The Privacy Act Just Wrote Your Business Case

You have 11 weeks of funding leverage you’ve never had before.

On 10 December 2026, a new transparency obligation in the Privacy Act goes live. If you’ve been trying to get funding for metadata, lineage or data governance work, this gives you a concrete business driver and a deadline.

The obligation is about automated decision making (ADM) programs where personal information goes in and what comes out either makes a decision about someone or is relied on by a decision maker (e.g. a score about a customer). If that decision could significantly affect them, your privacy policy must describe the kinds of personal information used and the kinds of decisions made.

We still don’t have the OAIC’s guidance, so it is up to you to action this obligation. Law firms have been proactive in writing about the legal side. For data professionals, it comes down to a familiar metadata and lineage question, what personal information feeds these decisions?

Why this is an opportunity

Data teams have argued for metadata, lineage, and stewardship for years, but the value is hard to prove, so the work has mostly gone unfunded. Part of the problem is measurement. Our 2026 State of the Data Management Industry report found 26% of organisations don’t measure data management performance at all, and only 3% measure it rigorously. When work isn’t measured, sustained investment is hard to secure.

What’s been missing is an external driver that makes this work a priority. The Privacy Act update is that external driver and has a date attached. I believe the transparency obligation is only as good as the metadata and lineage behind it. You need to know where the personal information comes from and where it goes. Use this compliance deadline as your opportunity to get funding.

What the obligation covers

The Act says “computer program”, and the OAIC’s consultation paper says it includes “pre-programmed rule-based processes”, not just AI. The obligation also covers programs that are already running, meaning it applies to any decisions made from 10 December, even if the program was previously set up and the personal information collected before then.

One of the OAIC’s own examples is an Excel formula that scores people calling a crisis hotline, where the score helps decide which call gets answered first. The obligation applies to formulas which are “substantially and directly related” to a decision. An AI example would be an insurer’s model that automatically rejects a claim using the customer’s personal information. Both require an understanding of what data is going into the program, something we data professionals have always been promoting.

The Act is interested in identifying the kinds of personal information used in these programs, which raises the lineage question, where does that information come from and where is it used? DAMA’s DMBOK2 describes data lineage as the pathway data follows from its point of origin to its point of use. When we surveyed data professionals for our report, none reported comprehensive lineage or fully catalogued data: 22% capture no lineage and 46% only minimal lineage, while 14% haven’t catalogued their data at all and 32% only minimally. We need to know what personal information is used by our ADM programs, from spreadsheets and business rules to AI models.

What to do in the next 11 weeks

Here are some practical steps you can initiate.

1. Find the decisions. First, the decisions a program makes on its own (e.g. a filter screening out applications before anyone sees them), and secondly decisions a person makes using a program’s output (e.g. a spreadsheet score). To find them ask the people running the system what the program decides without a person, then ask decision makers what they open when they make their choice.
2. Start a register (I know… the DGO in me can’t help it). List the programs, what decision they’re part of and who makes the final call (program or person).
3. Trace the data in. From source, ETL, warehouse, spreadsheet, report, AI program, to decision. Follow what personal information is used along the way. Work with your data engineers here. You don’t need lineage for every single field, so aim for something achievable, like the core information that flows into these ADM programs.
4. Put an owner on each program. Ensure someone is accountable for the system or process and for keeping the register up to date when it changes.
5. Link with your privacy or legal team, so they can use the register to update the privacy policy.

I think it is important to link this to your organisation’s strategy and outcomes and show how the register and lineage can support them. Business analysts are talking about the obligation also, it came up at a recent IIBA Sydney event. Pitch it as joint work that links your data strategy directly to the business, working with the BAs to find what the business uses to make decisions, then the data engineers to trace where that data comes from.

After 10 December

When an auditor, regulator, board or customer asks why a program produced a result, you’ll be ready with your catalogue and lineage. With good metadata, people will trust the reports, AI outputs can improve and there’ll be less time spent rediscovering the same datasets. Your register can also become a starting point for future analytics and AI projects, because you’ll have a clearer understanding of which data feeds which decisions. Turn the obligation into an opportunity and let the date do the work for you.