How to Update Your Privacy Policy for Automated Decision-Making (2026)

If you use ChatGPT to answer customer emails, a Shopify app that flags risky orders, or even a spreadsheet that scores your leads, a new rule is about to land on your desk. From 10 December 2026, your automated decision-making privacy policy has to tell people when a computer program helps make decisions about them. It’s a change to Australian Privacy Principle 1, and everyone is calling it the “AI privacy rule. That’s the first thing it gets wrong.

This rule barely cares whether you use AI. It cares whether a computer program, any program, helps decide something about a customer. Most small business owners hear “automated decision-making”, picture big tech, and assume it skips them. Then they miss half their own tech stack, and the deadline doesn’t care how small you are.

What counts as automated decision-making?

It counts when you have arranged for a computer program to make, or to do something substantially and directly related to making, a decision that uses someone’s personal information. The key words are “computer program”, not “artificial intelligence”. That’s a much wider net than most people expect.

In practice, that pulls in a lot of ordinary business tools:

• Rule-based tools. If-this-then-that logic in your CRM, booking or billing system. A rule that auto-declines a customer type is making a call for you.
• Scoring spreadsheets. A sheet with formulas that ranks or flags customers. The regulator has specifically called spreadsheets out.
• Machine-learning models. Anything predicting risk, churn or fraud.
• Generative AI. Tools that screen, summarise or recommend an outcome.
• Licensed vendor software. A tool you bought still counts if you arranged to use it. You can’t point at the vendor and call it their system.

So the honest first question isn’t “do we use AI?”. It’s “where does any program touch a decision about a customer?”. That list is usually longer than you think.

In a recent Lawpath webinar on the changes, commercial lawyer Sahil Bhandula put it bluntly:

Does my tool count? Run the four-part test

Run every tool through four questions. If all four are yes, you disclose it. If one is clearly no, you probably have your answer, though it’s worth writing down why.

1. Have you arranged for a computer program to be used?
2. Does it use personal information, meaning anything that identifies someone?
3. Does it make, or substantially and directly shape, a decision?
4. Could that decision significantly affect someone’s rights or interests?

Pressure-test it against real tools. An online lender that auto-approves applications is clearly in scope. A tool that ranks rental applications is likely in scope if the ranking really decides who gets the property and the human just confirms it. A website that auto-sorts enquiries into folders is probably fine, because nobody is worse off for landing in a different inbox. A fraud tool that freezes an account is in scope, because cutting off access is a real consequence for a real person.

Solely automated or substantially shaped? The part people miss

Both are caught, and your policy has to deal with both. The one everyone forgets is the second.

Type	What it means	Example
Solely automated	No human makes the final call	An application approved or declined instantly online
Substantially and directly shaped	A human decides, but leans heavily on the program’s output	Staff follow a risk score almost every time

The test for the in-between tools is blunt: how often do your people actually overrule it? If the answer is “almost never”, treat it as shaping the decision and disclose it. “We always have a human review it” isn’t the shield owners think it is.

The regulator’s own example makes the point. A business uses a generative AI tool to suggest staff bonuses. HR reviews it, a director approves it, two layers of human sign-off. Still in scope, unless those humans genuinely interrogate the output: question the numbers, check the inputs, push back when something looks off, and document why. Click “approve” on whatever the tool suggested and the tool shaped the decision.

When is a decision “significant”?

“Significant” means more than trivial. The decision has to have real potential to considerably influence someone’s circumstances or the outcome they get. You’re looking for decisions that touch:

• Legal or benefit entitlements under an act or scheme.
• Contract rights: approving, declining, changing or ending credit, insurance or a lease.
• Access to significant services, such as healthcare.
• Personalised pricing, interest rates or payment terms that change what someone actually pays.
• Account access: suspending, restricting or closing an account.
• Screening that filters out applicants or customers before a person sees them.

Don’t assume “significant” means life-changing. In the OAIC’s guidance, a business that varied its pricing by postcode, working out to about 132 dollars a year more for one area, was enough to be significant. The guidance is still settling, so the edges will move. But a 132-dollar gap clearing the bar tells you where that bar sits. Low.

Pay attention to the screening case. When a tool filters someone out, the person who got filtered never knows a decision was made. It’s invisible, and it’s exactly the kind of thing the rule is built to surface.

Does this apply to my small business?

These rules apply to businesses already covered by the Privacy Act 1988 (Cth). Many small businesses with annual turnover of 3 million dollars or less are currently exempt. The catch is the exceptions, and they catch more people than owners expect.

• Turnover over 3 million dollars: covered.
• You provide a health service: covered regardless of turnover. That includes a small physio clinic, an allied health practice, a psychologist, even a gym offering health services.
• You trade in personal information: covered.
• You’re an AML/CTF reporting entity: covered for the information you handle for those purposes.
• You work under a Commonwealth contract or have opted in: covered.

One more thing worth knowing: the small business exemption itself is under review and may be removed in future reform. A current privacy policy is worth having from day one anyway, because your customers want to know what you collect and what you do with it.

What does your privacy policy actually have to say?

Once a tool is in scope, your policy needs to cover three things:

1. What customer information the tool uses, like names, email addresses or payment details.
2. The decisions it makes completely on its own, with nobody checking (the “solely automated” ones).
3. The decisions it mostly drives, even when a staff member clicks approve at the end (the “substantially shaped” ones).

What it doesn’t need is just as useful to know. You don’t have to hand over your algorithm or decision logic, publish a trade secret, list every individual tool, or write a separate document. It sits inside your current policy.

Here is the pattern filled in for a small online lender, so you can see how little it takes:

Tool	Personal information used	Solely automated or shaped?
Loan application engine	Income, employment, credit history	Solely automated (approves or declines)
Fraud checks	Device, location, transaction history	Solely automated (blocks suspicious payments)
Credit limit model	Repayment history, income	Substantially shaped (staff set the limit on its recommendation)
Hardship triage	Contact and payment history	Substantially shaped (flags who gets priority review)

You don’t need to publish it as a table. Write it in plain English. “We may use your data” is too vague to meet the principle. Name the data, name the decision, and keep it honest: “Our system reviews purchase and return history and automatically refuses returns that match fraud patterns” is a complete disclosure in one sentence.

Where does the automated decisions section go?

Inside your existing privacy policy, not a new one. Add a clearly labelled section, something like “How we use automated decisions”, so it’s easy to find. Group the disclosures by kind of decision, not by every tool. Then keep it consistent with the rest of the policy and with what you actually do. If your collection notice says one thing and this section says another, that gap is the problem.

You can draft this yourself in minutes with a free privacy policy template and add the automated decisions section to it.

How do you get ready before 10 December 2026?

Work backwards from the deadline.

1. Map every tool that uses customer data. For each, ask what it decides or recommends, who it affects, how often staff override it, and what happens if it gets it wrong.
2. Apply the four-part test and sort tools into in scope and out of scope. Write down your reasoning for the close calls.
3. Draft the three disclosures inside your existing policy.
4. Align your collection notice so it says the same thing.
5. Get a legal review. One check buys you confidence before it goes in front of customers.
6. Publish before 10 December, and re-check whenever you switch on a new tool.

For some businesses this is eight weeks of work. For others it’s eight minutes. Either way, the trap is leaving it to December, when you’re rushing and start missing tools.

What the rules do not require

This is the reassuring part, and it’s easy to miss under the noise. The obligation is about transparency. You tell people what your tools do. How you decide stays your call.

• It doesn’t give people a right to contest your decisions, at least not yet.
• It doesn’t require a human to review every decision.
• It doesn’t make you explain the logic behind your decisions.
• It doesn’t stop you using automation. Keep running every tool you have.

Everything else that already applied still applies. You can’t mislead people under Australian Consumer Law, a tool that discriminates is still unlawful whether disclosed or not, and the other privacy principles about keeping data accurate and secure don’t change. For most owners this is a writing exercise, not an engineering one.

What happens if you ignore it?

The OAIC’s guidance makes clear the regulator can issue infringement notices for privacy policy deficiencies under APP 1, on top of its broader powers to issue compliance notices and pursue civil penalties for serious or repeated interference with privacy. It has also run proactive privacy policy reviews rather than waiting for complaints.

The cost that’s hardest to measure is trust. When a gap becomes public and people are already nervous about how their data is used, not being upfront about your automation is a bad look, and it tends to outlast any fine.

You’re not behind on this. Most businesses haven’t started, the fix is mostly writing, and you still have time if you begin the inventory this week. The one thing to do next is list your tools. Once you can see them, draft your privacy policy on Lawpath and have one of our lawyers check it before 10 December, so it’s sorted in one place and off your plate.

Frequently asked questions

When do the new automated decision-making rules start?

They start on 10 December 2026, under APP 1. There’s no phase-in and no grace period, so your privacy policy needs to be ready from that date.

Does the rule only apply to AI?

No. It applies to any computer program, including rule-based tools, scoring spreadsheets, CRMs and licensed vendor software. AI is only one part of it.

Does a human sign-off take my tool out of scope?

Not on its own. If staff follow the tool’s output almost every time, it’s substantially shaping the decision and must be disclosed. A human only takes it out of scope if they genuinely interrogate and can overrule the output.

Does this apply if I turn over under 3 million dollars?

It depends. Many small businesses are exempt, but exceptions cover health service providers, businesses that trade in personal information, AML/CTF reporting entities and others, regardless of turnover. Check the exceptions before assuming you’re out.

Do I need a separate automated decisions policy?

No. The disclosures sit inside your existing privacy policy. Add a clearly labelled section and group the decisions by kind.

Is a scoring spreadsheet automated decision-making?

It can be. If a spreadsheet uses personal information to rank, rate or flag people and that feeds a significant decision, it counts. The regulator has specifically pointed to spreadsheets.

Does a tool I built years ago still count?

Yes. There’s no grandfathering. If the tool is still making or shaping decisions after 10 December 2026, its age is irrelevant.

Do these rules stop me using automation?

No. You can keep running every tool you have. You just have to be transparent in your privacy policy about the automated decisions that affect people.