An upcoming privacy change asks covered businesses to explain particular uses of software in their privacy policies. If you manage invoices, one practical starting point is understanding which decisions your software helps make and who those decisions could affect.
What December's privacy change means for automated decisions
The disclosure duty starts on 10 December 2026
The new duty starts on 10 December 2026. It was enacted in 2024 but is not yet in force at this Note's publication date. The Privacy and Other Legislation Amendment Act 2024 sets out the new privacy policy requirements in Australian Privacy Principle 1.
The duty concerns decisions that could reasonably be expected to significantly affect an individual's rights or interests. It applies when an entity arranges for software to use that person's personal information to make the decision, or do something substantially and directly related to making it.
The privacy policy must describe the kinds of personal information used. It must also describe the kinds of decisions made entirely by software and those the software substantially and directly helps make.
Check whether your business is covered
The requirements concern entities covered by the Australian Privacy Principles. These include Australian Government agencies and many businesses.
Most businesses with annual turnover of A$3 million or less remain outside the federal Privacy Act. Exceptions include private health service providers and some businesses that trade in personal information. The December change does not remove the small business exemption. The OAIC's coverage explanation sets out other exceptions that may affect where your business fits.
Human approval does not remove the disclosure test
The OAIC published its final guidance on 30 September 2026. It explains that human approval does not automatically put a decision outside the rules. Software may still provide a key factor directly connected to the decision.
The rules cover computer programs generally, including ordinary rules and AI. The OAIC's APP 1 guidance explains the threshold and the importance of the individual's circumstances.
Look at the decision behind the invoice
A routine reminder is not automatically a significant decision. Using personal information to recommend whether a sole trader loses access to an important service may call for a closer assessment. These examples illustrate why the person's circumstances and the decision's effects matter.
These provisions add transparency requirements. They do not create a general ban on automation or require a person to approve every reminder. Existing privacy obligations continue to matter.
You can ask your software provider what the program does, what information it uses and how its output influences people. The answers can help you compare the actual process with your privacy policy. An adviser can help apply the threshold to your business.