The Privacy Act changes, and your automations.

Australia's privacy rules are changing, with new obligations phasing in from December 2026, and one of them lands squarely on the kind of automation small businesses are starting to use. The good news is that none of it stops you automating the busywork. It just asks you to be open about where software helps make decisions about people, and to keep a real human on the ones that matter. This is a plain read, not legal advice.

What's actually changing

The reforms cover a lot of ground, but the part most relevant to automation is transparency about automated decision-making. The principle is simple: people shouldn't be on the receiving end of consequential decisions made by software without knowing software was involved. So where an automated system makes, or does most of the work in making, a decision that could significantly affect a person, that needs to be disclosed in your privacy policy.

"Significantly affect" is the key phrase. We're not talking about an automation that sorts your inbox or drafts a reply for you to send. We're talking about decisions with real consequences for someone: approving or declining a request, setting a price for a particular customer, deciding who gets contacted or prioritised. If a program is making those calls, the new rules want it on the record.

The rubber-stamp trap

Here's the bit that catches people out, and it's worth saying plainly. You can't dodge the rules by having a person click "approve" at the end while the software does all the real thinking. A token sign-off, where nobody genuinely weighs the individual case, is still treated as an automated decision. The label "a human checked it" doesn't change what actually happened.

For human involvement to count, it has to be genuine. That means a real person, with the authority to overturn the result and the information to judge it, actually considering the case in front of them. If your "review step" is someone batch-approving a hundred decisions a minute without looking, that isn't oversight, it's a formality, and it won't protect you. Real human-in-the-loop is the standard, not a checkbox.

Does any of this apply to your business?

Possibly, and it's worth checking rather than guessing. Many small businesses with turnover of $3 million or less have long sat under an exemption, but that exemption has been under review and several obligations are broadening. Some small businesses are already covered regardless, for instance if you provide a health service or trade in personal information.

The sensible posture is to assume good privacy practice is expected of you, then confirm the specifics for your situation. Even where a rule may not strictly bind you yet, doing the right thing by people's data is both good business and the direction the law is heading. We won't overclaim here. The detail depends on your business, and a quick check beats an assumption.

What good practice looks like

If you're building or running automations, a few habits keep you comfortably on the right side of all this, and they happen to make for better systems anyway:

• Know where decisions happen. List any automation that touches a decision about a person, and be honest about whether software or a human is really making the call.
• Keep a real person on the consequential ones. Anything that affects a customer, a price or an approval should wait for genuine human review, not a token tap.
• Say so in your privacy policy. Where automated decisions are made, disclose it in plain language. People should be able to understand what's going on.
• Handle the data carefully. Collect only what you need, keep sensitive information protected, and be able to explain how a decision was reached if someone asks.

This is exactly how JDCS builds anyway. Our whole approach to AI automation keeps you approving anything that touches a customer, so the human stays in the loop by design rather than as an afterthought. The reforms simply make that the expected baseline, which suits us fine.

A simple way to get ready

You don't need a compliance project. Start with a short audit: walk through your automations and mark the ones that make or shape a decision about a person. For each, ask two questions. Is software making the call? And if a human signs off, is that review genuine? Where the answer leaves you uneasy, that's where to add real oversight and a line in your privacy policy.

If you'd like a structured way to set the rules for your whole team, our free AI policy and safe-use course walks through writing a simple, practical AI policy, including how to handle automated decisions and human review. And if you want a second opinion on which of your flows this even applies to, that's a good use of a free AI consulting conversation. For the wider picture on data handling, our guide on whether your data is safe with AI is a useful companion read.