The privacy regulator has fired the starting gun on a rule most small businesses haven’t heard of. The OAIC is now consulting on guidance for a new automated decision-making (ADM) transparency obligation that takes effect on 10 December 2026. It comes from the Privacy and Other Legislation Amendment Act 2024, which adds new sub-clauses to Australian Privacy Principle 1. In plain terms: if your business uses a computer program to make — or heavily assist — decisions about people that could significantly affect their rights or interests, you’ll need to say so in your privacy policy.

Here’s the trap we keep seeing in Australian client environments: business owners hear “automated decision-making” and think “that’s an AI thing, not us.” Then we look under the bonnet and find they’re already running it. Automated applicant screening in HR and rostering software. Credit or loan pre-qualification tools. Fraud and risk scoring baked into payment platforms. For the not-for-profits we support, it’s often automated eligibility or grant-scoring systems handling applicant data. You don’t need a shiny AI badge to be in scope — you just need personal information feeding a program that meaningfully affects someone.

So do this now. Make a short inventory of every system that makes or substantially shapes decisions about individuals, and note what personal information it uses and what kind of decision it produces. Then update your privacy policy to describe those decisions in clear language before 10 December. The OAIC’s final guidance is expected around September 2026, so build your list now and refine the wording once it lands — don’t leave both jobs until December.

Not sure which of your everyday tools count? That’s exactly the kind of untangling we do for businesses across Sydney’s Northern Beaches, wider Sydney and Central West NSW. Our team can map your systems against the new rule and get your policy sorted. Talk to us about your compliance before the deadline creeps up.