10 December 2026 · Australian Privacy Principle changes
From 10 December, your privacy policy has to name every system that makes or shapes a decision about a client. Two short documents explain what changes, what has to be done before the date, and what it takes to have it done for you.
The Privacy and Other Legislation Amendment Act 2024 added three new requirements to Australian Privacy Principle 1. From 10 December 2026, if your organisation uses a computer program to make a decision that could significantly affect a person, or to substantially shape one, your privacy policy must say what personal information the program uses, which decisions it makes on its own, and which it substantially contributes to.
That covers intake and eligibility tools, rostering, incident triage, recruitment screening, AI note-takers and any spreadsheet with a formula that decides who gets what. A provider that thinks it has ten such systems usually has 25 or 30. A privacy policy that does not comply is a breach the OAIC can act on without going to court.
Governance Works · Liability limited by a scheme approved under Professional Standards Legislation. General information, not legal advice.
Two short PDFs, written for a CEO or Board. Emailed straight away.
We'll email both PDFs straight away. Tick the second box if you'd also like The Guardrail, our short weekly note on AI regulation; it's optional, and every issue has an unsubscribe link. No phone calls unless you ask for one.