Guide · Privacy
Short answer: from 10 December 2026, a business covered by the Privacy Act must say in its privacy policy if it uses a computer program – including an AI tool such as ChatGPT or Claude – to make, or substantially help make, decisions that could significantly affect people, and what personal information goes into it. Most small businesses with an annual turnover of $3 million or less remain exempt; the small business exemption is not removed on that date, despite what some articles say. Every business, exempt or not, should still keep customer data out of personal AI accounts.
This is general information, not legal advice.It summarises the law and the regulator's guidance as at the review date above, with a link to each source. For decisions about your own obligations, and for regulated industries such as health or financial services, speak to a privacy lawyer.
What the new rule says
The Privacy and Other Legislation Amendment Act 2024 added three paragraphs to Australian Privacy Principle 1 (APP 1.7 to 1.9), which commence on 10 December 2026. The obligation applies when all three of the following are true:
- the business has arranged for a computer program to make a decision, or to do something substantially and directly related to making it;
- the decision could reasonably be expected to significantly affect the rights or interests of an individual; and
- personal information about that individual is used by the program for that purpose.
Where this is the case, the privacy policy must describe the kinds of personal information used, the kinds of decisions made solely by the program, and the kinds of decisions where the program does something substantially and directly related to a decision a person then makes. Note that the rule also catches tools and data that were already in use before 10 December 2026; there is no grandfathering. Additionally, it is a disclosure obligation only – it does not, on its own, give individuals a right to contest a decision or to be notified of it.
Does it apply to ChatGPT and Claude?
Potentially, yes. The regulator, the Office of the Australian Information Commissioner (OAIC), reads "computer program" broadly: its May 2026 issues paper states that generative AI tools, including chatbots, fall within it, and even gives the example of a spreadsheet formula that scores people. The words "substantially and directly related" capture a program that recommends or guides a human decision, where its output is a key factor in what the person decides.
In particular, one of the OAIC's own examples of a business having "arranged for" a program is an employer permitting or directing staff to use an AI chat tool to draft performance assessments that determine promotions. That is, the decision does not have to be made by the AI for the rule to apply; it is enough that the AI output is a key input into a significant decision about a person.
Examples of decisions that may "significantly affect" someone, given in the explanatory memorandum and the OAIC paper, include decisions about rights under a contract (such as insurance), access to a significant service (such as healthcare), eligibility for a benefit, and targeting that leads to different prices or limits access to jobs. By contrast, using AI to draft a marketing email, summarise a meeting or format a quote is unlikely to be caught, because no significant decision about a person is being made.
| Everyday AI use in a small business | Likely to be caught by APP 1.7? |
|---|---|
| Drafting emails, quotes, proposals and social posts | Unlikely – no significant decision about a person |
| Summarising meetings or documents | Unlikely, unless the summary drives a decision about a person |
| Screening or ranking job applicants | Likely – an OAIC example |
| Drafting staff performance reviews used for promotion or pay | Likely – an OAIC example |
| Approving or refusing refunds, credit or payment terms | Likely – affects rights under a contract |
| Prioritising which customers get served first, where it matters to them | Possibly – depends on how significant the effect is |
The right-hand column is our reading of the OAIC's examples, not a legal ruling. The OAIC said it would publish final guidance on this obligation by September 2026; as at the review date, we had not found it published, and this guide will be updated when it is.
Who the Privacy Act applies to
The Australian Privacy Principles apply to "APP entities", which excludes most small businesses. According to the OAIC's small business page, a business with an annual turnover of $3 million or less is generally exempt. However, the exemption does not apply to, among others:
- health service providers, which includes many allied health, fitness and wellness businesses that hold health information;
- businesses that trade in personal information (buying or selling it);
- contracted service providers under a Commonwealth contract;
- credit reporting bodies and reporting entities under the anti-money laundering laws;
- businesses related to a larger company that is covered; and
- small businesses that have chosen to opt in.
The small business exemption is not ending on 10 December 2026
Several articles claim that the exemption is "removed" on 10 December 2026. This is not supported by the Act. The Government agreed in principle in 2023 to remove the exemption in the future, but the second-tranche draft bill released for consultation on 31 August 2026 does not remove it, and that bill is a draft only, not law. The date 10 December 2026 is when the automated decision rule above starts.
Note that an exempt business is still not free of privacy risk. The statutory tort for serious invasions of privacy, in force since 10 June 2025, applies to businesses of any size and to individuals, and larger clients increasingly require privacy compliance from their suppliers in their contracts.
What the regulator recommends for AI tools
The OAIC's guidance on using commercially available AI products (October 2024, updated January 2025) is written for APP entities, but it is sound practice for any business. Its main points are:
- Do not enter personal information, and particularly sensitive information, into publicly available generative AI tools, because once entered it is hard to track, control or remove.
- Choose products with due diligence: who can access the data, where it is stored, and whether it is used to train models – and review this regularly, because it is "not set and forget".
- Be transparent: update the privacy policy, and clearly identify public-facing chatbots as AI.
- Check the output: AI can produce inaccurate information, and information generated about a person counts as collecting it.
- Remember overseas storage: most business AI plans store data outside Australia, which is itself something a privacy policy should cover. Our Claude vs ChatGPT guide lists where each plan stores data.
How Australian organisations are wording it
There is no standard wording yet, but the policies published so far follow a few common patterns, which a small business can adapt:
- A dedicated heading, such as "Automated decisions" or "Use of artificial intelligence", inside the section that explains how information is used. Telstra's privacy statement is the closest to the new rule: one list of the kinds of personal information used for automated decisions, and one list of the kinds of decisions.
- A short paragraph that links to a longer statement. Services Australia keeps the policy paragraph brief and links to a separate automation and AI transparency statement.
- Plain statements about safeguards: that a person reviews significant decisions, that existing complaint rights are unaffected, and how to ask for more information.
In the policies we reviewed, the most common gap is that they do not mention the AI tools staff actually use, or whether customer data is stored overseas as a result.
A checklist before 10 December 2026
- Work out whether you are covered. Check your turnover and the list of exceptions above. If you are unsure, assume you are, or ask a lawyer.
- List the AI tools in use, including the personal accounts staff use without asking. In most businesses this list is longer than the owner expects.
- Move work onto a business plan with training on your data switched off, and close personal accounts used for work.
- Identify significant decisions where AI output is a key factor: hiring, performance, pricing, credit, refunds, access to services.
- Update the privacy policy with the kinds of personal information and the kinds of decisions involved, and with overseas storage where it applies.
- Write a one-page staff AI use policy: what data may go in, what must be checked before it goes out, and who to ask.
- Add AI to your data breach plan, so that customer data pasted into the wrong tool is assessed promptly rather than ignored.
- Diarise a review, because the OAIC's final guidance and the second tranche of reforms may change the details.
Frequently asked questions
When do the automated decision-making rules start?
On 10 December 2026, 24 months after the Privacy and Other Legislation Amendment Act 2024 received Royal Assent. They apply to decisions made after that date, including decisions made with tools and data that were already in use.
Is the small business exemption being removed on 10 December 2026?
No. Businesses with an annual turnover of $3 million or less remain generally exempt unless an exception applies. The second-tranche draft bill released in August 2026 does not remove the exemption, and it is not yet law.
Does using ChatGPT or Claude to write emails trigger the new rule?
Unlikely. The rule is about decisions that could significantly affect a person, such as hiring, promotion, credit or access to a service. Drafting emails, quotes or marketing content is not such a decision.
Is pasting customer details into ChatGPT a data breach?
Not automatically. For a business covered by the Act, it may be an unauthorised disclosure that has to be assessed, and whether it is a notifiable breach depends on the likelihood of serious harm. The OAIC recommends not entering personal information into public AI tools at all, which is why a business plan and a staff policy matter.
Sources
- Privacy and Other Legislation Amendment Act 2024 (Cth), Schedule 1 Part 15
- OAIC, Automated Decision-Making Transparency Obligation (APP 1) – Issues Paper, May 2026, and the consultation page
- OAIC, Guidance on privacy and the use of commercially available AI products
- OAIC, Small business and Notifiable Data Breaches scheme
- OAIC, Statutory tort for serious invasions of privacy
- Attorney-General's Department, Privacy reform consultation (exposure draft, August 2026)
Want your team's AI use sorted before December?
Our AI Professional plan includes a business-plan setup with training switched off, least-privilege integrations and a written staff AI use policy. We work alongside your lawyer on the privacy policy wording.