From 10 December 2026, the rules on automated decisions change. Privacy Act changes mean providers using automated tools to make significant decisions must say so in their privacy policy.
A second wave of reforms, released as an exposure draft on 31 August 2026, would also widen what counts as personal information and tighten the rules on consent.
Here’s what disability providers need to know, and what to do before the end of the year.
10 December 2026 – automated decisions
The Privacy and Other Legislation Amendment Act 2024 has passed. From 10 December 2026, your privacy policy must disclose when you use AI or a computer program to make a decision that could significantly affect a person’s rights or interests, and that program uses personal information to do it.
For disability providers. Check any software that
- screens or prioritises referrals and intake
- allocates supports, hours or accommodation
- scores risk or flags behaviours, or
- informs incident escalation or restrictive practice decisions.
If a tool uses participant information and shapes an outcome that matters in someone’s life, it likely belongs in your policy.
The OAIC has published an issues paper on this obligation and APP 1 guidance on what a privacy policy must include.
A wider net for personal information
The exposure draft of the Privacy Amendment (Personal Data Protection) Bill 2026 would define personal information as anything that relates to an identified or reasonably identifiable person. That is broader than today’s test, and it could bring more of what providers hold into scope, from case notes to app and device data that can be linked back to someone.
Genomic information would also be named as both sensitive information and health information. Genetic information is already covered, so this mostly removes any doubt.
Consent has to mean something
Under the draft, consent must be voluntary, informed, current, specific and unambiguous.
Pre-ticked boxes, opt-out models and one broad form covering every possible future use are unlikely to be acceptable. Consent can still be implied where a person’s conduct makes it clear and the purpose is obvious from context.
This can be a big change for disability services, where a single intake pack often bundles consent for sharing with the NDIA, other providers, family and researchers. Each purpose will need to stand on its own, so a person can say yes to one and no to another.
It also fits naturally with supported decision-making. Specific, current consent is consent a person can understand, revisit, and change, with support where they want it.
If you run or join research
The current health and medical research exceptions would be replaced by one human research exception.
To rely on it, research must be reviewed, approved and monitored under the National Statement on Ethical Conduct in Human Research and follow new guidelines from the Privacy Commissioner.
Projects that never needed ethics approval before may now need a Human Research Ethics Committee to sign off. The exception only starts once those guidelines are in place.
What to do now
1. Map your tools. List every system that uses personal information to make or shape decisions about participants, and ask whether the outcome significantly affects them.
2. Update your privacy policy before 10 December 2026. Say plainly which decisions involve automation and what information they use. An Easy Read version helps the humans it’s about.
3. Audit your consent forms. Pull apart bundled consents, remove pre-ticked boxes and build in review points so the consent stays current.
4. Brief your team. Staff need to know personal information is likely to cover more than it used to.
5. Watch the bill. Consultation on the exposure draft closed on 18 September 2026, and the final version may change.
We will keep you updated with any changes as they arise. Keep your eye out on our In The News page!
–
Author: Amanda Robinson (She/Her) BA, MMHealthPrac.
Dja Dja Wurrung and Taungurung Country
Amanda, Head of Learning and Development and an experienced specialist in NDIS and Aged Care, promotes capability and sustainability within the disability and health sectors. With over 15 years of experience, a Master’s in Mental Health Leadership and Management, and an MBA underway, she offers extensive expertise and personal insight as someone with lived experience of disability. A military veteran and dedicated carer of a veteran, Amanda advocates for Human Rights, striving to reduce stigma and eliminate barriers for those with disability and mental health challenges. She is enthusiastic about fostering strong stakeholder relationships through her advocacy, communication, strategic thinking, and analytical abilities.
