Blog

From 10 December 2026, Australian businesses will need to disclose in their privacy policy when personal information is used in automated decision-making that could reasonably be expected to significantly affect an individual.  If your business uses any kind of algorithm to personalise offers, assess creditworthiness, flag suspicious transactions, or influence pricing, this reform likely applies to you — and most privacy policies currently in use haven’t been updated to address it.  The obligation sits with APP entities, so it generally captures businesses with an annual turnover above $3 million, along with some smaller businesses that are covered for other reasons (such as health service providers and credit reporting bodies).

What Counts as “Automated Decision-Making”?

The new requirement — inserted into the Privacy Act 1988 (Cth) as APP 1.7 to 1.9 by the Privacy and Other Legislation Amendment Act 2024 (Cth) — covers decisions made solely by a computer program, or decisions where a computer program does something substantially and directly related to making the decision, where that decision could reasonably be expected to significantly affect an individual’s rights or interests.  For retail and e-commerce businesses, that’s a broader net than it might first appear:

• Fraud detection systems that flag or decline transactions automatically
• Recommendation and personalisation engines that adjust pricing, offers, or availability shown to individual customers
• Automated credit or “buy now, pay later” assessments used at checkout
• Loyalty program tiering or eligibility decisions driven by algorithmic scoring rather than a human reviewer

What Does the Privacy Policy Actually Need to Say?

At a minimum, the disclosure needs to cover:

• The kinds of personal information used in the operation of the automated decision-making
• The kinds of decisions made solely by the operation of a computer program
• The kinds of decisions where a computer program does something substantially and directly related to making the decision, even where a person makes the final call

It’s worth being clear about what this reform doesn’t do: unlike the EU’s GDPR, it’s a transparency obligation only — it doesn’t give individuals a standalone right to demand an explanation of a specific decision or to formally contest it.  That said, being able to explain your systems clearly matters for customer trust as much as compliance, particularly as awareness of AI-driven decisions grows.  The OAIC has yet to release detailed guidance on what these disclosures need to contain, but it has signalled that detailed guidance will be published during 2026, so a policy drafted now may need a second look once that guidance lands.

Why Is This Being Introduced Now?

It’s part of the broader wave of Privacy Act reform that’s been rolling out in recent years, which already introduced stronger enforcement powers for the Privacy Commissioner and tightened expectations around “reasonable steps” to protect personal information.  The automated decision-making disclosure requirement is a natural extension of that trend — regulators are increasingly focused on the fact that decisions affecting consumers are made by systems, not people, and consumers have a right to know when that’s happening.  It also has teeth: the OAIC’s infringement notice and compliance notice powers extend to a privacy policy that doesn’t meet the new disclosure requirements, and civil penalties are available for serious or repeated failures.

What Should You Do Between Now and 10 December 2026?

• Map where automated decision-making actually happens in your business — this often involves talking to your web development or platform provider, since businesses don’t always realise which parts of their checkout or CRM system make automated calls.
• Update your privacy policy to include the required disclosures, rather than leaving it to the last minute in December.
• Check third-party tools and plugins — if a plug-in handles fraud scoring, dynamic pricing, or personalisation on your behalf, you’ll need to understand and disclose what it does, even though you didn’t build it yourself.
• Brief customer service staff on how to respond if a customer asks about an automated decision that affected them.

A privacy policy that hasn’t been touched in a while is a common gap we see in retail and e-commerce businesses — this reform is a good prompt to review the whole document, not just bolt on a new clause.

If you’d like your privacy policy reviewed ahead of the December 2026 deadline, get in touch with Gladwin Legal — we can identify where automated decision-making applies in your business and update your policy accordingly.

This article is general information only and does not constitute legal advice.