Using AI to book or screen customers? Check your privacy policy

Say a dental clinic puts an AI assistant on its after-hours phone line. (An AI assistant is software that answers calls and acts for you, like booking an appointment.) It asks callers about pain, swelling and bleeding. Callers it judges urgent get the first emergency slot next morning. Everyone else is offered a routine booking weeks away.

Nobody at the clinic would call that a decision. Under the Privacy Act it probably is one, and from 10 December 2026 the clinic's privacy policy has to describe it. The rule, Australian Privacy Principle 1.7, was added by the Privacy and Other Legislation Amendment Act 2024. This is general information, not legal advice.

What changes on 10 December

If the Privacy Act covers your business, your privacy policy must explain when software makes decisions about people, where all three of these are true:

• Software makes the decision, or does something closely tied to making it.
• The decision could reasonably be expected to significantly affect a person’s rights or interests.
• The software uses that person's personal information.

The policy must then say what kinds of personal information are used, which kinds of decisions the software makes on its own, and which it plays a big part in.

Saying no counts as a decision, and so does not deciding. Good outcomes count too: fast-tracking a patient counts as much as turning one away. Older systems are not exempt. The Act covers decisions made after the start date, even if the booking system was set up years earlier.

The rule is narrow. The privacy regulator, the OAIC, notes in its issues paper of May 2026 that it gives people no right to challenge a decision, and businesses no duty to notify them. But it has teeth. Under section 13K of the Act, breaking it can lead to fines (through infringement notices) and to compliance notices.

Does it apply to your business?

Most small businesses are not covered by the Privacy Act, but some are, says the OAIC's small business page. Small here means annual turnover of $3 million or less.

Health businesses are the big exception. The OAIC's page on health service providers says a business that provides a health service and holds health information is covered "even if they're a small business". Its examples include dentists, allied health professionals and complementary therapists, Chinese medicine among them.

From 1 July 2026, anti-money-laundering (AML/CTF) rules began to apply to certain services typically provided by lawyers, conveyancers, accountants and real estate professionals. The OAIC's guidance for those businesses says small businesses among them are not covered for their other work.

So the same assistant lands differently:

• A two-dentist practice using it to sort callers by urgency is covered.
• A plumber under $3 million using it for burst pipes generally is not.
• A small law firm is covered for its anti-money-laundering work. Whether its enquiry chatbot is too depends on what it collects and why.
• Mortgage brokers face the same turnover test and exceptions.

Which of your tools count

Chatbots count. The OAIC's issues paper says generative AI tools, "including chatbots, all fall within the definition of computer program". That is the regulator's view in a consultation paper, not a court ruling.

Having staff make the final call does not automatically get you out. If the software's recommendation is a key factor in the decision, it can still count. Software you bought counts too: on our reading, a booking platform's no-show rule becomes yours when you switch it on.

The OAIC said it intended to release guidance by September 2026, but on 22 September 2026 its consultation page linked to none. So what follows is our interpretation.

Probably counts, if your business is covered:

• A clinic's phone or chat assistant that decides who gets an urgent appointment.
• Rules that ask for a deposit, or block online booking, for patients who have missed appointments.
• A broker's tool that tells applicants they will not qualify before anyone reads the file.
• A chatbot that turns away legal enquiries by type of matter or postcode, where the firm is covered for that work.
• Prices that vary by customer. The OAIC asked how big a difference is significant (5%? 20%?) and left it open.

Probably does not count: answering questions about hours, fees or parking; booking exactly the time the caller asked for; interpreting between a Cantonese-speaking caller and a receptionist who then decides. The grey area is a call summary the dentist reads before deciding how urgent a case is.

The OAIC's guidelines on privacy policies say that where people from a non-English-speaking background could be expected to read your policy, appropriate accessibility measures should be available. On our reading, if your assistant sorts callers in Mandarin, an English-only policy is a weak point.

What to write, and what to ask

Write one plain paragraph for each kind of decision. This is an illustration, not a template:

Our after-hours phone assistant uses your name, phone number and what you tell it about your symptoms to decide whether to offer you our next emergency appointment. It makes that decision without a staff member reviewing it first. Our online booking system uses your appointment history to decide whether to ask for a deposit.

A short checklist:

1. Check whether the Privacy Act covers you: turnover over $3 million, a health service of any size, anti-money-laundering work, or another listed exception. If unsure, ask your lawyer or accountant.
2. List every tool that deals with your customers or patients, including features your booking or phone provider switched on by default.
3. Ask your provider which settings decide things automatically, what information they use, and whether staff review a decision before it takes effect.
4. Run each tool through the three tests above. If all three are true, it goes in your policy.
5. Say which decisions software makes alone and which a person finalises, in the languages your assistant speaks.
6. Update your list when your tools change, and check again when the OAIC's final guidance arrives.