New transparency obligations for automated decision-making take effect on 10 December 2026. Here is what they mean in practice, and a simple way to get ready.

What the rules require

Organisations covered by the Privacy Act must disclose in their privacy policy the kinds of personal information used, and the kinds of decisions made, by computer programs that significantly affect individuals’ rights or interests.

Where automated decisions hide

Credit and eligibility checks, applicant screening, pricing, fraud flags and chatbot triage are common examples. Some are built into software you bought rather than systems you built.

A three-step readiness plan

First, inventory where decisions are made or informed by software. Second, assess which are significant. Third, update your privacy policy and internal procedures, and make sure a person can review and explain outcomes.

This article is general information, not legal advice. Check current OAIC guidance and seek advice for your circumstances.