Know if you’re in scope
A clear test for whether your automated decisions trigger the new rules. Most businesses underestimate this.
New Privacy Act rules · live 10 December 2026
Your AI makes decisions about people.
Soon you have to tell them.
From 10 December 2026, Australian businesses that use automated decisions on personal information must disclose it and offer human review. We wrote a plain-English guide to what that means for you, and what to do about it.
The problem
Generic privacy templates won’t cover this.
Say you use AI or automated systems to make decisions that significantly affect people: approvals, pricing, eligibility, screening. Your privacy policy now has to spell out what those decisions are and how they work, and people can ask for a human to review them. The OAIC has already started compliance sweeps. Most teams have no idea where to start.
What it does
The work, done for you.
What you actually have to publish
The specific disclosures, the decision register, and the human-review process the law expects, in plain English.
A 90-day path
A practical sequence to be ready before 10 December 2026, without a $30k legal project.
Free guide
Get the plain-English guide.
Free guide
The Privacy Act ADM Guide (2026)
A plain-English guide to the 10 December 2026 automated-decision rules: who’s in scope, what you must disclose, and a 90-day readiness path.
- The in-scope test: do the new ADM rules apply to you?
- What your privacy policy must now say (with examples)
- The decision register and human-review process explained
- A 90-day readiness checklist