What actually changes on 10 December 2026, and what your IT provider is getting wrong

If you run an Australian business, you have probably had an email in the last few months telling you that the Privacy Act's small business exemption disappears on 10 December 2026, that 2.5 million businesses are about to be regulated, and that you should book a compliance audit immediately.

The date is real. Almost everything else in that sentence is not.

We have read a lot of these warnings, mostly published by IT providers, and the pattern is consistent: two entirely separate reforms, one legislated and one still a draft, get merged into a single deadline. The result is businesses buying compliance projects for an obligation that does not exist yet, while ignoring one that has been enforceable since last year.

The claim doing the rounds

The standard version reads something like: "From 10 December 2026, the $3 million small business exemption is removed and approximately 2.5 million Australian businesses must comply with all 13 Australian Privacy Principles."

Removing the exemption is a genuine policy commitment, and it was one of the Attorney-General's Department's agreed responses to the Privacy Act Review. But agreeing to do something is not the same as having done it. The exemption sits in the Privacy Act 1988, and removing it requires amending legislation that, as at September 2026, has not passed.

What exists instead is an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026, carrying roughly forty proposals, including a single "fair and reasonable" test for collection, use and disclosure. It was released for public consultation, and that consultation was still open this month. An exposure draft is a proposal the government is asking for comment on. It is not a commencement date.

What is actually law on 10 December 2026

The genuine deadline comes from the Privacy and Other Legislation Amendment Act 2024, which passed in late 2024. Most of it commenced immediately or shortly after. One significant piece was deliberately deferred by 24 months to give organisations time to prepare, and that is the part landing on 10 December 2026: transparency about automated decision-making.

From that date, if you are an APP entity and you use personal information in a computer program to make, or substantially support, a decision that could reasonably be expected to significantly affect an individual's rights or interests, your privacy policy must disclose:

• the kinds of personal information used in those decisions, and
• the kinds of decisions made using that information.

Note the shape of this obligation. It is a disclosure requirement, not a prohibition and not a consent requirement. You are not being told you cannot use automated decision-making. You are being told you have to admit that you do.

Does automated decision-making capture you?

This is where most businesses guess wrong in both directions. "Automated decision-making" sounds like it means a machine learning model, so businesses without a data science team assume it cannot apply. In practice the trigger is much broader, and it is usually satisfied by software you bought rather than software you built.

Three conditions have to line up: personal information is involved, a computer program makes or substantially supports the decision, and the decision could significantly affect someone's rights or interests. Things that routinely qualify:

The awkward cases are the ones where a human is nominally in the loop. "Substantially support" is doing real work in that definition. If a system produces a score and a person approves the outcome without meaningfully reviewing the inputs, that is still substantial support. A rubber stamp is not a human decision.

The practical exercise is unglamorous: list every system that touches personal information, and for each one ask what decision it produces and whether that decision changes someone's access to a job, money, housing, a service, or their reputation. Most businesses find between zero and three. Plenty of businesses genuinely find zero, and for them the December date means nothing at all, which is worth knowing before paying for a project.

The change that already happened

Here is the part that gets almost no attention from the same newsletters warning about December, and it is the one we would worry about first.

On 10 June 2025, a statutory tort for serious invasions of privacy came into force. For the first time in Australian law, an individual can sue directly over a serious invasion of privacy.

The significant detail is who it applies to. The tort is not limited to APP entities. It is not switched off by the small business exemption. A business under the $3 million threshold, a contractor, an individual employee: all can be sued directly. To succeed a claimant must establish that they had a reasonable expectation of privacy, that the invasion was serious, and that their privacy interest outweighs any countervailing public interest. They do not need to prove financial loss.

Every business currently relying on the small business exemption is already exposed to direct legal action. That has been true since June 2025.

So the honest framing is close to the opposite of the marketing one. The exemption has not protected you from being sued for over a year. Whether it eventually disappears from the Privacy Act is a question about regulator oversight and the 13 Australian Privacy Principles: a real question, but a second-order one next to the liability that already exists.

What is still only a draft

To be explicit, because the conflation is the whole problem:

Will the exemption eventually go? Probably. It has been criticised for years, Australia is an outlier in having it, and the government has committed to removing it. If and when it does, the sensible expectation is a transition period rather than an overnight switch; the policy intent has always been to give small businesses time.

But "probably, eventually, with a transition period" is a very different planning input from "you have until December." One justifies building good habits. The other justifies an emergency budget.

What to actually do between now and December

Our advice to clients has not changed much, because the things worth doing are worth doing regardless of which reforms land.

1. Do the automated decision-making inventory. It is a half-day exercise for most businesses. List systems holding personal information, identify which produce decisions that significantly affect people, and write down the answer. If the answer is "none", document that you checked; that record is the useful artefact.

2. If you do use ADM, update the privacy policy before December. This is a drafting task, not an engineering project. Describe the kinds of information and the kinds of decisions in plain language.

3. Treat the security basics as the real deadline. Australian organisations notified 1,205 data breaches in 2025, an 8% rise on the prior year and the highest annual figure since mandatory reporting began in 2018. Malicious or criminal attacks drove about two-thirds. Ransomware notifications rose 24%. Compromised credentials were the root cause in roughly a quarter of all breaches.

That last statistic is the one to sit with. A quarter of reported breaches trace back to a credential someone obtained and used. Multi-factor authentication on email, remote access and administrative accounts is not a compliance control; it is the single highest-return security change available to most businesses, and it addresses the most common cause of the incidents actually being reported.

4. Have a breach response plan you have read out loud. If the exemption is removed, the Notifiable Data Breaches scheme extends to newly covered businesses, and the clock on an assessment is short. Knowing who calls whom, who can take a system offline, and where the backups are, before you need it, is worth more than a policy document nobody has opened.

5. Be sceptical of December-shaped urgency. If a provider is quoting you for Privacy Act compliance work, a fair question is: which specific obligation, in which Act, commencing on what date? A good provider will answer without hesitating. If the answer is vague, the deadline is doing the selling.

The genuinely useful work (knowing what personal information you hold, where it lives, who can reach it, and what happens when something goes wrong) pays off under any version of these reforms. It also happens to be the work that stops you being in the breach statistics, which is a better outcome than being compliant while being breached.