Australian privacy law is changing, and businesses should review their compliance arrangements now. New transparency requirements for certain automated decisions commence on 10 December 2026. A Children’s Online Privacy Code is also being developed, while a separate exposure draft proposes broader changes to how personal information is handled. For your business, the immediate priority is to identify applicable requirements and prepare accurate privacy documentation before the December deadline.
Automated decision transparency from 10 December 2026
From 10 December 2026, entities covered by the Australian Privacy Principles (APP entities) must include additional information in their privacy policies about certain automated decision-making processes. The requirements apply where an entity arranges for a computer program to make a decision, or perform something substantially and directly related to making it, using personal information about an individual, and the decision could reasonably be expected to significantly affect that individual’s rights or interests.
The privacy policy must explain the kinds of personal information used, the kinds of decisions made solely by computer programs, and the kinds of decisions for which programs perform substantially and directly related functions. Businesses should assess their actual systems and practices when preparing these disclosures, rather than rely on a general statement that they use artificial intelligence.
These requirements can apply even where a person makes the final decision. The OAIC’s guidance explains that a computer-generated recommendation may be captured where it substantially facilitates and directly connects with the human decision. Relevant interests include access to credit, employment, financial assistance, healthcare and housing. If your business uses automated assessments or recommendations, we recommend checking how those outputs influence decisions and obtaining relevant information from your technology providers.
Children’s Online Privacy Code registration by 10 December 2026
The Children’s Online Privacy Code must be finalised and registered by 10 December 2026. Its registration deadline should be distinguished from the commencement arrangements specified in the final instrument. The statutory scope covers APP entities providing specified online services likely to be accessed by children or primarily concerned with children’s activities, with an exclusion for entities providing health services. The OAIC may also specify additional APP entities.
Businesses operating apps, games or websites should assess whether their services fall within scope. Preparation should include identifying children’s information, reviewing privacy notices and settings, and monitoring the final code so that implementation reflects its confirmed requirements.
Further proposed changes that have not yet become law
Further changes are proposed in the exposure draft Privacy Amendment (Personal Data Protection) Bill 2026. Consultation closed on 18 September 2026, and the Attorney-General’s Department states that the Bill remains subject to further government consideration. These proposals should inform forward planning, but their final wording and commencement remain subject to the legislative process.
A central proposal is a fair and reasonable test for collecting, using and disclosing personal information. Factors would include individuals’ reasonable expectations, transparency, data minimisation, genuine choice, proportionality and children’s best interests. Businesses would need to assess their information-handling practices in context; consent alone would not resolve every issue. Proposed direct marketing changes would also require simple opt-out mechanisms and clear information about using them. Marketing practices, including behavioural advertising and information sharing, warrant review.
The draft would modernise key definitions. Personal information would include information relating to an identified or reasonably identifiable individual, including where someone can be singled out without their name being known. Defined precise geolocation tracking data would become sensitive information. Consent could remain express or implied, but would generally need to be voluntary, informed, current, specific and unambiguous. Businesses using tracking technologies or customer profiling should consider how these proposals could affect their practices.
The proposed breach notification framework would require notification to the OAIC within 72 hours after an entity becomes aware of reasonable grounds to believe an eligible data breach has occurred. Separate proposed duties would require mitigation of breaches beyond those requiring notification. Revised security provisions would strengthen ongoing evaluation and the destruction or de-identification of information no longer needed, subject to applicable exceptions. These proposals support reviewing incident response and retention arrangements now.
The package also proposes a right to erasure against large digital platforms, subject to thresholds, possible prescription and exceptions. It would not apply generally to every business. Businesses outsourcing information handling should consider the implications for supplier contracts and oversight.
Our recommendation before the December deadline
We recommend that you arrange a review of your current privacy policy now and complete any necessary updates before 10 December 2026 to ensure compliance with the new automated decision transparency requirements where they apply. The review should confirm that your privacy policy accurately describes your information-handling practices.
We can assist you to assess the requirements relevant to your business, identify gaps and prepare tailored amendments.
Jean Kallmyr
Lawyer
