The privacy policy change coming on 10 December 2026
From 10 December 2026, businesses covered by the Privacy Act must say in their privacy policy when software uses personal information to make significant decisions about people. It isn't only big tech. Online quote tools, booking systems and some chatbots can count. Here's who it applies to, how to tell if your website is affected, and what to add.
Last updated
The short answer
From 10 December 2026, Australian Privacy Principle 1.7 requires businesses covered by the Privacy Act to explain in their privacy policy when a computer program uses personal information to make, or substantially and directly help make, a decision that could significantly affect someone. The policy must list the kinds of personal information used and the kinds of decisions involved. It applies to businesses the Privacy Act covers, which generally means turnover over $3 million, plus health providers and some others of any size.
What the new rule says
The rule is in Australian Privacy Principles 1.7 to 1.9, added by the Privacy and Other Legislation Amendment Act 2024. It applies when three things are true: your business has arranged for a computer program to make a decision, or do something substantially and directly related to making it; the decision could reasonably be expected to significantly affect someone's rights or interests; and the program uses personal information about that person. If all three are true, your privacy policy must say what kinds of personal information the program uses, and what kinds of decisions it makes on its own or helps to make. The privacy regulator, the OAIC, says a decision can be in scope even when a person reviews the result.
Website tools that might count
Online quote or eligibility tools
A form that works out a price, a discount or whether someone qualifies, using their details, and shows the answer without a person checking it.
Booking and triage systems
A system that decides who gets an appointment, how urgent a request is, or who is turned away, based on what the person enters.
Chatbots and AI assistants
A plain question-and-answer chatbot probably isn't making significant decisions. One that approves refunds, books services or screens people in or out might be.
Account and payment checks
Automatic suspension of an account, credit or payment checks, or fraud rules that block a customer.
Job applications
Software or an AI tool that ranks or filters job applicants before anyone reads them.
Things that don't count
Using software to write up a decision a person has already made, like a word processor or email, isn't captured, according to the OAIC.
Who this applies to
- Businesses with annual turnover over $3 million, which the Privacy Act covers.
- Health service providers of any size, including allied health and practices that keep health records.
- Businesses that buy or sell personal information, and contractors to the Australian Government.
- From 1 July 2026, lawyers, accountants, real estate agents and conveyancers for the work the anti-money laundering rules cover.
- Small businesses that have chosen to opt in to the Privacy Act. If you're not sure whether you're covered, the OAIC's small business page explains it, or ask your lawyer.
How to get ready before 10 December
- List the tools. Write down every form, calculator, booking system, chatbot and plugin on your website, plus any back-office software that makes decisions about customers or staff.
- Ask the three questions for each one. Does it make or substantially help make a decision? Could that decision significantly affect someone? Does it use their personal information? If the answer to all three is yes, it goes in the policy.
- Add a section to the privacy policy. In plain words, describe the kinds of personal information each tool uses and the kinds of decisions it makes or helps make. You don't have to publish how the software works.
- Check the rest of the policy while you're there. The OAIC can now issue infringement notices for a privacy policy that is missing required content. Make sure it also covers what you collect, why, who you share it with, overseas disclosure, and how people can access, correct and complain.
How WaTo can help
- Our website security and compliance audit lists the tools on your website that could fall under the new rule, and checks which tracking tags fire on your pages.
- We can update the privacy policy page on your website once you or your lawyer have settled the wording.
- We aren't lawyers. If you need advice on whether the Privacy Act covers you, or on the exact wording, talk to a privacy lawyer and give them our list.
Questions about the 10 December 2026 change
Does this apply to my small business?
Only if the Privacy Act covers your business. Most businesses with turnover of $3 million or less are exempt, but health service providers, businesses that trade in personal information, Australian Government contractors and, from 1 July 2026, some lawyers, accountants, real estate agents and conveyancers are covered whatever their size. The small business exemption has not been removed, although the government has proposed changes to it.
What exactly do I have to add to my privacy policy?
Three things: the kinds of personal information your software uses to make these decisions, the kinds of decisions it makes on its own, and the kinds of decisions where it does something substantially and directly related to making the decision. The OAIC's APP 1 guidelines have worked examples.
Does my website chatbot count?
It depends what it does. A chatbot that only answers common questions isn't likely to be making significant decisions about people. If it approves or refuses something, books or turns people away, or screens them, it may be. List it and work through the three questions.
What if a person checks every decision the software makes?
It can still count. The OAIC says a decision can be in scope even when a human reviews the computer's output, if the program does something substantially and directly related to making the decision.
What happens if we miss the date?
The OAIC can issue infringement notices when a privacy policy is missing required content, and in December 2025 it announced a sweep checking the privacy policies of about 60 businesses against APP 1.4. The bigger risk for most businesses is a customer complaint that leads the regulator to look closer.
We're under $3 million and not covered. Should we do it anyway?
It's worth knowing what your tools do, and a clear privacy policy builds trust. The government has proposed narrowing the small business exemption, so being ready does no harm. It isn't a legal requirement for businesses the Act doesn't cover.
How WaTo can help with this
Guides on this topic
- Practical AI governance for small businesses
- A practical cyber security policy for small business
- How to secure your business domain name
Sources & references
WaTo Consulting. Last reviewed 2026-11-07. Review after 10 December 2026, and when the Privacy Act small business exemption changes.
Not sure what your website's tools are doing?
We'll list every form, plugin, chatbot and tracking tag on your site so you or your lawyer can update the privacy policy before 10 December.
Mon to Fri, 8:30am to 5pm
