There is a real Privacy Act deadline on 10 December 2026. It deserves attention, particularly if your business uses software to screen job applicants or decide whether someone can access a service. It does not mean every Australian small business suddenly loses its privacy exemption.
As at 13 October 2026, the $3 million small-business exemption is not being abolished on 10 December under the legislation currently in force. The OAIC's small-business guidance still explains that most businesses with annual turnover of $3 million or less are outside the general Australian Privacy Principles regime, subject to exceptions.
The confusion comes from bundling the existing exemption, enacted privacy reforms, the December commencement and possible future changes into one announcement. Those distinctions matter when somebody is asking you to commission compliance work. A deadline on its own tells you very little about what your business needs to do.
What the December date actually means
The Privacy and Other Legislation Amendment Act 2024 contains several reforms with different commencement dates. Much of Schedule 1 commenced in December 2024. Part 15, concerning automated decisions and privacy policies, commences on 10 December 2026. Passing legislation and commencing every provision are separate events.
The OAIC's announcement of 30 September 2026 explains the coming obligation. APP entities, meaning organisations and agencies covered by the Australian Privacy Principles, must add information to their privacy policies when their computer-assisted decisions meet the specified conditions.
Under APP 1.7, the entity must have arranged for a computer program to make a decision, or perform work substantially and directly connected with making it. The program must use personal information about the individual in that process, and the decision must be reasonably expected to significantly affect that person's rights or interests. All those conditions matter.
Separately, the OAIC has argued for removing the small-business exemption. A reform recommendation does not establish a commencement date. The exemption remains in the current Privacy Act, including sections 6C and 6D. Future reform should be monitored, but it should not be presented as an obligation already imposed on every SME this December.
Recruitment makes the consequences easier to see
I watched the recent 60 Minutes Australia report on older Australians being rejected for jobs by AI. It brings a very practical question into this discussion: what happens to an applicant whose experience never reaches the person doing the hiring?
Nine describes 52-year-old former fashion editor Stacey Duguid's difficulty finding work over 16 months following redundancy. Career coach Leah Lambart explains that employers can use AI to exclude candidates with extensive experience when seeking younger workers. Duguid's account does not establish what caused each rejection, but the screening practice Lambart describes gives employers something concrete to investigate in their own systems.
The connection to December is quite direct. The OAIC's APP 1 guidance specifically gives an example of an organisation obtaining another provider's AI system to screen and rank job applications, leading to a hiring decision. It also identifies access to employment opportunities as a significant interest. That supports examining recruitment screening against APP 1.7; it does not establish that any particular employer in a television report has breached the law.
A covered employer using applicants' personal information in screening that meets APP 1.7's conditions will need the additional privacy-policy disclosures from 10 December. Buying the system from a recruitment software supplier does not automatically transfer that obligation to the supplier. Using AI also does not, by itself, remove an otherwise applicable small-business exemption.
Employers should be careful about assuming the employee-records exemption settles this. The OAIC explains that it does not cover future employment relationships, including collecting information about unsuccessful applicants who are never employed.
An ordinary rules-based system can fall within the provision. The program does not need to generate text, use a large language model or be sold as AI. Equally, using software somewhere in the business does not automatically trigger it. The OAIC's transparency fact sheet explains the scope of the obligation.
Human involvement does not automatically remove the obligation either. I would want an employer to establish whether its software rejects applications, ranks candidates or produces a shortlist that staff rarely look beyond. Those are illustrative uses to assess, rather than findings about the systems in the report. Calling the final step “human review” does not explain how much the software determines who gets considered.
Where the conditions apply, APP 1.8 requires the policy to describe the kinds of personal information used, the kinds of decisions made entirely by the programs, and the kinds of decisions substantially and directly assisted by them. APP 1.9 also covers refusals or failures to decide or act, and significant beneficial effects as well as adverse ones. These details appear in Part 15 of the amending legislation.
The OAIC's APP 1 guidance calls for meaningful, understandable information. Publishing proprietary algorithms or every technical detail is not the requirement. For recruitment, a useful explanation would identify the information used, such as employment history and qualifications, and the selection decisions the software makes or assists. “We may use technology” would tell an applicant remarkably little.
These provisions require disclosure in the privacy policy. They do not themselves ban AI recruitment, guarantee an interview or establish that a screening process is fair. An employer should still want to know whether capable people are being discarded before anyone reads their application. A revised policy will not answer that operational question.
Turnover is only the beginning of the coverage question
A business below the threshold cannot safely stop at its revenue figure. Important exceptions include health-service providers holding health information beyond employee records, businesses trading in personal information, and contracted service providers under Commonwealth contracts. Personal-information trading has qualifications, including consent and collection or disclosure authorised by legislation; an ordinary customer database is not automatically information trading. These distinctions are set out in section 6D.
AML/CTF activities need particular care. The OAIC's guidance for reporting entities explains that Privacy Act obligations apply to personal-information handling connected with those obligations even for small businesses. That does not necessarily bring every unrelated activity of an otherwise exempt business into the APP regime.
These are examples, not the complete coverage test. The OAIC's small-business guidance also identifies other circumstances, including related businesses and voluntary opt-in. If coverage is uncertain, establish it with a qualified privacy adviser before deciding what December requires.
An exemption from the general federal APP regime also leaves room for state and territory privacy laws, alongside relevant sectoral and consumer-protection requirements. The OAIC's guidance for start-ups discusses other applicable requirements. Contractual promises and the practical need to secure customer records do not disappear because a business is small.
Follow the enquiry beyond the website
From a developer's perspective, I would start with what the website and its connected services actually do. A brochure website with an enquiry form might simply email a message to the owner. Another site might send application details into a hosted platform that scores applicants and determines eligibility. The pages could look much the same to a visitor.
Collecting customer information does not, by itself, establish that these new disclosure provisions apply. For a covered business, the question is whether its actual software and decision-making arrangements meet the conditions. The website's appearance is a poor guide to that.
I would follow a sample enquiry through the system, using test details. Establish where it goes and what happens before a person opens it. If another supplier runs the assessment, ask them to demonstrate the relevant settings and outputs. The same practical approach helps when examining customer data held by external providers.
A privacy policy should describe those actual practices. Copying a template that claims the business makes automated decisions when it does nothing of the sort creates its own confusion. So does leaving the policy untouched after adding an eligibility engine.
Solway Web Consulting's role is to help establish the technical facts: data flows, connected services, website functionality and security. Legal interpretation belongs with qualified privacy advisers, working from an accurate account of the system.
Before commissioning a December compliance project, I would ask for the provision being relied on and an explanation of how it applies to the business. If the answer assumes the small-business exemption is disappearing, that needs correcting before the quote is approved.
Tags: security, small-business, web-development, australia