The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024, and it staged some of its biggest changes exactly two years out. That clock runs out on 10 December 2026, and two separate obligations share the date.
1. Automated decision-making transparency commences
From 10 December 2026, APP entities that use personal information in automated decision-making with the potential to significantly affect an individual’s rights or interests must say so in their privacy policy — including the kinds of personal information used and the kinds of decisions made.
This is a transparency obligation, not a ban. But it forces a question many businesses haven’t asked: where do our systems make or substantially shape decisions about people automatically? Credit and eligibility scoring, automated screening of applications, algorithmic pricing and AI-assisted triage can all qualify.
The OAIC opened consultation on its ADM transparency guidance on 18 May 2026, ahead of commencement — worth watching for the final wording your privacy policy will be measured against.
2. The Children’s Online Privacy Code must be registered
The same Act requires the OAIC to develop and register a Children’s Online Privacy Code by 10 December 2026, setting out how the Australian Privacy Principles apply to online services likely to be accessed by children — social media and many apps, games and websites. An exposure draft was consulted on earlier in 2026.
One honest nuance: 10 December 2026 is the deadline for the Code to be finalised and registered — that is not necessarily the same day its requirements start operating. If your service is plausibly used by children, track the registered Code’s own commencement terms.
What to do before December
- Map your automated decisions. List where personal information feeds automated or substantially automated decisions that affect people.
- Draft the privacy policy disclosure now. The obligation lands in your privacy policy — the document takes minutes to update once you know what to say, but the mapping behind it doesn’t.
- If children plausibly use your service, read the draft Children’s Code and assign someone to review the registered version when it lands.
- Diarise 10 December 2026. Both items live on our Privacy Act reforms guide, whose change timeline tracks these dates.
Sources
- OAIC — consultation on guidance for transparency in automated decision making
- OAIC — APP 1 guidelines (open and transparent management of personal information)
- OAIC — Children's Online Privacy Code
- Privacy and Other Legislation Amendment Act 2024 (legislation.gov.au)
This article is education, not legal advice. Dates and obligations are cited to the official sources above — the linked source is the authoritative wording. See how we verify.