On 10 December 2026, new transparency obligations under Australia's amended Privacy Act take effect. For small and medium businesses, this is the date the compliance conversation stops being optional.

What's actually changing

The amendments introduce automated decision-making (ADM) transparency obligations: if your business uses any automated system to make or help make decisions that significantly affect a customer (credit, pricing, eligibility, risk scoring), your privacy policy now has to say so, in plain terms. The OAIC has also begun 2026 compliance sweeps, actively checking whether businesses' privacy policies and practices meet the new standard, not just waiting for complaints.

Who this affects

More businesses than you'd think. The existing small business exemption (turnover under $3 million) still exists, but it's narrowing, and several categories were never covered by it regardless of size: businesses that trade in personal information, provide health services, or are contracted to the Commonwealth. If you collect customer data, run any kind of scoring or eligibility logic, or operate in a regulated sector, turnover alone won't tell you whether you're exempt.

Penalties if you get it wrong

A privacy policy that doesn't meet the required standard can attract a penalty of up to $66,000. Serious or repeated breaches carry much higher exposure, up to $50 million or 30% of adjusted turnover for the relevant period, whichever is greater. These aren't theoretical numbers, they're the same structure that's already driven billions of euros in GDPR enforcement overseas, and Australia's regulator has signalled it intends to use its new powers.

What to do before 10 December

Start with an honest audit of what your privacy policy currently says versus what it needs to say. If you use any automated decisioning, disclose it. If your policy hasn't been updated since before the 2026 amendments, assume it doesn't meet the new bar. A Deep Scan against the current requirements takes minutes and tells you exactly where the gaps are, so you're not guessing three weeks out from the deadline.

This is general information, not legal advice. For advice on your specific obligations, speak with a qualified privacy lawyer.