Ten Weeks to 10 DecemberYour spreadsheet is an automated decision-maker. The Privacy Act's new disclosure duty covers far more than AI — here's a checklist to get ready.

Ask most small business owners whether they use "automated decision-making" and they'll say no — "we don't use AI for that".

Then ask whether a spreadsheet formula decides who gets a discount, whether a booking system auto-declines a request, or whether a recruitment tool shortlists applicants. Different answer.

From 10 December 2026, that difference matters. Here's what changes, who it covers, and a checklist you can work through before the deadline.

What's changing

Reforms passed in late 2024 added new rules to the Australian Privacy Principles (APP 1.7–1.9). They had a two-year runway, which ends on 10 December.

On 30 September, the privacy regulator (the OAIC) published its final guidance: updated APP 1 guidelines, fact sheets and a flowchart.

The duty itself is about transparency. If you use a computer program to make — or substantially help make — significant decisions about people using their personal information, your privacy policy has to say so.

The three-part test

The obligation applies when all three are true:

1. You've arranged for a computer program to make a decision, or to do something "substantially and directly related" to making it.
2. The decision "could reasonably be expected to significantly affect the rights or interests of an individual".
3. The program uses personal information about that person.

"Computer program" means more than AI

This is the part that will catch people out. The guidance covers commonly used software, apps, rule-based processes, spreadsheets, machine learning and generative AI, including chatbots.

As law firm Allens put it: "Simple, long-standing tools can be captured, not just sophisticated AI." Squire Patton Boggs reads it as reaching even Excel spreadsheets with basic formulas.

What counts as "significant"

More than trivial — something that could considerably influence a person's circumstances. The guidance's examples include:

• granting or refusing benefits;
• decisions affecting contract rights, such as insurance;
• access to significant services, such as healthcare;
• differential pricing for essential goods or services;
• targeted employment advertising.

It also works through scenarios like AI screening of job applications, automated loan decisions and algorithmic account suspension. And it notes that a decision can be significant for vulnerable people — children, people with disability — even when it wouldn't be for most of us.

"But a person makes the final call"

That doesn't get you out of it. If the program's output is "a key factor with a direct connection to the human's decision, whether advisory or determinative", it's in scope.

The guidance looks at how much staff rely on the output, how often they override it, and how integrated it is in the process. If your team rarely overrides the system, assume it's in scope.

Who it applies to

APP entities — broadly, businesses with turnover above $3 million, plus some smaller businesses regardless of size, such as health service providers and businesses that trade in personal information. The small business exemption still stands for now; the next round of reforms hasn't removed it.

Note the onus: the duty sits with the business that "arranged for" the program — you, not your software vendor.

The checklist

1. Confirm you're covered. Over $3m turnover, a health provider, or otherwise an APP entity? If unsure, check with your adviser.
2. Map every tool that feeds a decision about a person. Spreadsheets with formulas, CRM scoring, rules in booking or quoting systems, AI screening, chatbots.
3. Run each one through the three-part test. Pay special attention to pricing, credit, hiring, account suspensions and access to services.
4. Be honest about human review. Record how often staff actually override each output.
5. Ask your vendors what personal information their tools use and how outputs are produced.
6. Update your privacy policy before 10 December. List, in plain language, the kinds of personal information used, the kinds of decisions made solely by computer, and the kinds of decisions computers substantially assist. Call out sensitive data such as health or biometrics.
7. Keep a register and review it whenever you add a tool.

Why bother

The duty itself is light-touch — a few honest paragraphs in your privacy policy. But the Privacy Act now has civil penalty tiers, infringement notices and compliance notices behind it, and the regulator expects complaints to rise once people can see where machines are deciding things about them.

More practically: you can't govern what you haven't mapped. The businesses that do this audit properly will know exactly where their automated decisions live — which is the first step to making sure they're fair.

Ten weeks is enough time to do this well. It isn't enough time to start in December.

General information only, not legal advice. Check your obligations with a qualified adviser.