--- title: "Automated Decision-Making Privacy Rules 10 Dec 2026 | StartCloud" description: "From 10 December 2026 Australian privacy policies must disclose significant automated and AI-driven decisions. Who it covers, what to write, and the myth doing the rounds." lang: en json-ld: | [ { "@context": "https://schema.org", "@type": [ "LocalBusiness", "ProfessionalService" ], "@id": "https://startcloud.au/#business", "name": "StartCloud", "legalName": "Start Technologies Pty Ltd", "alternateName": "StartCloud Australia", "identifier": { "@type": "PropertyValue", "propertyID": "ABN", "value": "17 676 121 449" }, "slogan": "Go Beyond", "description": "StartCloud is Perth's cybersecurity-first AI MSP: managed IT, Essential Eight security, Microsoft 365 and cloud, networking, and practical AI for Australian businesses with 5 to 50 staff.", "url": "https://startcloud.au", "logo": "https://startcloud.au/og-image.png", "image": "https://startcloud.au/og-image.png", "telephone": "+61862850001", "email": "web@startcloud.com.au", "priceRange": "$$", "currenciesAccepted": "AUD", "paymentAccepted": "Invoice", "foundingDate": "2023", "contactPoint": { "@type": "ContactPoint", "telephone": "+61862850001", "contactType": "customer service", "areaServed": "AU", "availableLanguage": "English" }, "address": { "@type": "PostalAddress", "streetAddress": "Ground Floor West, 6 Gibberd Road", "addressLocality": "Balcatta", "addressRegion": "WA", "postalCode": "6021", "addressCountry": "AU" }, "geo": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday" ], "opens": "07:00", "closes": "16:30", "description": "General support hours" }, { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday" ], "opens": "00:00", "closes": "23:59", "description": "Security Operations Centre (SOC) with 24/7/365 threat monitoring" } ], "areaServed": [ { "@type": "City", "name": "Perth" }, { "@type": "State", "name": "Western Australia" }, { "@type": "Country", "name": "Australia" } ], "serviceArea": { "@type": "GeoCircle", "geoMidpoint": { "@type": "GeoCoordinates", "latitude": -31.8648813, "longitude": 115.8095638 }, "geoRadius": "50000" }, "knowsAbout": [ "Cybersecurity", "Managed Security Services", "Essential Eight", "Microsoft 365", "Microsoft Azure", "IT Support", "Network Security", "Disaster Recovery", "Compliance Management", "Microsoft Copilot", "AI Readiness", "AI Governance", "AI Agent Development" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "IT and Cybersecurity Services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity Services", "url": "https://startcloud.au/cybersecurity" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT Services and Support", "url": "https://startcloud.au/technology" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft 365 and Cloud Solutions", "url": "https://startcloud.au/cloud" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed Networking", "url": "https://startcloud.au/networking" } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI and Automation", "url": "https://startcloud.au/ai" } } ] }, "sameAs": [ "https://www.linkedin.com/company/startcloudau", "https://www.facebook.com/startcloudaus/", "https://www.cloudtango.net/providers/12375/startcloud", "https://clutch.co/profile/startcloud", "https://abr.business.gov.au/ABN/View?abn=17676121449", "https://www.yellowpages.com.au/balcatta-wa/bpp/startcloud-581735301", "https://www.truelocal.com.au/balcatta-wa/tlp/startcloud-581735301", "https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj" ] }, [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://startcloud.au/" }, { "@type": "ListItem", "position": 2, "name": "Resources", "item": "https://startcloud.au/resources" }, { "@type": "ListItem", "position": 3, "name": "Automated Decision-Making", "item": "https://startcloud.au/resources/automated-decision-making-privacy-policy-australia" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "Is the small business exemption removed on 10 December 2026?", "acceptedAnswer": { "@type": "Answer", "text": "No. The exemption is still in place. What commences on that date is the automated decision-making transparency obligation under Australian Privacy Principle 1. Removing the exemption was proposed as part of a second tranche of privacy reforms, but that legislation has not been introduced and has no commencement date. A lot of articles have run the two together." } }, { "@type": "Question", "name": "We use AI to help shortlist job applicants. Are we caught?", "acceptedAnswer": { "@type": "Answer", "text": "Possibly, if the Privacy Act covers you. Hiring decisions affect people's rights and interests, so if a program is making or substantially making the shortlisting call using personal information, that is the kind of thing the rule is aimed at. If a person reviews every application properly and the tool only sorts them, you are on safer ground. Write down how it actually works, not how it was meant to work." } }, { "@type": "Question", "name": "We turn over under $3 million. Can we ignore this?", "acceptedAnswer": { "@type": "Answer", "text": "Probably, but check the exceptions first. Health service providers, businesses that buy or sell personal information, and contractors working under a Commonwealth contract are covered regardless of turnover. WA businesses doing government work catch people out here more than anything else." } }, { "@type": "Question", "name": "What happens if we do nothing and we are covered?", "acceptedAnswer": { "@type": "Answer", "text": "This is a transparency obligation under APP 1, so failing to meet it is a privacy breach like any other and the OAIC can investigate. The more likely practical consequence is simpler. A client, an insurer, or a tender process asks how you handle automated decisions, and you have no answer." } }, { "@type": "Question", "name": "Do we need a lawyer for this?", "acceptedAnswer": { "@type": "Answer", "text": "For most businesses, no. Working out whether you are covered and describing your automated decisions honestly is something you can do in an afternoon. If you hold health records or you are deep in government contracts, get advice." } } ] }, { "@context": "https://schema.org", "@type": "BlogPosting", "headline": "Automated decisions and your privacy policy: what actually changes on 10 December 2026", "description": "From 10 December 2026, Australian privacy policies must disclose significant automated and AI-driven decisions. Who it covers, what to write, and the myth doing the rounds.", "author": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au" }, "publisher": { "@type": "Organization", "name": "StartCloud", "url": "https://startcloud.au", "logo": { "@type": "ImageObject", "url": "https://startcloud.au/startcloud-logo.png" } }, "datePublished": "2026-09-16", "dateModified": "2026-09-16", "image": "https://startcloud.au/og-image.png", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://startcloud.au/resources/automated-decision-making-privacy-policy-australia" } } ] ] --- [![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth")](/ "StartCloud | Managed IT Services Perth") - Cybersecurity - AI Solutions - Cloud - Technology - Networking - Explore [Contact Us](/contact "Contact StartCloud, Perth IT Support") Open menu Overview Short Version The Myth Does It Apply? What Counts Your Policy What to Do Now Verdict Sources FAQ Related A plain-English guide to the Australian automated decision-making transparency obligation that commences on 10 December 2026. From that date, APP entities that use a computer program, including AI, to make decisions that could reasonably be expected to significantly affect an individual's rights or interests must disclose in their privacy policy the kinds of personal information used and the kinds of decisions made. Corrects a widespread claim that the Privacy Act small business exemption is removed on the same date: it is not. The exemption remains in place, its removal was left out of the Privacy and Other Legislation Amendment Act 2024 and deferred to a second tranche of reforms that has not been introduced and has no commencement date. Covers who is actually caught, including the exceptions that cover businesses under the $3 million turnover threshold such as health service providers, businesses that buy or sell personal information, and Commonwealth contractors. General information, not legal advice. [Home](/)[Resources](/resources)Automated Decision-Making Compliance Guide Commences 10 December 2026 # Automated decisions and your privacy policy: what actually changes on 10 December 2026 If your business uses a computer program, and that includes AI, to make decisions that could seriously affect someone, your privacy policy will have to say so. It is narrower than a lot of what you have read, and it does not land on every business in Australia. StartCloud 16 September 2026 7 min read The short version ## The short version **A new transparency rule starts on 10 December 2026.** Privacy policies have to disclose automated decisions that significantly affect people, including decisions made by AI. **It only applies if the Privacy Act already covers you.** Most businesses under $3 million turnover are still outside the Act, though the exceptions catch more of them than owners expect. **The small business exemption is not removed on that date.** A lot of articles say it is. They are wrong, and we set out the source below. Clearing something up ## The thing you have probably read, and why it is wrong Over the past few months a wave of articles has appeared telling Australian small businesses that the Privacy Act small business exemption disappears on 10 December 2026, and that 2.5 million businesses are about to be pulled into the Act. That is not right. The small business exemption, the one that keeps most businesses under $3 million turnover outside most of the Privacy Act, is still there. Removing it was proposed during the Privacy Act review, and the government has said it is working on a second tranche of reforms that would do it. But that legislation has not been introduced, and there is no commencement date. You do not have to take our word for it. The Parliamentary Library's own Bills Digest for the Privacy and Other Legislation Amendment Bill 2024 records industry groups being disappointed that the Bill _did not_ remove the small business exemption. It was left out and deferred. What genuinely commences on 10 December 2026 is the automated decision-making transparency obligation, added to Australian Privacy Principle 1 by that same Act. Two different things, one date, and a lot of articles have welded them together. We are not saying this to score points. We are saying it because a Perth business owner who believes the wrong version spends money and worry on the wrong problem, and quite possibly ignores the obligation that does apply to them. Scope ## Does this actually apply to you? The new rule applies to APP entities. If the Privacy Act already covers you, it covers this too. Most businesses turning over under $3 million a year are not APP entities, so as things stand today this does not apply to them. That is the exemption doing its work. Except the exemption has holes in it, and they catch more small businesses than people expect. You are covered regardless of turnover if you are a health service provider and hold health records, which includes a surprising number of allied health and wellbeing businesses. You are covered if you buy or sell personal information. You are covered if you are a contractor providing services under a Commonwealth contract, which sweeps in businesses doing government work. Credit reporting and tax file number handling bring their own obligations too. If you are a WA business bidding for government work, read that list again. Plenty of businesses that assume they are exempt are not. And if you are over $3 million, this is simply yours to deal with. The test ## What counts as an automated decision The test is not whether you use AI. The test is whether a computer program uses personal information to make a decision that could reasonably be expected to significantly affect someone's rights or interests. Two halves matter there. The decision has to be made, or substantially made, by the program rather than by a person using a tool. A human who reads a report and decides is not automated decision-making. A system that scores an application and returns an answer probably is. And the effect has to be significant. Credit decisions. Hiring and shortlisting. Insurance pricing. Access to a service someone needs. Tenancy. Those affect people's lives in a way that a recommendation engine picking which product photo to show does not. Here is where it gets uncomfortably close to home for a lot of businesses. If you have wired an AI tool into your hiring process to rank applicants, or you use automated scoring to decide who gets credit terms, you are likely in scope. Most businesses that did this did not think of it as automated decision-making. They thought of it as saving time. If you are not sure what your team has connected to what, that is worth finding out for more reasons than this one. Our [AI usage analysis](/cybersecurity/ai-analysis) exists because most businesses genuinely do not know. The obligation ## What your privacy policy has to say The obligation is a disclosure one. You are not being told you cannot make automated decisions. You are being told you have to be open about it. Your privacy policy needs to cover the kinds of personal information the systems use, and the kinds of decisions those systems make. Kinds, not a line-by-line inventory. You are describing the shape of what happens, clearly enough that someone reading it understands their information goes into an automated process and what sort of call comes out the other end. The OAIC has been consulting on more detailed guidance and has signalled it will publish before the commencement date. When that lands, it is worth reading properly rather than guessing, because the difference between adequate and inadequate disclosure is exactly the kind of thing guidance is for. Practical steps ## What to do now None of this requires a compliance department. Four moves cover most of the ground for a typical WA business. ### Check if you are covered Turnover first, then the exceptions. Ten minutes with your accountant settles it, and if the answer is no, you have just saved yourself a project. ### List where software decides Not where you use software, where software decides. Hiring, credit, pricing, eligibility, access. Include anything you plugged an AI tool into over the past two years. ### Ask who is really deciding If a person reviews the output and can genuinely overrule it, that is different to a system that just returns an answer. Be honest here rather than optimistic. ### Update the policy If anything is in scope, your privacy policy needs to describe it before 10 December 2026. Start the review now, not in November. And if you turn out to be exempt, do the security basics anyway. Most privacy trouble does not start with a compliance failure, it starts with a breach. The exemption will not help you explain to a client why their data is on a leak site, which is why the [Essential Eight basics](/cybersecurity/essential-eight-checklist) are worth more to most businesses than any policy wording. Verdict ## The takeaway The rule that commences on 10 December 2026 is real, it is narrower than the headlines suggest, and it lands on businesses the Privacy Act already covers. The exemption removal is coming at some point. It is not here, and it is not dated. Anyone telling you otherwise has read a blog post rather than the legislation. If you are not sure which side of the line you sit on, that is a short conversation rather than a project. We would rather tell you that you are fine than sell you something you do not need. [Explore compliance & risk](/cybersecurity/compliance)[Read the wider Privacy Act guide](/resources/privacy-act-changes-wa-small-business) Sources ## Where this comes from This article takes a position that contradicts a lot of what is currently published, so here is where every claim comes from. All of it is Australian Government material, and none of it is behind a paywall. [ ### Privacy and Other Legislation Amendment Bill 2024, Bills Digest Parliament of Australia Records that the Bill did not remove the small business exemption, which was left to a later tranche of reforms. ](https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/bd/bd2425/25bd016)[ ### Consultation on guidance for transparency in automated decision-making Office of the Australian Information Commissioner The OAIC's work on what the APP 1 automated decision-making disclosure will require in practice. ](https://www.oaic.gov.au/engage-with-us/consultations/consultation-on-guidance-for-transparency-in-automated-decision-making)[ ### APP 1: Open and transparent management of personal information Office of the Australian Information Commissioner The Australian Privacy Principle the new automated decision-making obligation is being added to. ](https://www.oaic.gov.au/privacy/australian-privacy-principles/australian-privacy-principles-guidelines/chapter-1-app-1-open-and-transparent-management-of-personal-information)[ ### Privacy obligations for small business Office of the Australian Information Commissioner The current small business exemption, including the exceptions that catch businesses under the turnover threshold. ](https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/organisations/small-business) FAQ ## Common questions ### Is the small business exemption removed on 10 December 2026? No. The exemption is still in place. What commences on that date is the automated decision-making transparency obligation under Australian Privacy Principle 1. Removing the exemption was proposed as part of a second tranche of privacy reforms, but that legislation has not been introduced and has no commencement date. A lot of articles have run the two together. ### We use AI to help shortlist job applicants. Are we caught? Possibly, if the Privacy Act covers you. Hiring decisions affect people's rights and interests, so if a program is making or substantially making the shortlisting call using personal information, that is the kind of thing the rule is aimed at. If a person reviews every application properly and the tool only sorts them, you are on safer ground. Write down how it actually works, not how it was meant to work. ### We turn over under $3 million. Can we ignore this? Probably, but check the exceptions first. Health service providers, businesses that buy or sell personal information, and contractors working under a Commonwealth contract are covered regardless of turnover. WA businesses doing government work catch people out here more than anything else. ### What happens if we do nothing and we are covered? This is a transparency obligation under APP 1, so failing to meet it is a privacy breach like any other and the OAIC can investigate. The more likely practical consequence is simpler. A client, an insurer, or a tender process asks how you handle automated decisions, and you have no answer. ### Do we need a lawyer for this? For most businesses, no. Working out whether you are covered and describing your automated decisions honestly is something you can do in an afternoon. If you hold health records or you are deep in government contracts, get advice. This article is general information, not legal advice, and privacy law is changing quickly. For how these obligations apply to your specific business, particularly around health records or government contracts, check the current guidance at oaic.gov.au or speak to a qualified adviser. Keep reading ## Related pages [ Deep dive ### Privacy Act Changes The wider picture: the statutory privacy tort, the exemption, and what WA small business should do. Guide ](/resources/privacy-act-changes-wa-small-business)[ Service ### AI Agent Security Governance and monitoring for the AI tools making decisions in your business. Service ](/cybersecurity/ai-agent-security)[ Deep dive ### Directors' Cyber Liability How ASIC reframed cyber resilience as a directors' duty, and what boards should do. Guide ](/resources/directors-cyber-liability) ![StartCloud](/assets/StartCloud-Logo-ByZE1kzP.svg "StartCloud: Cybersecurity-First Managed IT Services Perth") Cybersecurity-led IT for Australian businesses. We manage security, compliance, and modern IT environments, so risk is governed, not guessed. Ground Floor West, 6 Gibberd Road, Balcatta WA 6021 [08 6285 0001](tel:+61862850001 "Call StartCloud on 08 6285 0001") Serving Perth businesses from Balcatta, Western Australia. ![Microsoft Solutions Partner - Modern Work](/assets/microsoft-solutions-partner-DqvNMv91.png "Microsoft Solutions Partner: Modern Work") ### Services - [Cybersecurity](/cybersecurity "Cybersecurity Services Perth | StartCloud") - [AI Solutions](/ai "AI & Automation Services Perth | StartCloud") - [Cloud](/cloud "Cloud Services Perth | StartCloud") - [Technology](/technology "IT Services and Support | StartCloud") - [Networking](/networking "Business Networking Perth | StartCloud") - [Packages](/packages "IT Support Packages Perth | StartCloud") ### Company - [About](/about "About StartCloud, Perth IT Support Team") - [Company Facts](/facts "StartCloud Company Facts | Perth Cybersecurity-First AI MSP") - [Capability Statement](/capability-statement "Capability Statement | StartCloud") - [Resources](/resources "IT Resources & Guides | StartCloud Perth") - [Service Areas](/it-support-perth "IT Support Perth | StartCloud") - [Contact](/contact "Contact StartCloud, Perth IT Support") ### Locations - [All Service Areas](/locations "Perth IT Support Areas | StartCloud") - [IT Support Perth](/it-support-perth "IT Support Perth | StartCloud") - [Cybersecurity Perth](/cybersecurity-perth "Cybersecurity Perth | StartCloud") - [MSP Perth](/managed-service-provider-perth "Managed Service Provider Perth | StartCloud") - [Industries We Serve](/industries "IT Support by Industry Perth | StartCloud") © 2026 Start Technologies Pty Ltd trading as StartCloud. All rights reserved. ABN 17 676 121 449 [](https://www.linkedin.com/company/startcloudau "StartCloud on LinkedIn")[](https://www.facebook.com/startcloudaus/ "StartCloud on Facebook")[](https://www.google.com/maps/place/StartCloud/@-31.8648767,115.8069889,739m/data=!3m2!1e3!4b1!4m6!3m5!1s0x2a32a5b5d9e864b5:0x9f02690968f0e50c!8m2!3d-31.8648813!4d115.8095638!16s%2Fg%2F11vzbgtytj "StartCloud on Google") [Terms of Service](/terms-of-service "Terms of Service | StartCloud")| [Privacy Policy](/privacy-policy "Privacy Policy | StartCloud")| [Modern Slavery Policy](/modern-slavery-policy "Modern Slavery Policy | StartCloud")| [Cookie Policy](/cookie-policy "Cookie Policy | StartCloud") StartCloud Assistant Online G'day! 👋 I'm the StartCloud Assistant. How can I help you today? Tell me about your servicesBook a discovery callI need IT support Find Your Solution