New Privacy Rules for AI: What Your Website Needs by 10 December

On 10 December 2026, a small but important change to the Privacy Act switches on. If your business is covered by the Act and uses AI or automation, fed by people’s personal information, to make or help make decisions that could significantly affect them (approving, declining, ranking or pricing them for things that matter), your privacy policy will need to say so. It is not a ban on AI, and it gives customers no new right to appeal. It is a transparency rule. Think of it like VAR: nobody is banning the technology, but the crowd gets to know when it made the call.

We have written about first steps with AI and agents that run whole jobs. This is the paperwork that now comes with them, plus a game plan for the weeks left before kick-off.

General information, not legal advice. Privacy law turns on your circumstances, so confirm the specifics for your business with the OAIC or a privacy lawyer.

The Short Version

The Privacy and Other Legislation Amendment Act 2024 became law on 10 December 2024. Most of it is already in force, but one part got a two-year runway: new Australian Privacy Principles 1.7 to 1.9, covering automated decisions. They start on 10 December 2026.

• Who: organisations covered by the Privacy Act (“APP entities”), generally businesses that have turned over more than $3 million in any year since 2002, plus some smaller ones.
• What: computer programs that make, or substantially help make, decisions that could significantly affect a person, using their personal information.
• The obligation: say so in your privacy policy.
• The catch: it covers decisions made from 10 December 2026, even if the tool was set up years earlier.

Does This Apply to Your Business?

For private businesses, being an APP entity generally means having turned over more than $3 million in any financial year since 2002 (or since the business started). Once you pass that mark, you stay covered even if turnover later drops. Smaller businesses are usually exempt, but the OAIC’s small business guidance lists those covered whatever their turnover, including:

• Health service providers holding health information, such as dental and medical practices, physios and allied health clinics.
• Businesses that trade in personal information (collecting or disclosing it for a benefit, service or advantage), unless they have consent or the law allows it.
• Contractors providing services under a Commonwealth contract, plus credit reporting bodies and residential tenancy database operators.
• AML/CTF reporting entities, for that work only. Since 1 July 2026, new anti-money laundering obligations have applied to real estate agents, accountants, lawyers, conveyancers and others, so small firms in those fields are now covered for their AML/CTF work.
• Businesses that have opted in, and small companies that belong to a larger corporate group.

Not sure where you sit? Settle that first. If you are clearly outside the Act, stick around: we explain why the inventory is still worth doing near the end.

What Counts as an Automated Decision?

Strip away the legal drafting and the law asks three questions. Three yeses and the tool belongs in your privacy policy.

1. Is a computer program making the decision, or doing something that is a key part of it? “Computer program” is read broadly: rule-based logic, machine learning and AI all count. The OAIC has said generative AI tools, including chatbots, fall within it. So can a humble spreadsheet formula.
2. Could the decision reasonably be expected to significantly affect someone’s rights or interests? The law’s examples: a benefit under legislation, rights under a contract, and access to a significant service or support. Good or bad effects both count, and so does saying no.
3. Is personal information about that person used?

The Explanatory Memorandum (the government’s official explainer), as quoted in the OAIC’s May 2026 consultation, gives a feel for “significant”: a life insurance contract, access to healthcare, a housing benefit. Targeted ads can qualify too, if they lead to different prices for significant goods or services or limit access to job opportunities. The effect must be more than trivial, and it can weigh more heavily on a child or someone experiencing vulnerability.

A human in the loop doesn’t automatically let you off the hook

If a program recommends or guides a human decision, it is still caught when its output is a key factor directly connected to the outcome. The OAIC’s September 2026 guidance says machine learning and generative AI outputs used in significant decisions will generally be in scope unless there is extensive human oversight and control. Its example: managers use a generative AI tool to suggest staff bonuses and pay rises, and even with HR oversight and director sign-off, the tool is caught because managers rely on it. If your team rarely overrides the tool, the tool is doing more of the deciding than the org chart suggests.

Bought it off the shelf? It’s still yours

The rule bites when a business has “arranged for” a program to make or help make decisions. The OAIC’s examples include buying another company’s AI to screen and rank job applications, and contracting software that automatically approves or declines refunds. The duty sits with the business using the tool, not the vendor hosting it. Your SaaS subscription is not a compliance hall pass.

Likely In, Grey Zone, Probably Out

On 30 September 2026 the OAIC published its guidance: an updated APP 1 chapter, a fact sheet and a flowchart. Our sorting below follows it, but guidance is not law, and when in doubt the OAIC says to disclose.

Likely in (if you are an APP entity)

• AI CV screening that ranks, shortlists or filters out job applicants.
• Finance, credit or insurance pre-approvals where software decides, or effectively decides, who is eligible.
• Healthcare intake and triage tools that automatically prioritise or decline patients. Worth noting for dental and medical practices, which are covered regardless of turnover.
• Chatbots that screen people out of finance, insurance, rental housing, jobs or healthcare. What counts is what the chatbot decides.
• Personalised pricing on essential or significant goods, such as prices set by postcode. The OAIC says this counts whether the price difference is small or large.
• Programmatic advertising for significant goods or services, and job ads targeted in ways that limit who gets to see them.

Grey zone (when in doubt, lean towards disclosing)

• Lead-qualifying chatbots. In June we described an agent that qualifies enquiries and politely redirects the rest. For a builder, that is sales triage. For a finance broker, the same bot may be deciding who gets a shot at credit.
• Automated quotes and eligibility checks. A price calculated from the job (square metres, materials) is one thing. A price or yes/no driven by the person’s own data (postcode, age, history) is closer to the line, and for an essential or significant service it moves into “likely in”.
• Fraud screening that blocks orders. Cancelling an order is a refusal, but whether blocking an ordinary purchase is significant is unsettled. If your payment provider runs the screening, who “arranged for” it matters too.

Probably out

These usually fall outside the rule:

• A chatbot that only answers questions or books open appointment slots.
• A spam filter on your contact form.
• Aggregate analytics.
• Simple calculations, like shipping by weight.
• “You might also like” recommendations on their own.

What Your Privacy Policy Must Actually Say

The new APP 1.8 asks for three things, all at the level of “kinds” rather than detail:

1. The kinds of personal information those programs use.
2. The kinds of decisions made solely by those programs.
3. The kinds of decisions where a program does something substantially and directly related to the decision, such as scoring or recommending for a person to sign off.

That’s it. No code or scoring weights (the OAIC’s guidance says commercial-in-confidence information, such as trade secrets, is excluded), no individual notices, and no new right to challenge the decision. It goes in your APP privacy policy, the one that should already be linked from your website footer.

For a business with an online finance pre-approval tool and AI-assisted recruitment, it might read something like this (an illustration, not a template):

• Decisions made automatically: our online pre-approval tool decides whether to offer you an indicative finance quote, based on the information you enter.
• Decisions where software helps our team: our recruitment software ranks job applications to help our hiring team choose who to interview.
• Information these programs use: contact details, income and employment details, credit history, and the work history and qualifications in your application.

Keep it short, clear and easy to find. A disclosure buried in dense legalese helps nobody, and the next round of reform is looking hard at exactly that. And if a tool uses sensitive information, such as health details, the OAIC says your policy should make that clear.

Your Game Plan Before 10 December

1. Confirm you are covered. Check turnover and the categories above. If you are part of a group, check the group.
2. Inventory every tool that touches personal information. Website chatbot, form logic, CRM lead scoring, booking and triage, recruitment software, payment and fraud tools, pricing apps, ad audiences, and the Zapier, Make or n8n flows joining them up.
3. Map data in, decision out. What personal information each tool uses, what it decides or recommends, and what happens to the person.
4. Sort each tool into the right list. Who sees the output, and how often do they override it? If nobody checks, it goes under decisions made automatically. If a person genuinely weighs it up, it goes under decisions where software helps your team. If the honest answer is “rarely”, the human check may be a formality, so flag it for your lawyer.
5. Update the privacy policy. Draft the three disclosures in plain English, have your privacy lawyer review them, and publish before 10 December. Make sure the policy is linked in your footer and near anywhere you collect personal information, such as enquiry forms and your chatbot. Check the wording against the OAIC’s September 2026 fact sheet.
6. Keep the inventory current. Make “update the AI register” part of switching on any new tool, and review it quarterly. The automation someone built in 2023 counts too.

One housekeeping tip while you are in there: stop staff pasting customer details into public AI tools, which the OAIC already advises against.

The Bigger Picture

The regulator can already fine privacy policy failures

Since 11 December 2024, the OAIC has been able to issue infringement notices (fine-style notices that don’t need a court case) for certain breaches, including having no privacy policy or one missing required content. From 10 December 2026, a missing automated decisions disclosure joins that list. At the current penalty unit of $364, a notice can be up to $21,840 per contravention for a company, $4,368 for an individual and $72,800 for a listed company. Court-imposed penalties go much higher. And the OAIC is looking: in December 2025 it announced a sweep of around 60 organisations’ privacy policies.

People can now sue for serious invasions of privacy

Since 10 June 2025, individuals can sue under a statutory tort for serious invasions of privacy, including misuse of information about them. The bar is high (serious, and intentional or reckless), but it isn’t limited to businesses over $3 million.

More reform is on the way

On 31 August 2026 the Attorney-General’s Department released an exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 for consultation, which closed on 18 September. Of its roughly 40 proposals, the ones most likely to reach a small or medium business are a fair and reasonable test for handling personal information, a stricter definition of consent, consent before trading personal information, direct marketing rules covering targeted ads, and 72-hour data breach notification to the OAIC.

It is a draft only, with no start dates, and no new automated decision rights. The Attorney-General has said she hopes to introduce the Bill this year. One point from the consultation paper deserves a spot on the dressing room wall: a practice isn’t reasonably expected just because your privacy policy describes it. Disclosure is the minimum, not a shield.

The small business exemption: on the list, not on the calendar

In 2023 the government agreed in principle to remove the exemption, but only after an impact analysis, support for small businesses, a proportionate way to comply and a transition period. There is no confirmed date, and neither the 2024 Act nor the 2026 draft removes it. One draft change to watch: a broader definition of “trading” personal information that could catch small businesses sharing customer data for ad targeting without consent. That is a proposal, not law.

Not Covered Yet? Do the Inventory Anyway

Outside the Act? 10 December isn’t your legal deadline, but the inventory still pays off.

• Customer trust. People notice when a machine says no. Telling them upfront, and labelling your chatbot as AI (as the OAIC already recommends), shows you have nothing to hide.
• Future-proofing. Removing the exemption is agreed in principle, the trading definition may widen, and a single year past $3 million brings you into the Act for good.
• It is cheap now. Documenting five tools takes an afternoon. Untangling twenty undocumented automations against a deadline does not.

Where Hooray Fits

We build AI chatbots and automations, so we know what is under the hood. We can map each tool that touches personal information: the data it uses, what it decides or recommends, and where a human steps in. Your lawyer gets a plain-English inventory instead of billing hours to reverse-engineer your tech stack.

We are not lawyers and we don’t give legal advice. We draw the technical map; your lawyer makes the legal call. Every AI agent and automation we build comes documented from day one, and if your site needs a refresh so policies and AI labels are easy to find, our web design team has you covered.

The Final Whistle

The 10 December rule is modest: a few honest paragraphs about how your tools make decisions. Do the inventory, have your lawyer check the wording, publish it, and keep it current. Then get back to the fun part: putting AI to work.

One more time for the back row: this is general information, not legal advice. Confirm the specifics with the OAIC or a privacy lawyer.

Keep Reading

June 2026

From Chatbot to Employee: What AI Agents Actually Do for a Small Business in 2026

February 2026

How Do I Use AI in My Business?

August 2026

When the Customer Is a Robot: Getting Your Online Store Ready for AI Shopping Agents