store need to be disclosed?

It can. The OAIC lists differential or personalized pricing by online retailers selling significant goods as generally in scope. Its example shows that even small price differences based on a customer's postcode can be significant when they add up over time or affect access to essentials, so stores using personalized pricing should review their privacy policy.

What happens if my privacy policy is not updated by 10 December 2026?

The OAIC can issue infringement notices for privacy policies that are not clearly expressed and up to date, or that miss required information. As at July 2026 that is up to $21,840 per contravention for a company and $72,800 for a listed corporation, before any court action for more serious breaches.

Six Weeks to Explain Your Algorithms

The new rule is not about banning automation. It asks Australian businesses to say plainly where software makes or shapes decisions about people. For most online businesses that means an honest inventory, a few clear paragraphs and a process to keep them current.

If you want help finding which apps and AI features on your site are in scope and rewriting your privacy policy section to match, send me a message and I will audit your WordPress, Shopify or custom site and give you a clear plan, working in Australian business hours. You can see my work in my case studies. I will reply within 24 hours.