Privacy Act automated decisions rule (10 December 2026): what accounting, financial advice and mortgage broking firms need to do
General information, not legal advice. It doesn’t consider your firm’s circumstances. For advice, speak to a privacy lawyer or your professional association.
From 10 December 2026, if your firm uses a computer program to make, or substantially help make, decisions that could significantly affect a client, and the program uses their personal information, your privacy policy must say so. The duty sits with your firm, not your software vendor, and it covers tools you set up before December. This guide explains when it applies to accounting, financial advice and mortgage broking firms, with a seven-step checklist and answers to the questions owners ask.
Last checked against the Act and the OAIC’s guidance:
The rule in plain terms
The rule is a new part of Australian Privacy Principle 1 (APP 1.7 to 1.9). It applies when three things are all true:
- a computer program makes a decision about a person, or substantially helps make it;
- that decision could significantly affect them; and
- the program uses personal information about that person.
A “computer program” is wider than AI: the OAIC’s guidance includes rule-based software. When all three apply, your firm’s privacy policy has to say what kinds of personal information the program uses, and what kinds of decisions it makes or helps make. The Act’s examples of decisions that may affect someone’s rights or interests include ones that affect their rights under a contract, or their access to a significant service or support. The rule applies only where that effect could be significant.
Firms can’t pass this duty to their software vendor: the OAIC expects it to stay with the business that uses the program to decide, even when a vendor builds or runs it. It also covers tools set up before 10 December. Some smaller businesses — for example those with turnover under $3m — are exempt, with some conditions.
Does it apply to my firm?
It applies if the Privacy Act covers your firm and any of your tools meets all three tests above. A business with annual turnover over $3 million is covered. Below that, most businesses are exempt, but there are exceptions, and the OAIC’s small business page lists them. The one most likely to catch firms in these industries:
- AML/CTF reporting entities. A small business that provides services regulated by the anti-money laundering law is covered for that work, whatever its turnover, though not for the rest of its business. From 1 July 2026 that can include accountants who provide designated services.
Others include trading in personal information and being related to a larger business the Act covers.
Does ChatGPT, Copilot or an AI note-taker count?
Only when its output substantially shapes a decision about a client: it depends on what the tool does, not what it’s called. A note-taker that transcribes a client meeting isn’t making a decision. A summary that sets the client’s risk profile, or a draft recommendation the adviser adopts, can be. Separately, the OAIC advises against entering personal information into publicly available AI tools, and for an AI note-taker suggests telling attendees at the start and letting them object. Its guidance on commercially available AI products covers what to check.
What do I write in my privacy policy?
Write the kinds of personal information each program uses, the kinds of decisions it makes on its own, and the kinds it helps make: describe kinds, not code. The OAIC’s fact sheet has worked examples. A sample paragraph to adapt with your adviser:
Automated decision-making. We use software to help make some decisions that may significantly affect you. Our financial planning software uses the information you give us about your income, assets, goals and attitude to risk to suggest your risk profile and the investment options we consider. An adviser reviews every recommendation before we make it. We do not make decisions about you by software alone.
What do I need from my software vendors?
Enough to describe each tool accurately. Ask each vendor, in writing: what personal information the tool uses; what it produces — a score, a ranking, a recommendation or a decision; whether anything happens without a person reviewing it; and where the data is processed. Their answers don’t move the duty to them.
What if I’m not sure?
Run the tool through the OAIC’s flowchart and write down your answer and why. If you still can’t tell, ask a privacy lawyer or your association, and read the OAIC’s guidance on automated decisions.
Three examples, as things to check
Accounting
Your practice software rates clients for AML/CTF risk, or ranks overdue accounts and sends some to collections automatically.
Things to check: whether the rating or ranking decides how a client is treated, whether a person reviews it first, and whether the client is an individual or sole trader — the rule protects individuals, not companies.
Financial advice
A risk-profile questionnaire scores the client, and the score sets the portfolio your planning software suggests.
Things to check: whether the adviser tests the score or simply adopts it, and whether a tool also decides who gets a review or which service a client is offered.
Mortgage broking
A serviceability or lender-matching tool filters which loans you show a client, or your CRM scores leads for follow-up.
Things to check: whether a client can be ruled out of a loan by the filter before you look, and what personal information the tool uses to do it.
The seven-step checklist
- 1
Check whether the Privacy Act covers you.
Turnover over $3 million, or one of the exceptions above. Do this first: if the Act doesn’t cover your firm, neither does this rule.
- 2
List every tool that uses client data.
Practice and CRM systems, planning and lender-matching software, AI assistants, note-takers, and spreadsheets that score. Do it now: every later step works from this list.
- 3
Mark the ones that make or strongly shape decisions about people.
Decisions that could significantly affect an individual: taking them on, their risk profile, a recommendation, the loans they see. Each one you mark goes through steps 4 to 6.
- 4
Ask your vendors how those tools use the data.
The four questions above. You need the answers to describe each tool correctly, so ask early.
- 5
Run each one through the regulator’s flowchart.
The OAIC’s flowchart walks a tool through the three tests. Do it for every marked tool, and note the answer.
- 6
Update your privacy policy.
Required by 10 December 2026 for every tool that meets all three tests: the kinds of information it uses and the kinds of decisions it makes or helps make.
- 7
Keep a dated record of what you checked.
Not a rule of its own, but APP 1.2 asks covered businesses to take reasonable steps to comply, and a dated record shows you did. Repeat it when you add or change a tool.
FAQs
Do I need client consent?
Not under this rule. It is about telling people, in your privacy policy, not asking them. Other principles still apply: for example, you generally need consent to collect sensitive information such as health information (APP 3).
Does having a person sign off take a tool out of scope?
Not automatically. The rule also covers a program that does something substantially and directly related to making the decision, such as a recommendation a person then approves. The OAIC says a decision can be in scope even when a person reviews the program’s output; what matters is how much the person relies on it.
What about tools set up before December?
They are covered. The rule applies to decisions made from 10 December 2026, whenever the tool was set up and whenever the information was collected.
Forsa helps you uncover how software and AI influence decisions in your business, meet your transparency obligations under the Privacy Act’s new automated-decisions rule, and keep your automation governed as your business evolves.
Start your free scoping conversationGeneral information, not legal advice. It doesn’t consider your firm’s circumstances. For advice, speak to a privacy lawyer or your professional association.