Privacy Act, 10 December: even a spreadsheet can be caught

From 10 December, a business covered by the Privacy Act must say in its privacy policy when software makes, or substantially shapes, significant decisions about people. The regulator's first worked example is a spreadsheet formula that scores and ranks people for medical and aged care support (OAIC fact sheet, 2026).

It's a transparency rule and nothing more: one section of a privacy policy, with no ban on automation and no new right to contest a decision (Allens, 2026). It isn't only about AI, either. The law never mentions AI, and that spreadsheet is caught because of what it decides: who gets offered care.

So the work is finding the decisions software makes or feeds about people, including ones nobody calls a system, then judging which are significant. The wording comes last, and it's short.

If your business turned over $3 million or less last financial year, you're probably not covered. The draft of the next privacy reforms, out in late August, leaves the small business exemption alone (Gadens, 2026).

Some small businesses are covered anyway: health service providers, businesses that trade in personal information, credit reporting bodies and small companies in a bigger group. Commonwealth contractors are covered for their contract work (Privacy Act 1988).

Once you've passed $3 million in any year since you started, you stay covered even if turnover falls.

This is my reading of the law, and it isn't legal advice.

What the 10 December privacy rule asks for

The date's written into the Act, so nothing else has to happen first (Privacy and Other Legislation Amendment Act 2024). It'll also apply to systems and data you already have.

The new rule, Australian Privacy Principle 1.7 (APP 1.7), applies when three things are true:

• You've arranged for a computer program to make a decision, or to do something "substantially and directly related to making" one.
• The decision "could reasonably be expected to significantly affect the rights or interests of an individual".
• Personal information about that person goes into it.

The OAIC, the federal privacy regulator, reads "computer program" wide, from rule-based processes to chatbots and generative AI (OAIC guidelines, 2026). "Significantly" means "more than trivial".

Human sign-off alone isn't an exit. AI outputs used in significant decisions are generally in scope "unless subject to extensive human oversight and control", the OAIC's fact sheet says.

Xero's policy, updated on 26 October, spells this out for its sanctions screening. A person reviews the result, but "The tool's result is a key factor in that decision" (Xero, 2026).

What goes in the policy isn't long: what types of personal information go in, which decisions software makes alone and which it substantially helps make. You don't publish the algorithm. Confidential business details can stay out, but the OAIC says embarrassment doesn't make something confidential.

Which tools are caught: pricing, hiring, credit and fraud

The OAIC's examples run from border control to everyday business software. The business ones include credit approvals, insurance eligibility, recruitment software that sorts candidates, and online retailers' personalised pricing "in the sale of significant goods". Fraud tools that block accounts or transactions can be in too, and so can suspending accounts people rely on.

In one example, postcode pricing costs a shopper $132 extra over a year on baby formula. The OAIC calls that significant "regardless of whether the price difference is small or large", because it affects access to essentials like food and medication.

Grey areas remain. On targeted ads beyond jobs and essentials, law firm Allens says the guidance leaves open "where the line sits for targeted advertising generally."

That corrects something I wrote here a year ago, when I put recommendation engines and conversion optimisation in the automated decision bucket. Under the final guidance, generic product recommendations probably don't belong there, unless they change prices or access for essentials, or limit access to jobs.

Related Article37 min read

Privacy Act 2025: How AI Website Analytics Affect Australian Business Compliance

The Privacy Act 2025 overhaul slashes penalties, adds statutory torts, and forces new APP disclosures on AI analytics stacks before the OAIC demands...

Read full article

The case against bothering: nobody reads privacy policies. In the OAIC's 2026 survey, 69% always or often agree to one without reading most or all of it (OAIC survey, 2026). But 91% back a right to be told when automated decisions use their information, and you'll need the list anyway.

Penalties: $21,840 a notice, and whether anyone's checking

On 10 December, APP 1.7 joins the rules that can draw an infringement notice, a fixed penalty (Privacy and Other Legislation Amendment Act 2024). At the current $364 penalty unit, that's $21,840 per contravention for a company (Privacy Act 1988; ASIC, 2026). It's $4,368 for an individual and $72,800, or 200 penalty units, for a listed company.

The OAIC has shown it'll read privacy policies without waiting for a complaint. Its January sweep checked the policies of about 60 businesses that collect information in person (OAIC, 2025). Privacy Commissioner Carly Kind said it "found instances of non-compliance in a significant proportion" (OAIC, 2026).

Notices aren't automatic, though. The OAIC's own guide says it's less likely to issue one where "a complex assessment of facts" is needed, and judging significance can be exactly that (OAIC, 2026).

On 30 October we checked 50 large Australian organisations' privacy policies, and about half blocked our automated tools. Of the roughly 25 we could read, three had a section like the one APP 1.7 asks for: Telstra, hummgroup and Xero. It's a snapshot, not a verdict.

Related Article5 min read

The Digital Duty of Care bill reaches services that generate material using AI. That's the chatbot on your website. Here's what it would owe.

The Digital Duty of Care bill passed the House on 28 October. Its list of online services takes in websites and AI services, with no size threshold.

Read full article

Five steps before 10 December

1. List decisions, not tools. Every approval, refusal, price, ranking or suspension that touches a person, including spreadsheets, vendor features and staff using chat tools.
2. Ask the significance question. Could the outcome considerably change someone's access to money, work, housing, health care or essentials? Does a person really weigh the result, or just sign it off? If you're unsure, the OAIC says to "take a cautious approach" and disclose.
3. Write to your vendors. It's still your obligation, so ask what their software decides and what personal information it uses.
4. Copy the OAIC's shape. A heading, a list of kinds of personal information, a list of kinds of decisions. Law firm Corrs warns: "Generic, high-level transparency statements will not be sufficient to satisfy the obligation."
5. Say so if nothing qualifies. Law firm Maddocks suggests stating it expressly (Maddocks, 2026). If something qualifies, update your collection notices to match.

This week, ask whoever runs your CRM, pricing and HR tools one question: which of them score, rank or filter people? Their answer is the first draft of your list.

---