Getting privacy-ready

On 10 December 2026, new automated decision-making (ADM) transparency requirements under the Privacy and Other Legislation Amendment Act 2024 will come into force. From that date, Australian Privacy Principle (APP) entities will be required to include information about certain ADM processes in their privacy policies.

In addition, the government will be tabling the final Privacy Amendment (Personal Data Protection) Bill 2026 in parliament early next year representing tranche two of Australia’s Privacy Act reforms. The bill represents a decisive shift in the government’s approach and will require organisations to substantially overhaul how they collect, use and manage personal information.

For agencies with complex technology environments, decades-old systems and large volumes of personal information, the 10 December deadline is not something that can be addressed by updating a privacy policy in late November. The work should be well underway. The December deadline should be a prompt to get the broader privacy house in order – understand what data is held, where it flows, how it is protected, how it is used in decision-making and whether existing systems and processes can withstand scrutiny.

The privacy house needs a health check

The Privacy Act has been around since 1988, but the environment in which it operates has changed dramatically. AI and automated decision-making are increasingly influencing how government agencies manage information and deliver services, while privacy law is developing alongside these technologies.

The 13 APPs remain the foundation for effective data governance. They are sometimes treated as a compliance hurdle, something cleared at the beginning of a project and then forgotten but in 2026, that approach carries significant risk. APP 11, which requires entities to take reasonable steps to protect personal information from misuse, interference and loss, remains particularly important. Reasonable steps must be measured against the nature of the entity, the sensitivity and volume of information held, and the current threat environment.

Systems, data and services are increasingly shared with contractors and external providers. Risk does not disappear when a function is outsourced. Agencies need to understand the systems supporting their services, the information flowing through them and whether contractual arrangements adequately address privacy and security risk.

The scale of potential consequences has also changed. The maximum penalty for a serious interference with privacy is now the greater of $50 million, three times the benefit obtained, or, where that cannot be determined, 30 percent of an entity’s adjusted turnover during the relevant period.

Know what your systems are doing

The new legislation applies anywhere a computer program makes decisions, or does something substantially and directly related to making a decision, that can affect an individual’s rights or interests or if personal information about that individual is used. It can apply to newly adopted AI but also relatively simple rule-based formulas, benefit calculators and other systems that have been embedded in government processes for years. The first task for agencies should therefore be to map their information and decision-making flows.

Critical issues to be considered include what systems are being used to make or inform decisions? Where does personal information enter those systems? Which decisions are likely to significantly affect an individual’s rights or interests? Who understands how the underlying system works? And can the agency explain that process clearly to the person affected and to the public?

For agencies operating decades-old systems, this may be a significant forensic exercise. Translating ancient logic and complex processes into plain English for a public-facing privacy policy will take time. Privacy impact assessments can identify risks early, while data-flow mapping can expose information being collected, transferred or retained without a clear contemporary purpose. Data minimisation should be part of this process. The question should increasingly be whether information needs to be collected and retained in the first place. Information that is not held cannot be breached.

The APS AI Plan 2025 sets out a roadmap for responsible AI use across government, including AI literacy, governance, procurement and impact assessment. Agencies need the right leadership and accountability structures to turn these requirements into practice. AI systems should be assessed for fairness and bias, transparency and explainability, human oversight and data minimisation. The National AI Assurance Framework provides a shared language and set of practices for managing these risks.

Use the deadline to get ahead of the risk

The privacy, security, data governance and automated decision-making requirements are interconnected. An agency cannot confidently explain an automated decision without understanding the data and systems underpinning it, demonstrate reasonable security without knowing where its information is held, or effectively govern AI without clear accountability for data and technology.

That is why the December 2026 deadline should be a catalyst for a broader privacy health check, rather than a point-in-time compliance exercise. The APPs remain the starting point, while the developing case law and AI reforms point to stronger expectations around security, governance and accountability. The ADM transparency requirements provide a clear date by which agencies need to understand and explain the systems and processes they have in place.

The work now is practical: understand what information is held, where it moves, how it is protected and how it is used to make or inform decisions. Doing so will help agencies meet the December deadline while giving them a clearer view of the privacy, security and governance risks already sitting within their technology environments.

Published on governmentnews.com.au in October 2026.

About SPA Australia

SPA Australia (Systems Planning & Analysis, Australia) is a leading provider of integrated legal, commercial, consulting and analytics services to government.      

Our multidisciplinary approach, trusted advice and leading-edge technology and analysis help clients deliver measurable outcomes.    

In 2025, SPA Australia acquired Proximity, a highly regarded professional services firm specialising in government legal, consulting, and commercial advisory services.    

Our parent company, SPA, has more than 3,000 employees in 30 locations within the US, UK and Australia. In Australia, more than 130 employees are based across Canberra, Melbourne, Sydney and Adelaide, where our local teams deliver sovereign capability backed by global expertise.