Will the 10 December 2026 privacy change affect your business?
Free, about five minutes, no email needed. Your answers stay in your browser unless you ask us to email them.
Check your business
Likely needs action by 10 December 2026Worth checkingProbably not caught
Your answers suggest you'll need to update your privacy policy by 10 December 2026.Some of your answers need checking before anyone can give you a straight answer.The new rule probably doesn't catch you. How your team uses AI still matters.
A preliminary indication based only on your answers. General information, not legal advice: see the disclaimer below.
Why we say that
What to do next
Want a hand before December? Book a 30-minute call. We'll talk through your answers and how your business uses AI and software, then I'll come back with the first step and what it costs. If there's a legal question, I'll point you to a privacy lawyer.
Book a 30-minute callNot sure about one of these? Book a 30-minute call. We'll talk it through, then I'll come back with what needs checking and who should check it.
Talk it throughGet the one-page checklist: how to choose AI tools for client information, what never to paste in, and the settings to switch off.
Want help putting it in place? Book a call. If it's something you can sort yourselves, I'll tell you.
Book a callWant your results by email?
We'll email your result, the reasons and what to do next, plus the one-page AI checklist.
Disclaimer: general information only
This tool provides a preliminary, general indication of whether the privacy policy changes starting 10 December 2026 may apply to your business, based only on the answers you provide. It does not provide legal advice, create a solicitor-client relationship or conclusively determine your business's legal obligations.
Results depend on the accuracy and completeness of your answers and may contain errors, omissions or outdated information. The tool may not identify all applicable Commonwealth, state, territory or overseas laws, exemptions or industry-specific requirements. A result suggesting the new rule may not apply to you is not confirmation that your business is exempt from privacy obligations.
Before relying on any result, obtain advice from a qualified privacy lawyer about your business's circumstances. Having a privacy policy does not, by itself, establish compliance with privacy law.
Based on the Privacy Act and OAIC guidance as at 6 October 2026. Last reviewed: 20 October 2026.
The short answer
From 10 December 2026, businesses covered by the Privacy Act must describe in their privacy policy the decisions a computer program makes, or does something substantially and directly related to making, using personal information, where the decision could reasonably be expected to significantly affect a person's rights or interests.
The policy has to describe the kinds of personal information used, and the kinds of decisions made by the program alone or with its help. This check helps you work out whether that's likely to include you, and where AI fits.
What the check looks at
Your income history, whether you provide health services, and a few special cases that can bring smaller businesses in.
Anything that decides, scores, ranks, filters, recommends, summarises or prioritises something about a person, and whether the outcome could make a real difference to them.
Client, applicant and staff information going into AI tools, meeting recordings, where data is stored, and who owns it.
Why a person signing off doesn't settle it
The rule reaches a program that does something substantially and directly related to making a decision, not only one that decides on its own. Software that recommends, ranks or filters before a person decides generally still counts. A person approving the result doesn't, by itself, take the decision out: the OAIC says only extensive human oversight and control might.
It isn't limited to AI either. Spreadsheets and rule-based systems are treated the same way.
Which check do you actually want?
Whether the 10 December privacy rule is likely to reach your business, and where AI touches personal information.
What could go wrong with one way you use AI, and whether to carry on, fix something first, or stop.
How ready the whole business is to put AI to work.
Questions we get asked
What changes on 10 December 2026?
Businesses covered by the Privacy Act must describe in their privacy policy decisions that a computer program makes, or does something substantially and directly related to making, using personal information, where the decision could reasonably be expected to significantly affect a person's rights or interests. The policy describes the kinds of personal information used and the kinds of decisions involved.
Does it only apply to AI?
No. It applies to any computer program, including spreadsheets and rule-based systems, that makes a decision or does something substantially and directly related to one.
A person checks every decision. Are we outside the rule?
Not on that basis alone. If the software recommends, ranks or filters before the person decides, the decision generally still counts. Extensive human oversight and control may take it outside the rule, but that depends on how much people rely on the software.
We are a small business. Does this apply to us?
Many businesses with annual income of $3 million or less are outside the Privacy Act, but not all. Health service providers, for example, are covered whatever their size, and some activities bring smaller businesses in. The check asks about the main ones.
What happens to my answers?
They're worked out in your browser and not stored. If you ask for your results by email, we keep your email address and a summary of your result so we can send it. If you book a call, the booking form is filled in with your result, your type of business and the decisions you ticked.
Is this legal advice?
No. It's a preliminary indication based only on your answers, using the Privacy Act and OAIC guidance as at 6 October 2026. Other obligations and exceptions may apply that the questions don't cover. For a legal answer about your business, talk to a privacy lawyer.
More free tools
* Disclaimer: general information only
This tool provides a preliminary, general indication of whether the privacy policy changes starting 10 December 2026 may apply to your business, based only on the answers you provide. It does not provide legal advice, create a solicitor-client relationship or conclusively determine your business's legal obligations.
Results depend on the accuracy and completeness of your answers and may contain errors, omissions or outdated information. The tool may not identify all applicable Commonwealth, state, territory or overseas laws, exemptions or industry-specific requirements. A result suggesting the new rule may not apply to you is not confirmation that your business is exempt from privacy obligations.
Before relying on any result, obtain advice from a qualified privacy lawyer about your business's circumstances. Having a privacy policy does not, by itself, establish compliance with privacy law.
Based on the Privacy Act and OAIC guidance as at 6 October 2026. Last reviewed: 20 October 2026.
Want a hand before December?
Book a 30-minute conversation about how your business uses AI and software. I come back with the first step and what it costs.