Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
From 10 December 2026, Australian businesses covered by the Privacy Act 1988 must explain in their privacy policy when they use computer programs, including AI, algorithms and rules-based systems, to make decisions about people. The Privacy and Other Legislation Amendment Act 2024 added Australian Privacy Principles 1.7 to 1.9. They apply where a computer program uses personal information to make a decision, or to do something substantially and directly related to making a decision, that could reasonably be expected to significantly affect an individual’s rights or interests. Your privacy policy must describe the kinds of personal information used and the kinds of decisions made solely by the program or where it plays a substantial part.
Decisions caught by the rules include approving or refusing credit, insurance or a service, pricing and eligibility, screening job applicants, and flagging customers for fraud or account closure. The same 2024 Act gave the Office of the Australian Information Commissioner (OAIC) new powers, including infringement notices for some administrative breaches such as privacy policies that don’t meet APP 1, and a new mid-tier civil penalty for interferences with privacy, alongside the maximum penalties for serious interferences. A statutory tort for serious invasions of privacy has also applied since June 2025. The rules apply to APP entities, which generally means businesses with annual turnover over $3 million plus some smaller ones such as health service providers and those trading in personal information. This check helps you find your automated decisions and get your privacy policy ready.