Find out if the Privacy Act's 10 December changes apply to you — then fix it in an afternoon.
A practical kit, not a compliance project: the 15-minute test, the audit, the privacy policy clause, and a one-page AI use policy for your team. Built from the same research behind our Privacy Act deadline article.
Does this actually apply to you?
From 10 December 2026, if your business uses AI or an automated system to make, or substantially help make, a decision about a person, your privacy policy has to say so. That's narrower than "using AI" generally — here's the quick read before you spend $147 finding out properly.
- A tool that scores, ranks or shortlists leads, applicants or customers
- Anything that approves, declines or prices something for a customer without a human checking first
- AI involved in screening job applicants before a person sees them
- A chatbot or agent that can approve a refund or confirm eligibility on its own
- Missed-call text-back, appointment booking, after-hours triage — a human still decides the job
- AI used for drafting, summarising or admin, reviewed by a person
- Chatbots that answer FAQs without making a binding decision
Either way — every business that sat under the old $3 million turnover exemption needs a real privacy policy from 10 December, whether or not the AI clause applies. The Kit covers both.
Five parts, built to be used the same afternoon you buy it.
The full version of the test above, with more edge cases and examples specific to trades, allied health, professional services and property.
A worksheet walking every system that touches a customer or candidate — missed calls, chatbots, lead scoring, hiring, pricing — flagging where disclosure is likely needed.
Plain-English wording to adapt and drop straight into your existing privacy policy — see the sample below.
Print it, put it on the wall. What's fine for your team to do with ChatGPT/Claude/Copilot day to day, and what needs a second thought first.
An honest boundary — what this Kit covers, and the specific situations where you need real advice instead.
“[Business name] uses [name the tool] to [describe what it does, in plain language]. [State whether a human reviews the outcome before it's acted on.]”
Kept in the section of your policy that deals with how you use personal information — not buried in a separate document, because a customer reading your normal privacy policy needs to be able to find it.
The AI Disclosure Kit
Instant PDF download. No call, no booking — built for one person to work through solo.
- The 2-minute test, in full
- 15-minute audit worksheet
- Privacy policy clause template
- One-page team AI use policy
- When-to-call-a-lawyer guide
- Sourced to OAIC & the 2024 Privacy Act reforms
Questions, answered.
Does this apply to a small business like mine?
Probably not the disclosure clause specifically — most trades and small service businesses won't trip the automated decision-making test. But every business that sat under the old $3 million exemption now needs a real privacy policy regardless, and the Kit's audit checklist tells you in 15 minutes which parts apply to you.
Is this legal advice?
No. It's a plain-English starting point built from public OAIC guidance and the Privacy and Other Legislation Amendment Act 2024. Have your finished privacy policy checked by a qualified solicitor before you publish it, especially if you're in a regulated industry.
What format is it delivered in?
An instant PDF download, available immediately after purchase — no call or booking required.
I've already read the Privacy Act article on your blog — is this different?
The article explains what's changing and why. The Kit is the do-it-yourself version: the audit worksheet, the clause template, and the team policy, ready to fill in and use, rather than background reading.
What if I need more than just the disclosure clause?
If your business has a leadership team of 5 or more and needs full AI governance, tool vetting and a team rollout — not just the Privacy Act clause — the AI Foundations Toolkit covers that, and Disclosure Kit buyers get credited toward it.
This kit provides general business information and is not legal or privacy advice. Whether and how these obligations apply to your business depends on your specific circumstances — get advice from a privacy-qualified lawyer before publishing a privacy policy or relying on any exemption.
Start with what matters.
Tell us what feels slower, harder or less reliable than it should. We'll help you work out whether there's a worthwhile improvement — and the simplest way to make it happen.