Does your business use software that makes decisions about people?

From 10 December 2026, every business covered by the Privacy Act must explain in its privacy policy where it uses a computer program to make decisions about people. The change comes from the Privacy and Other Legislation Amendment Act 2024, which gave businesses two years to prepare.

Which decisions your privacy policy has to cover

The rule covers decisions that could significantly affect a person, such as whether they get a rental, a loan, insurance, a job or a service. It applies when software makes the decision itself, and when it produces a score or ranking that a person then follows.

The program does not have to be AI. Spreadsheet formulas and rule-based software count, and so do tools where a person signs off but usually follows the result.

Where small businesses use these programs

• Tenant application tools that score or rank applicants

• Identity verification services that pass or fail a buyer, seller or new client

• Credit checks that set payment terms or decline a customer automatically

• Recruitment software that screens applications before anyone reads them

• Quote and pricing tools that decline a customer or set their price

Most firms find two or three. In the Tranquillity Realty story, the identity verification tool that can stop a vendor from being signed up is one, and so is the rental application platform if it ranks applicants.

What your privacy policy has to say about these programs

The policy has to describe the kinds of personal information these programs use, the kinds of decisions a program makes on its own, and the kinds of decisions where a program does something substantially and directly related to the outcome. A plain description of each tool and what it decides is enough, and the policy can leave out how the software works.

How to prepare before 10 December

List the tools that make decisions about people. Include any software, formula or vendor service that scores, flags, approves or declines a person, and ask each vendor what it decides and on what information.

Decide which ones significantly affect someone. A tool that sorts newsletter subscribers is unlikely to qualify. A tool that declines a rental application or a new client is the kind of decision the rule is aimed at.

Update the privacy policy. Add the disclosure and check the rest of the policy at the same time. A template from a few years ago is unlikely to meet the current wording.

Get help updating your privacy policy

If you want help listing your tools or updating your policy before 10 December, get in touch. Cyber People supports Sunshine Coast businesses on site, and Australian businesses remotely.

General information only. Not legal advice. Confirm your own obligations with your advisers.

Sources: Privacy Act 1988 (Cth), Australian Privacy Principle 1.7 to 1.9, as amended by the Privacy and Other Legislation Amendment Act 2024; Office of the Australian Information Commissioner, automated decision-making transparency guidance (September 2026).