What actually commences on 10 December
One thing: a transparency requirement about automated decisions, created by a new APP 1.7 with APP 1.8 setting out what has to be said. From that date a covered organisation’s privacy policy must set out three things. The kinds of personal information used in computer programs that make decisions about people. The kinds of decisions those programs make on their own. And the kinds of decisions where the program does something substantially and directly related to the decision without quite making it.
The date is not a guess or an interpretation. The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. Section 2 of that Act commences this Part on “the day after the end of the period of 24 months” from assent, and the Act’s own commencement table prints the resulting date as 10 December 2026. The OAIC says the same thing in its guidance. You will still find the eleventh quoted in places, including by at least one national law firm, which tells you something about how carefully the rest of the commentary has been checked.
That third limb is wider than it reads. The OAIC published its guidance ahead of the start date and signalled a broad interpretation: a program does not have to replace the whole process to be caught. Output that informs, influences or shapes a decision a person then signs off on can still be in scope, and the decision has to significantly affect someone’s rights or interests rather than be trivial.
The obligation sits with the business using the software, not the company that sold it. “That is our supplier’s system” does not move it anywhere.
What is not commencing
The removal of the small business exemption is not law. The government agreed to it in principle after the Privacy Act review. There is no bill before Parliament doing it, and no commencement date has been announced. The same goes for the fair and reasonable test on collection and use, a right to erasure, and reform of the employee records exemption. All of it sits in the next tranche, all of it is unlegislated, and none of it has a date you can put in a diary.
What did pass has already started. The statutory tort for serious invasions of privacy commenced on 10 June 2025 under Schedule 2 of the same Act, and the OAIC’s enforcement powers and penalty range were lifted at the same time. If you were going to worry about one thing from the last round of reform, it is that a person can now sue, not that a December deadline is coming.
For most of the practices we support, the exemption was never the question
This is the part the December headlines bury. The $3 million threshold comes with a list of exceptions, and two of them cover a large share of the businesses reading this.
Health service providers are covered no matter what they turn over. The OAIC reads that broadly, covering services relating to “physical, emotional, psychological and mental health”, and its own checklist extends to child care centres and private schools. A two-chair dental practice billing $700,000 a year has been bound by the Privacy Act since 2001. It has no exemption to lose in December or at any other time.
Reporting entities under the AML/CTF Act are also covered regardless of turnover. That list grew by around 100,000 businesses on 1 July 2026, when Tranche 2 brought in law firms, accounting practices, conveyancers and real estate agents. Section 6E(1A) treats a reporting entity as an APP entity for the personal information it handles under that regime, which is why we wrote separately about the client ID scans sitting in those practices’ filing systems. A suburban conveyancer that was outside the Privacy Act in June was inside it in July, and almost nobody told them.
So when a vendor email warns your clinic or your firm about losing the exemption, the honest reply is that you never had it.
Who does still have it
Plenty of our clients. An architecture studio, a design practice, a display and fitout contractor, most not-for-profits under the threshold. For those businesses nothing changes on 10 December unless they are doing something with automated decisions, and the exemption continues until a future government legislates it away.
Does the December change reach a small practice?
Often not much, and it is worth saying that plainly rather than selling a panic. Most clinics and firms do not run software that decides things about people without a human in the chair.
But look properly before concluding that. The things to check are anything that scores, ranks, flags, triages or shortlists using personal information. A recall system that decides which patients get chased and which do not. Booking or triage software that prioritises. Payment risk scoring in a practice management system. A screening tool that sorts job applicants. And anything where someone has started running client or patient information through a generative AI tool to help decide something that matters, which the OAIC guidance treats as in scope unless there is real human oversight over it.
What to do before 10 December
If the Privacy Act applies to you, which for every dental practice, medical clinic, law firm and accounting practice reading this it does, the work is short.
List the software that touches personal information and ask each vendor, in writing, whether their product makes or materially shapes decisions about individuals. Written answers matter here, because the obligation lands on you and a verbal assurance from a support rep is not a record.
Where the answer is yes, your privacy policy needs updating by 10 December to describe the information used, the decisions made automatically, and the decisions the software shapes. Where the answer is no across the board, write that conclusion down with the date and who checked. An organisation that assessed its systems and found nothing in scope is in a very different position to one that never looked, and the difference only shows up when somebody asks.
If you are genuinely exempt, do not run the business as though privacy is optional
The Notifiable Data Breach scheme, tenders, professional indemnity insurers and increasingly clients themselves all ask the same questions regardless of what the Act requires of you. Being under the threshold is a legal position, not a commercial one. And the exemption has been on the reform list for three years now, which is long enough to stop treating it as permanent.