The 10 December Privacy Law Changes Are Coming. Is Your Agency Ready?
On 10 December 2026 a new set of privacy obligations commences in Australia. For most real estate agencies the honest answer is that one of them matters to you, one of them almost certainly does not, and a good deal of what is being written about both is wrong.
Here is what actually lands, what it asks of an agency, and the question you need to answer before any of it applies to you at all.
What Actually Commences on 10 December
Two things are worth separating.
The automated decision making transparency requirement. New provisions, APP 1.7, 1.8 and 1.9, are inserted into the Australian Privacy Principles. They require an APP entity's privacy policy to disclose its use of automated decision making. Civil penalties attach to a privacy policy that does not meet them.
The Children's Online Privacy Code. The regulator must register the code by the same date. It applies to online services likely to be accessed by children, which means websites, apps, games and social platforms that children actually use, not services designed only for them.
For an ordinary agency, the first one is the live issue and the second one almost certainly is not. We will come back to why.
The Automated Decision Making Rule, in Plain English
The rule applies where a computer program makes a decision, or substantially assists in making one, that could reasonably be expected to significantly affect a person's rights or interests, and personal information is used in doing it.
Where that happens, your privacy policy has to set out two things: the kinds of personal information used in the automated decision making, and the kinds of decisions that are made or substantially assisted that way.
That is the whole obligation. It is a privacy policy requirement. It is not a separate notice you have to hand someone at the time, and it does not oblige you to offer a human review of the decision.
That last point is worth holding onto, because it is the single thing being reported wrongly most often. A good deal of the commentary describes a duty to tell people a decision was automated, explain how it was reached and give them a path to human review. That is not what these provisions say. They require disclosure in your policy. Anything beyond that is someone describing a different jurisdiction's law, or describing what they think good practice looks like.
What Counts as Automated Decision Making in an Agency
This is where it stops being abstract.
The obvious candidate is automated tenancy application screening. If software scores, ranks, filters or shortlists applicants, and a person's ability to get a home turns on the output, that is a decision affecting their rights or interests, and personal information is being used to reach it.
Others worth checking:
Affordability or income-to-rent calculations that produce an automatic pass or fail
Automated identity verification or document matching, particularly anything doing facial comparison
Background or database checks that return a result your team acts on without reviewing the underlying data
Any third party platform that hands you a score, a rating or a recommendation about an applicant
The question is not whether a human clicks the final button. It is whether the program substantially assisted the decision. A shortlist generated by software and approved without much scrutiny is still a decision the software substantially assisted.
Most agencies have never asked their proptech suppliers what their tools do under the surface. That is the work between now and December.
But First: Does the Privacy Act Apply to You at All?
None of this reaches you unless the Privacy Act does, and that is not automatic.
We set the position out in full in the small business privacy exemption has not ended, and it is worth reading before you spend a dollar on this. In short: the small business exemption is still law. If your annual turnover is $3 million or less, the Act generally does not apply to you.
Becoming an anti-money laundering reporting entity on 1 July 2026 pulled agencies into the Act, but only in relation to their anti-money laundering activities. Not the whole business.
Follow that through and something useful falls out. Tenancy application screening sits in property management. Property management is not a designated service under the anti-money laundering rules. So for a small agency that is covered only because it is a reporting entity, automated tenancy screening sits outside the coverage, and the December rule does not reach it.
If your turnover is above the threshold, or something else already brings you into the Act, the position is the opposite and the whole business is in scope.
Two agencies of similar size can therefore land in completely different places. Work out which one you are before you build anything.
Case Study
The Screening Tool Nobody Had Asked About
A principal we spoke with was confident the December change was irrelevant, because nobody at the agency used AI. The property management team used an application platform that ranked applicants and surfaced the top three. Nobody had ever asked how the ranking worked. That is automated decision making by any reading of the provisions, and it had been running for two years. The fix was not difficult. Finding out it existed was the hard part.
Case Study
The Six Week Project That Was Not Required
Another agency read that the children's code applied to any business with a website and started scoping a consent and age-verification project. The code is aimed at online services likely to be accessed by children. An agency website advertising properties to adult buyers and renters is not what it is for. The project was stopped before it cost anything beyond a fortnight of someone's attention.
What the Rule Does Not Fix
Worth saying plainly, because the disclosure obligation can create a false sense of completion.
Disclosing that you use automated screening does not make the screening fair. Those are two different questions under two different bodies of law. Privacy law asks whether you told people. Other laws, including those dealing with discrimination, ask whether the decision itself was lawful.
A tool that quietly weights an applicant down for a postcode, a name, an income source such as a pension or family payment, or a gap in rental history is a problem whether or not your privacy policy mentions it. Writing it into your policy documents the practice. It does not defend it.
So ask the supplier two questions, not one. What information does the tool use, and what is it doing with it. If nobody at the company can explain how the ranking is produced, that is worth knowing before a tenant's advocate asks you the same thing.
What to Do Before December
If the Act applies to your business, or to a part of it that involves automated decisions, the work is genuinely modest.
Ask every software supplier one question in writing: does your product make, or substantially assist in making, decisions about individuals, and what personal information does it use to do it?
List what comes back. Tenancy screening, affordability scoring, identity matching, anything that produces a rating.
Update your privacy policy to describe the kinds of personal information used and the kinds of decisions involved. Plain language, not a technical annex. You also need to disclose if you DO NOT use such software or apps.
Decide whether you are comfortable with what the tools are doing, separately from whether you have disclosed it. Disclosure is the legal obligation. Whether the screening is fair is a business and reputational question, and it is the one that ends up in the news.
Diarise the date. The obligation commences 10 December 2026 and civil penalties attach to a policy that does not meet it.
None of that requires a project plan. It requires someone to ask the supplier a question and then write two paragraphs.
Where This Sits in the Bigger Picture
Privacy has moved from a background obligation to a scheduled one, with dates attached and penalties behind them. The pattern is the same as the one we saw when privacy audits have started well before most agencies were ready.
Our Free Real Estate Agency Privacy Legal Guide covers the wider privacy picture for agencies, and AML and privacy compliance for real estate agencies sets out how the two regimes now sit together.
The headline will tell you December is a deadline you are not ready for. For most agencies it is a question for your software suppliers and two paragraphs in a policy. That is a very different job, and it is worth knowing which one you actually have before you start. Getting that scoped sits under compliance and licensing, alongside the rest of real estate agency law.
Key Takeaways
Two things commence on 10 December 2026: the automated decision making transparency requirement, and the registration of the Children's Online Privacy Code.
The automated decision making rule inserts APP 1.7, 1.8 and 1.9. It requires disclosure in your privacy policy, nothing more.
It does not require a separate notice, and it does not create a right to human review. Commentary saying otherwise is wrong.
It applies where a computer program makes, or substantially assists in making, a decision that could reasonably be expected to significantly affect a person's rights or interests.
For agencies the obvious candidate is automated tenancy application screening, along with affordability scoring, identity matching and any third party tool that returns a score or ranking.
A human clicking the final button does not take you outside it. The test is whether the program substantially assisted.
The Children's Online Privacy Code applies to online services likely to be accessed by children. An ordinary agency website is not the target.
None of it reaches you unless the Privacy Act does. The small business exemption is still law, and a reporting entity under $3 million is covered for its anti-money laundering activities only.
Because property management is not a designated service for AML, tenancy screening at a small agency may sit outside coverage entirely. Check which side of the line you are on first.
Civil penalties attach to a privacy policy that does not meet the requirement.
Next Steps
If nobody at your agency can say what your tenancy screening software actually does with an applicant's information, that is the thing to find out before December. It is one question to your supplier, and the answer decides whether you have any work to do at all.
Not sure whether any of this reaches your agency? Book a free 10 min call with a member of our team.
Frequently Asked Questions (FAQ)
-
Two things. New provisions, APP 1.7, 1.8 and 1.9, require an APP entity's privacy policy to disclose whether it does or does not use automated decision making. Separately, the Children's Online Privacy Code must be registered by that date, and it applies to online services likely to be accessed by children.
-
Not as a separate notice. The obligation is to describe your use of automated decision making in your privacy policy, covering the kinds of personal information used and the kinds of decisions involved. A good deal of commentary describes a duty to notify at the time and offer human review. That is not what these provisions require.
-
Very likely yes, if it scores, ranks, filters or shortlists applicants using their personal information. A person's ability to get a home is a decision affecting their rights or interests, and the test is whether the program substantially assisted the decision, not whether a human approved the result.
-
That does not automatically take you outside the rule. The provisions cover decisions substantially assisted by a computer program, so a shortlist generated by software and signed off without much scrutiny is still caught.
-
Almost certainly not. The code is aimed at online services likely to be accessed by children, such as apps, games and social platforms. A website advertising properties to adult buyers and renters is not what it is designed for. Check it properly if you run something aimed at a younger audience.
-
It depends on whether the Privacy Act applies to you at all. The small business exemption is still law. If you are covered only because you became an anti-money laundering reporting entity, you are covered for your anti-money laundering activities, and property management is not a designated service, so tenancy screening may sit outside coverage. Confirm your position before you act.
-
Civil penalties can apply to an APP entity whose privacy policy does not meet the automated decision making requirement. The practical exposure is the policy itself, so it is a cheap thing to get right and an avoidable thing to get wrong.
Luke Shumack – Principal, Realgate Legal
Luke Shumack is one of the Principals at Realgate Legal with a Bachelor of Laws and a sharp focus on helping agencies and business owners stay compliant while scaling with confidence. Since starting his legal career in 2021, Luke has worked closely with real estate agencies, startups, and established businesses on privacy compliance, employment law, contractor agreements, mergers and acquisitions, and corporate governance. Known for his tech savvy approach and love of efficiency, Luke blends legal precision with practical business strategy, making the complex simple for clients who want to move fast without risk.
Boring legal stuff: This article is general information only and cannot be regarded as legal, financial or accounting advice as it does not take into account your personal circumstances. For tailored advice, please contact us. PS - congratulations if you have read this far, you must love legal disclaimers or are a sucker for punishment.