The new rules can apply to everyday business systems, including spreadsheet formulas, as well as more sophisticated software like AI.
The Office of the Australian Information Commissioner (OAIC) released updated guidance on 30 September 2026, with examples relevant to healthcare and aged care providers.
Does this affect your organisation?
The new rules apply to organisations covered by the Privacy Act 1988 (Cth).
Medical, dental, and allied health practices that hold health information are covered, regardless of their size. The same applies to aged care providers delivering health-related care.
Other organisations, including many retirement village operators and not-for-profits, are generally covered if their annual turnover exceeds $3 million. Some smaller organisations are also covered for other reasons.
Which software is covered?
There are three questions to ask:
- Does the software use personal information about someone?
- Does it make a decision about that person, or play a substantial and direct part in making one?
- Could the decision reasonably be expected to significantly affect that person’s rights or interests?
If the answer to all three is yes, your privacy policy must address the software’s role.
A decision is significant if it has the potential to considerably affect someone’s circumstances or outcomes, rather than having only a trivial impact. The effect can be positive or negative, and decisions involving children or vulnerable people may have a greater impact.
The OAIC identifies access to healthcare, aged care, and housing as interests that will generally be significant. A decision not to provide a service, or not to take action, can also count.
What should you look for?
One of the OAIC’s examples involves a health and aged care provider using a spreadsheet to score and rank people needing care. The rules apply even where the rankings are used to decide whom not to contact.
Other software worth checking includes systems used to prioritise patients, allocate care services, assess retirement village applicants, or rank job candidates.
A person making the final decision does not necessarily take the software outside the rules. If the software plays a substantial and direct part in that decision, it may still be covered.
The same applies to software purchased from a vendor. Your organisation generally remains responsible for the privacy policy disclosure, even if you cannot control how the software works.
An AI scribe used only to record a clinician’s decisions is less likely to be covered. However, if its summaries or recommendations become a key factor in decisions that significantly affect a patient’s care or access to services, it may be covered.
What needs to go in your privacy policy?
Where the rules apply, your policy must explain the kinds of personal information used and the kinds of decisions the software makes on its own or plays a substantial and direct part in making.
The explanation should be meaningful, particularly where health information is involved, but does not need to include technical detail or trade secrets. Similar decisions can be grouped together.
If there is doubt about whether software is covered, the OAIC recommends taking a cautious approach and including the information.
Why does this matter now?
The OAIC has already started checking privacy policies. In January 2026, it began its first compliance sweep, reviewing around 60 businesses across six sectors, including chemists and pharmacists.
The OAIC can require organisations to fix certain privacy policy breaches and issue infringement notices carrying financial penalties. From 10 December, these powers will also apply to failures to meet the new automated decision-making transparency requirement.
What should you do before 10 December?
Review the systems your organisation uses to make or help make decisions about people. This might include clinical, booking, care-management, admissions, and recruitment software, as well as spreadsheets.
Ask your software providers how their products use personal information and influence decisions. Identify which systems are covered and keep a short record of your assessment.
Update and publish your privacy policy before 10 December. The new rules apply to decisions made from that date, even if the software was already in use. Check whether your collection notices also need updating.
Need assistance?
We can assist with reviewing and updating your privacy policy to reflect new and changing privacy requirements. To find out more, please contact Ryan Callanan.
This article is general information only and is not legal advice.
