10 Dec 2026 ADM Rule: Does Your Booking Logic Count

From 10 December 2026, any APP entity that has “arranged for” a computer program to make, or substantially help make, a decision that could significantly affect someone’s rights or interests must disclose that in its privacy policy, under new subsections inserted into Australian Privacy Principle 1 (APP 1) by the Privacy and Other Legislation Amendment Act 2024. For a cosmetic clinic or dental practice, that test can reach further than “we don’t use AI.” It can reach the automated triage rule in your booking widget, the waitlist scoring your practice software runs quietly in the background, and any pricing logic that varies by who is looking at the page.

Key takeaways

• The ADM transparency obligation commences 10 December 2026, inserted into APP 1 of the Privacy Act by the Privacy and Other Legislation Amendment Act 2024.
• Three conditions all have to be met before disclosure is required: a computer program made or substantially helped make a decision, the decision could reasonably significantly affect someone’s rights or interests, and personal information was used to do it.
• The OAIC names access to healthcare services as an example of a decision that can “significantly affect” someone under this test.
• The OAIC’s own worked example treats differential pricing driven by personal data as a potential trigger, directly relevant to any clinic running dynamic online pricing.
• The disclosure test covers third-party software your clinic switched on, not only code your clinic built, under the “arranged for” wording in APP 1.7(a).
• The OAIC published a consultation Issues Paper on 18 May 2026, closed submissions 15 June 2026, and intends to release final implementation guidance by September 2026, before the obligation takes effect.
• Commercial-in-confidence information about how a vendor’s automated system works is excluded from the disclosure requirement, per the Bill’s Explanatory Memorandum.
• No infringement or enforcement action can exist yet for this specific obligation because it has not commenced.

What the OAIC says the rule actually requires

The OAIC’s Automated Decision-Making Transparency Obligation (APP 1) Issues Paper, published 18 May 2026, sets out the three-part test in plain terms. From the commencement date, disclosure is required where:

1. the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision, and
2. the decision could reasonably be expected to significantly affect the rights or interests of an individual, and
3. personal information about the individual is used in the operation of the computer program to make the decision, or do the thing that is substantially and directly related to making the decision.

Where all three are met, APP 1.8 requires the privacy policy to disclose: the kinds of personal information used in the program, the kinds of decisions made solely by the program, and the kinds of decisions where the program does something substantially and directly related to a human decision-maker’s call. The OAIC’s own consultation page puts it directly: “the new obligations commencing on 10 December 2026 require APP entities engaging in automated decision making to update their privacy policies to provide adequate information to individuals with on these decisions.”

The Issues Paper also gives a worked example of where the line sits. If a pre-programmed spreadsheet formula pulls a person’s age from a date of birth field, that is “directly related” to a decision but not “substantially related,” because it is just arithmetic. If the same formula generates a risk score that a human then relies on to decide an outcome, that score becomes both “substantially” and “directly” related, because it is a key factor in the human’s decision. The gap between those two examples is exactly where most clinic booking logic sits, and it is worth reading twice before you decide your clinic is in the clear.

The regulator says X; the build consequence is Y; whether X applies to your circumstances is a question for your medical defence organisation or your lawyer.

What that means for your build

Most cosmetic clinics and dental practices do not write their own automated decision-making. They switch it on inside a booking platform, a payment processor, or a chatbot plugin. That matters, because APP 1.7(a) uses the words “arranged for,” and the Issues Paper is explicit that this test catches an entity that configures or directs a third party’s automation, not only the entity that built it. Four places to check on a typical clinic website and booking stack:

• Booking rules engine. Any setting that auto-approves, auto-declines, or auto-routes an online booking request based on form answers (procedure type, age field, medical history questionnaire, previous no-show count).
• Waitlist and priority scoring. Practice management or booking software that ranks or reorders a waitlist using a scoring formula rather than strict first-in, first-served.
• Dynamic or tiered pricing. Any script, plugin, or promo-code logic that varies the price a visitor sees based on inferred segment, location, device, or browsing history, not just a flat published price list.
• Chat or intake bots. A website chatbot or intake form that scores urgency or eligibility and auto-routes the enquiry, rather than simply forwarding every enquiry to a human.

For each one, the practical fix is not a code change by 10 December 2026. It is an accurate sentence in your privacy policy, under a heading such as “Automated decision-making,” naming the kinds of personal information the program uses and the kinds of decisions it makes or feeds into. Field names and settings screens vary by vendor (Cliniko, Halaxy, Power Diary, Nookal, Fresha, Pabau, Dental4Windows and similar all handle booking rules differently), so the accurate answer for your clinic starts with asking your vendor what automation is switched on for your account, not with assuming the default configuration is automation-free.

Does your booking logic clear the bar

That chart is drawn from the OAIC’s own October 2025 desktop review of 23 government agencies with statutory authority to use ADM, referenced in the same Issues Paper. It is a government-sector sample, not a clinic-sector one, but it is the clearest evidence the regulator itself has published that disclosure is currently the exception, not the norm, going into a rule that assumes the opposite from 10 December 2026.

Getting the disclosure text right by the commencement date matters more than getting the underlying automation removed, and that is a smaller job than most clinics assume.

Two worked examples

Cosmetic clinic. A Perth clinic runs anti-wrinkle and dermal filler bookings through a widget that combines a date-of-birth field with an intake questionnaire. The date-of-birth check alone, used only to block under-18 bookings by arithmetic, is unlikely to trigger disclosure on its own, following the OAIC’s own example. But the same widget also runs a risk-scoring rule that reads the intake answers (previous adverse reactions, current medications, pregnancy status) and auto-declines or auto-flags a booking for practitioner review. That scoring step is a computer program substantially and directly related to a decision about access to a health service, using personal information, which the Issues Paper lists as an example of a decision that can significantly affect someone’s rights or interests. On the OAIC’s own test, that combination is a reasonable candidate for APP 1.8 disclosure. These are illustrative example numbers and settings, not a real clinic’s configuration.

Cosmetic dental practice. A dental practice’s website chatbot triages incoming enquiries, scoring each one for urgency based on the symptoms typed in, then automatically offering the next available slot to “urgent” enquiries ahead of routine ones already in the queue and applying a call-out surcharge to same-day bookings. The urgency score is substantially and directly related to a decision about who gets access to a significant service, and the same-day surcharge is a form of the differential pricing the OAIC names as a possible trigger for “significantly affect the rights or interests” under APP 1.9(d). This is a hypothetical build pattern used to illustrate the test, not a description of any named vendor’s product.

What to check on your own site

• Ask your booking or practice-management vendor, in writing, which automated triage, waitlist scoring, or dynamic pricing features are switched on for your account, and get the answer before you draft new privacy policy wording.
• Find your current privacy policy page and confirm it has a section, however short, that can hold an “automated decision-making” disclosure without a full rebuild of the page.
• List every form field on your booking flow that feeds a rule (not just a display), and mark which ones combine more than one input into a score or flag.
• Check whether any pricing shown at checkout varies by anything other than the selected treatment and quantity.
• Confirm which entity in your stack “arranged for” each automated feature: your clinic (if you configured or enabled it) or the vendor operating it independently of your settings.
• Diarise a review date in November 2026, after the OAIC’s intended September 2026 guidance release, to finalise your privacy policy wording before 10 December 2026.

Those two figures, from the OAIC’s own research cited in the Issues Paper executive summary, are the reason this obligation exists in the first place: 89 per cent of Australians believe they should have the right to know when their personal information is used in automated decision-making that could affect them, and 86 per cent believe government should publicly report on any technology used to inform decision-making.

Enforcement anchor

There is no infringement notice, determination, or complaint outcome for this specific obligation, because it has not commenced yet and cannot be enforced before 10 December 2026. The closest available signal of regulator intent is the OAIC’s own October 2025 desktop review of government agency ADM disclosure under the Freedom of Information Act, a different Act to the one this obligation sits in, which found three in four of a 23-agency sample could not be identified as disclosing ADM use at all. Treat that as evidence of the regulator’s stated priority, not as a penalty precedent for this rule.

Where this gets hard

The OAIC’s own consultation is still asking stakeholders to help define “substantially and directly related” and “significantly affect,” which means the exact line is not settled even inside the regulator as of the source paper. A clinic drafting privacy policy wording before the OAIC’s intended September 2026 guidance is drafting against a moving target, and a reasonable, good-faith reading today may need a follow-up edit once that guidance lands. The commercial-in-confidence carve-out in the Bill’s Explanatory Memorandum also means a clinic may not always be able to get full detail from a vendor about exactly how a third-party scoring system works, which can make an accurate, specific disclosure genuinely hard to write. None of this changes the commencement date. It changes how much certainty you should expect to have on 9 December 2026.

Status

In force from 10 December 2026, not yet commenced as at the date of this post: the obligation was enacted by the Privacy and Other Legislation Amendment Act 2024, and the OAIC’s implementation guidance was in consultation (Issues Paper published 18 May 2026, submissions closed 15 June 2026, guidance intended by September 2026) at time of writing.

Frequently Asked Questions

Does the 10 December 2026 ADM rule apply to a small cosmetic clinic?

The rule sits inside APP 1, so it applies to whichever entities already count as an APP entity under the Privacy Act. Health service providers are already covered regardless of annual turnover under existing law, separate from the unrelated small business exemption debate, so most clinics need to check this even if they turn over less than $3 million.

Does using a booking platform’s built-in features count as my clinic doing automated decision-making?

Possibly. The OAIC’s Issues Paper says the test is whether your clinic “arranged for” a computer program to make or substantially help make a decision, which can include switching on a vendor’s automated triage, waitlist, or pricing feature, not just code you wrote yourself.

What exactly has to go in the privacy policy from 10 December 2026?

Under APP 1.8, three things: the kinds of personal information used in the automated program, the kinds of decisions made solely by the program, and the kinds of decisions where the program does something substantially and directly related to a human making the decision.

Need a hand with your website?

If you want a second pair of eyes on how this applies to your own site, request a callback and we will talk it through.

Sources and References

1. OAIC, Consultation on Guidance for Transparency in Automated Decision Making, published 18 May 2026, submissions closed 15 June 2026. Date checked: 15 August 2026.
2. OAIC, Automated Decision-Making Transparency Obligation (APP 1), Issues Paper, 18 May 2026 (PDF, oaic.gov.au). Date checked: 15 August 2026.
3. OAIC, Automated decision-making and public reporting under the Freedom of Information Act, published 21 January 2026. Date checked: 15 August 2026.
4. Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024. Date checked: 15 August 2026.
5. OAIC, The Privacy Act. Date checked: 15 August 2026.

Last reviewed: 15 August 2026.