New AI Privacy Rule from 10 December 2026: What Aussie Businesses Need to Know
From 10 December 2026, a new rule under Australia's Privacy Act starts. If your business uses software, including AI, to make or help make important decisions about people, your privacy policy has to say so. Here's what that means in plain English. (This is general information, not legal advice. Talk to your lawyer or adviser about your situation.)
What's changing?
New Australian Privacy Principles, APP 1.7 to 1.9, were added by the Privacy and Other Legislation Amendment Act 2024. From 10 December 2026, an organisation covered by the Privacy Act must update its privacy policy if it arranges for a computer program to use personal information to make a decision, or do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect someone's rights or interests.
If that applies, the privacy policy needs to describe:
the kinds of personal information the program uses
the kinds of decisions made solely by the program
the kinds of decisions where the program does something substantially and directly related to a decision a person makes
The Office of the Australian Information Commissioner (OAIC) released its guidance on the new obligation on 30 September 2026. It's a transparency rule: it's about telling people, not banning the technology.
Does it apply to my business?
It applies to "APP entities", the organisations covered by the Privacy Act. Generally that means businesses with an annual turnover above $3 million, plus some smaller businesses that are covered regardless, such as health service providers and businesses that trade in personal information. If you're not sure whether you're covered, check with your adviser or the OAIC website.
Even if you're not covered, being upfront about how you use AI builds trust with customers. It's good practice either way.
What counts as a "significant" decision?
The OAIC's examples include decisions about access to a benefit or a significant service, decisions affecting contract rights, and even everyday things like whether someone gets a job interview. Examples in a small business might include:
Software that automatically approves or declines finance, credit or payment plans
AI that screens job applicants and decides who gets an interview
Systems that automatically set pricing, cover or eligibility for an individual
Using ChatGPT to write a Facebook post isn't the target here. The rule is about decisions that affect people.
What should you do before 10 December?
List your software that makes or informs decisions about people. Include tools from vendors. Using someone else's software doesn't hand the obligation to them.
Work out which decisions could significantly affect someone.
Update your privacy policy to describe those uses in plain English.
Check your AI tool settings and contracts so you know what data goes where.
Get advice if you're unsure, especially in finance, insurance, health, HR or property.
The bottom line
Most small businesses using AI for writing, marketing and admin won't be heavily affected. But if software helps decide things about your customers or staff, now is the time to review your privacy policy. Being clear about how you use AI is quickly becoming the standard customers expect.
Want it set up for you?
If you'd rather skip the learning curve, we can set this up in your business: the right tools, trained on how you work, plus automations that save hours every week. Book a free 20-minute AI chat.
New to all this? Grab the free list of 10 AI tools I'd set up first in any small business, each with a 10-minute first win.
