Privacy Act AI Compliance Australia

What Changed in the Privacy Act?

The Privacy and Other Legislation Amendment Act 2024 introduced mandatory transparency requirements for automated decision-making. Before this amendment, disclosure was best practice. Now it's law.

The scope is broad. Any automated system that "significantly affects rights or interests" falls under the requirement. That includes:

• Credit scoring and lending decisions
• Insurance premium calculations
• Fraud detection systems
• HR screening and recruitment tools
• Customer service routing algorithms
• Automated claims processing

If your system makes decisions about people without a human reviewing each one, it almost certainly qualifies. And most organisations are running more of these than they realise. I've audited firms that thought they had two automated systems and discovered they had eleven.

The 10 December 2026 Deadline

This is a hard legislative deadline. Not a guideline, not a recommendation, not a target. 10 December 2026. OAIC doesn't grant extensions.

Here's the maths on timing:

• More than 30 weeks out: our ADM Sprint takes 6 weeks, which leaves over 6 months of buffer.
• 20 to 30 weeks out: tight but manageable.
• Under 15 weeks out: rush delivery required. Higher cost, lower certainty.

Early movers get fixed-price certainty for a complete ADM transparency sprint. Late movers pay more because they're competing for limited advisory capacity. Every compliance firm in Australia will be scrambling for the same December deadline.

OAIC Privacy Sweep: What's Happening Now

The OAIC launched a Privacy Sweep in January 2026 targeting 60 entities across property, retail, car rental, venues, chemists, and pawnbrokers. The focus: in-person data collection practices and privacy policy compliance.

Penalties reach $66,000 for non-compliant privacy policies. That's per breach, not a one-off slap.

This sweep is a signal. OAIC is actively enforcing. The organisations caught with outdated or missing privacy policies aren't getting warnings. They're getting enforcement notices. And the ADM transparency requirement hasn't even hit its deadline yet.

APP 11 and AI Processing

Australian Privacy Principle 11 requires organisations to take reasonable steps to protect personal information. When AI systems process personal data, APP 11 applies to that processing.

Here's where most organisations get caught: consumer AI subscriptions don't meet enterprise security requirements. If your team is using ChatGPT or Claude to process customer data on personal accounts, that's likely an APP 11 breach. The AI tool's terms of service are not a substitute for your organisation's privacy obligations.

Practical steps for APP 11 compliance with AI:

• Audit which AI tools process personal information across your organisation
• Verify that enterprise-grade security controls are in place for each tool
• Document data flows between your systems and AI providers
• Confirm data sovereignty (where your data is processed and stored matters under Australian law)
• Establish access controls so only authorised personnel use AI on sensitive data

How to Get Compliant

The ADM Transparency Sprint is a 6-week, fixed-price engagement that delivers:

Week 1-2: Complete ADM inventory. We map every automated decision system in your organisation. Most firms find more than they expected.

Week 3-4: Privacy policy update. Plain English disclosure of automated decision-making, written to meet OAIC requirements and tested against the legislative standard.

Week 5-6: Implementation and documentation. Updated policies deployed, staff briefed, evidence package assembled for OAIC review.

Guaranteed compliance by 10 December 2026 or full refund. But the guarantee assumes you start with enough lead time. Starting in September cuts the buffer to zero. Starting now gives you months of breathing room.

Related Resources

• AI Governance Framework: Complete governance framework for Australian businesses
• ASIC AI Director Duties: Director obligations under Section 180
• AI Compliance Checklist: Step-by-step compliance verification
• AI Risk Register Template: Board-ready risk documentation