Does your website make decisions about people? Your privacy policy must say so from 10 December 2026.
Short answer: from 10 December 2026, Australian businesses covered by the Privacy Act must say in their privacy policy when a computer program makes, or substantially and directly helps make, decisions that could significantly affect someone, using their personal information. Most businesses with a turnover of A$3 million or less are not covered, but some are. Here is how to check, and what to add.
Check this first: does the Privacy Act cover your business?
The new rule only applies to businesses the Privacy Act already covers (the law calls them "APP entities"). Work through these in order:
- Is your annual turnover more than A$3 million? Then you are covered.
- A$3 million or less? According to the OAIC, most businesses this size are not covered, but there are exceptions. For example, health service providers (clinics, dentists, physios, chiropractors and similar) and businesses that trade in personal information are covered whatever their size. Check the full list on the OAIC small business page.
- Covered? Then look at the tools on your website (next section) and decide whether any of them make decisions about people.
Not covered? This rule doesn't apply to you, though a clear privacy policy still helps customers trust your site.
What changes on 10 December 2026
The Privacy and Other Legislation Amendment Act 2024, passed in December 2024, added APP 1.7 to 1.9. From 10 December 2026, your privacy policy must say if a computer program makes, or substantially and directly helps make, decisions that could significantly affect a person's rights or interests, using their personal information. OAIC media release
Which website tools might count.
The question is whether a program decides something that significantly affects a person, using their personal information. These are common website examples. The "probably not" column is our reading, not an official ruling.
Likely to count
- Automated finance or payment approvals, such as a buy-now-pay-later or credit check that approves or declines a customer.
- Automated booking or eligibility refusals, such as a booking system that turns people away based on their details.
- Fraud tools that block orders automatically, for example on a Shopify or WooCommerce checkout.
- Any tool that ranks or screens applicants, such as job or tenancy applications, before a person looks.
Probably not, on their own
- Plain visitor analytics, such as page view counts and traffic reports.
- Sending an email newsletter to people who signed up.
- A contact form that sends the enquiry to you, where a person replies.
- Spam filters on your own forms. If a tool decides who gets an offer, a booking or credit, look at it more closely.
If you're unsure whether a tool counts, the OAIC advises including it. If a plugin or app does the deciding, the business using it is generally responsible, so ask the vendor how it decides and what information it uses.
The 3 things your privacy policy must list.
According to the OAIC fact sheet, if you use a program this way your policy must describe:
1. The personal information used
The kinds of personal information the program uses, such as name, address, order history or payment details.
2. Decisions made by the program alone
The kinds of decisions the program makes with no person involved, such as automatically declining an order.
3. Decisions it substantially helps with
The kinds of decisions where the program does most of the work and a person signs off, such as a fraud score your staff act on.
- You don't have to reveal trade secrets or commercial-in-confidence details (OAIC fact sheet).
- You can likely group kinds of information together, but name sensitive information such as health or biometric details separately. This comes from one law firm's reading of the guidance (Corrs Chambers Westgarth), not from the OAIC directly.
- If in doubt, include it. That is the OAIC's own advice.
A second change is coming, but its start date is not yet known.
What is known
- The Children's Online Privacy Code must be registered by 10 December 2026, under the same 2024 Act.
- It covers social media and online services, including websites, that are likely to be used by children. OAIC: Children's Online Privacy Code
What is not yet known
- When businesses must follow it. As of 2 November 2026, no start date for businesses has been announced.
- If your site is likely to be used by children, watch the OAIC page above. We will update this page when a date is set.
This page is a plain summary, not legal advice. For advice on your own business, speak to a lawyer or read the OAIC guidance linked on this page.
Questions Australian owners ask.
Something else? Ask in the chat or email hello@penguina.website.
When does the automated-decision privacy policy rule start?
On 10 December 2026. From that date, businesses covered by the Privacy Act must say in their privacy policy if a computer program makes, or substantially and directly helps make, decisions that could significantly affect someone's rights or interests using their personal information. The rule is in APP 1.7 to 1.9, added by the Privacy and Other Legislation Amendment Act 2024.
Does it apply to my small business?
Only if your business is covered by the Privacy Act. According to the OAIC, most businesses with an annual turnover of A$3 million or less are not covered, but there are exceptions, for example health service providers and businesses that trade in personal information. Check the OAIC small business page for your situation.
My plugin or app makes the decision. Who is responsible?
Generally the business that uses the tool, not the company that makes it. Ask the vendor how the tool decides and what personal information it uses, so you can describe it in your privacy policy.
Do Google Analytics or my email newsletter count?
Probably not on their own. Plain visitor statistics and sending a newsletter don't usually make decisions that significantly affect a person. This is our reading, not an official ruling. If a tool decides who gets an offer, a booking or credit, look at it more closely. When in doubt, the OAIC advises including it.
When does the Children's Online Privacy Code start?
Not yet known. The code must be registered by 10 December 2026, but the date businesses must follow it has not been announced as of 2 November 2026.
Is this page legal advice?
No. It is a plain summary with links to the official pages. For advice on your own business, speak to a lawyer or read the OAIC guidance.
Related pages.
Sources for this page
- Office of the Australian Information Commissioner: new resources on transparency for use of AI and automated decision-making
- Office of the Australian Information Commissioner: APP 1.7 to 1.9 transparency obligation fact sheet (PDF)
- Office of the Australian Information Commissioner: Children's Online Privacy Code
- Office of the Australian Information Commissioner: small business
- Federal Register of Legislation: Privacy and Other Legislation Amendment Act 2024
- Corrs Chambers Westgarth: transparency in automated decision-making