The Privacy and Other Legislation Amendment Act 2024 introduced comprehensive transparency obligations for automated decision-making across Australia. Organisations regulated under the Australian Privacy Principles (APP entities) will be required to explain within their publicly available privacy policies when automated computer programs make—or substantially facilitate—decisions that significantly impact individuals.
This plain-English guide explains the legal mechanism, clarifies which routine automations are caught (versus those that remain unaffected), and provides a pragmatic compliance checklist to future-proof your tech stack well in advance of the deadline.
1. What Changes on 10 December 2026?
The new legislation introduces statutory transparency requirements targeting automated decision-making (ADM). If an organisation deploys computer programs or artificial intelligence systems that impact customers, the organisation can no longer operate those algorithms as opaque black boxes.
The Three-Part Statutory Test
An automated process falls within the mandatory disclosure regime when all three conditions are met:
- Personal Information is Used: The system processes data relating to an identified or reasonably identifiable individual.
- Computer-Driven Decision Making: A computer program makes the decision, or substantially facilitates the decision-making process.
- Significant Effect: The outcome significantly impacts an individual's rights, legal entitlements, financial interests, or access to essential services.
What Your Privacy Policy Must State
Under the amended APP 1.4 requirements, covered organisations must explicitly detail:
- The specific kinds of personal information utilised in automated decisions.
- The specific kinds of automated decisions made or substantially facilitated by computer programs.
- How individuals can seek review, clarification, or human reconsideration of automated determinations.
2. Does This Apply to My Business?
The mandate applies strictly to APP entities under the Privacy Act 1988 (Cth):
- Businesses with Turnover > $3 Million: Automatically classified as APP entities and fully subject to the 10 December 2026 rules.
- Small Business Exemption (< $3M Turnover): While general small businesses remain exempt, crucial statutory exceptions apply:
- Private health service providers (allied health, medical clinics, psychologists).
- Businesses that trade in personal information (buying or selling customer lists).
- Contractors providing services under a Commonwealth contract.
- Credit reporting and residential tenancy databases.
3. Which Automations Are Likely Caught?
Not all automation triggers mandatory disclosure. Routine administrative efficiency tools (such as sending a calendar booking confirmation or auto-acknowledging an enquiry) do not "significantly affect" legal or financial rights. The table below outlines common business automations:
| Automation Type | Significantly Affects Rights or Interests? | Likely Disclosure Needed? |
|---|---|---|
| Auto-reply to website enquiry | Unlikely | Unlikely (Administrative triage) |
| AI Voice/Chat calendar booking | Unlikely | Unlikely (Administrative scheduling) |
| AI Lead Score deciding callback priority | Possibly (if denying service) | Review with your adviser |
| Automatic loan, tenancy or insurance decline | Likely | Likely (Mandatory disclosure) |
| Dynamic automated pricing or eligibility vetting | Possibly or likely | Review with your legal counsel |
The "Failure to Decide" Principle
Crucially, under Australian administrative law principles, "refusing or failing to make a decision" also constitutes a decision. If an algorithm automatically filters out an applicant or silently rejects a qualified lead from human review based on personal characteristics, this can trigger compliance scrutiny.
4. Data Sovereignty & Where Your CRM Stores Data
Automated decision-making frequently relies on cloud platforms (such as GoHighLevel, HubSpot, or AWS). When Australian personal information is stored or processed overseas, Australian Privacy Principle 8 (Cross-Border Disclosure) requires Australian entities to take reasonable steps to ensure the overseas recipient does not breach the APPs.
Questions to ask your software and AI vendors:
- Are our customer databases hosted within Australian data centres (e.g., AWS Sydney region / ap-southeast-2)?
- Does the AI model use our customer data for foundational model training, or is data processing zero-retention?
- Is there an end-to-end Data Processing Agreement (DPA) incorporating Australian standard contractual clauses?
5. The Often Forgotten Law: Spam Act 2003
While preparing for Privacy Act amendments, Australian businesses frequently overlook the Spam Act 2003 (Cth), vigorously enforced by the Australian Communications and Media Authority (ACMA).
Any automated lead nurture, SMS follow-up, or email sequence must comply with the three immutable pillars:
- Consent: Express or inferred consent must be provable and timestamped in your CRM.
- Identity: Clear, unambiguous sender identification (your legal business name and contact).
- Unsubscribe: A functional, frictionless opt-out mechanism (e.g., "Reply STOP" in SMS) that is honoured within 5 business days.
Pragmatic 7-Step Preparation Checklist (Pre-December 2026)
- Audit Automated Data Flows: Map every automated sequence, workflow, and AI prompt that processes customer personal data.
- Flag Decision Gates: Highlight any automated logic that approves, rejects, discounts, or prioritises individuals.
- Document Input Variables: Record exactly what data points (income, location, lead score, credit signals) feed each algorithm.
- Update Privacy Policies: Work with an Australian privacy solicitor to draft precise disclosure clauses under APP 1.4.
- Engineer Human-in-the-Loop (HITL) Fallbacks: Ensure high-stakes automated flags route to an Australian human manager for qualitative review before adverse actions occur.
- Timestamp Explicit Marketing Consent: Ensure CRM forms record checkbox consents, IP addresses, and opt-in timestamps.
- Verify Cloud Data Residency: Confirm your CRM and AI voice providers store data in Australian sovereign server regions.
Frequently Asked Questions
When does the automated decision-making rule start?
The transparency obligations under the Privacy and Other Legislation Amendment Act 2024 take effect on 10 December 2026.
Does it apply to small businesses under $3M turnover?
While general small businesses under $3M turnover are exempt, important exceptions apply, including private health service providers, credit reporting participants, and businesses trading in personal data. Furthermore, larger supply chain partners increasingly require small vendor compliance.
Do simple chatbots or voice receptionists need disclosure?
Only if they make, or substantially help make, decisions that significantly affect rights or interests. A receptionist bot taking a message or booking an appointment generally does not require disclosure, but disclosing that the caller is speaking with an AI assistant remains recommended industry best practice.
What are the penalties for non-compliance?
The OAIC has statutory enforcement powers including formal determinations, enforceable undertakings, and civil penalties for serious or repeated privacy interferences.
Audit Your AI & CRM Architecture Today
Ensure your automation infrastructure is fast, profitable, and fully compliant with Australian privacy and spam regulations. Book a direct Strategy Call with Dr. Priya Jaganathan.
Book Your Compliance & AI Audit