OAIC: Your Booking Widget May Need Disclosure by 10 Dec 2026
From 10 December 2026, the OAIC requires any organisation using personal information in automated decision-making to disclose it in their privacy policy. A clinic's auto-accepting booking widget, suitability quiz, or triage chatbot can fall inside that definition.
Vikas Thakur Founder, RockingWeb 9 min read 
On this page 10
- Key Takeaways
- What the OAIC Actually Announced
- Why a Booking Widget Can Count as “Automated Decision-Making”
- The Second Part of the Test: Does It Actually Matter?
- What to Add to Your Privacy Policy Before 10 December 2026
- How This Compares to Western Australia’s Own ADM Rule
- A Simple Audit for This Week
- FAQ
- Get Your Clinic’s Website Checked Before December
- Sources and References
Key Takeaways
- From 10 December 2026, APP entities using personal information in automated decision-making (ADM) that could significantly affect someone’s rights or interests must disclose it in their privacy policy, under Australian Privacy Principle 1.7 and 1.8, added by the Privacy and Other Legislation Amendment Act 2024
- The OAIC’s consultation on guidance ran 18 May to 15 June 2026, with final guidance due by September 2026, three months before commencement
- The OAIC’s own research found 89% of Australians believe they should know when their data drives an ADM decision affecting them, and 86% want government to publicly report on the technology used
- “Computer program” is defined broadly to include pre-programmed rule-based processes, not just AI, and the OAIC names chatbots as falling inside that definition
- The OAIC’s own worked examples of “arranged for” ADM include software that automatically approves or declines applications on an entity’s behalf
- Access to healthcare services is one of the Explanatory Memorandum’s own named examples of a decision that can “significantly affect” a person’s rights or interests
- Western Australia’s separate ADM rule, under the Privacy and Responsible Information Sharing Act 2024, already commenced 1 July 2026 and goes further, requiring notification and a right to request human intervention
From 10 December 2026, the Office of the Australian Information Commissioner will require a new line in your privacy policy: what personal information you feed into automated decision-making, and what kinds of decisions it makes. Picture the booking form on your site right now. If it auto-accepts a request without a staff member checking availability first, that is automated decision-making under the OAIC’s own working definition. So is a suitability quiz that routes an enquiry, and so is a chatbot that triages a question before a human sees it. None of that requires artificial intelligence. A pre-programmed rule is enough. This guide covers what the OAIC’s issues paper says counts, and how to check your own site before December.
What the OAIC Actually Announced
The Privacy and Other Legislation Amendment Act 2024 inserted a new transparency obligation into Australian Privacy Principle 1. The OAIC’s issues paper, published 18 May 2026, sets out a three-part test: the entity has arranged for a computer program to make, or do something substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual’s rights or interests; and personal information is used in the program’s operation to make it.
If all three apply, the entity discloses, in its privacy policy, the kinds of personal information used and the kinds of decisions made. Submissions on the draft guidance closed 15 June 2026, and the OAIC intends to publish final guidance by September 2026, three months before the 10 December 2026 commencement.
Takeaway: this is a commenced legal obligation with a fixed date, not a proposal.
Why a Booking Widget Can Count as “Automated Decision-Making”
Here is where most clinic owners assume this doesn’t apply to them. “Computer program” sounds like it means AI. It doesn’t, not under this rule. The OAIC’s issues paper states the term takes its ordinary meaning and covers “pre-programmed rule-based processes, artificial intelligence and machine learning processes.” A simple if-this-then-that rule counts the same as a neural network.
The OAIC’s own worked examples make the clinic parallel obvious. One scenario it lists as an entity having “arranged for” a computer program to make a decision: a business that contracts a third-party software company to automatically approve or decline refunds on its behalf. Swap “refund” for “appointment request,” and you have a standard clinic booking stack. A widget that auto-accepts a booking against available slots is doing exactly what that example describes. Chatbots are named explicitly too, as generative AI tools used to generate text.
Takeaway: the test starts with the mechanism, not the sophistication. Rule-based counts the same as AI-based.
The Second Part of the Test: Does It Actually Matter?
Meeting the “computer program” limb is not the whole story. The decision also has to be one that “could reasonably be expected to significantly affect the rights or interests” of the person involved. The Explanatory Memorandum names a decision affecting access to a significant service or support as an example, and specifically lists access to healthcare services.
That is the piece that pulls a clinic booking system inside the frame. A decision about whether someone gets an appointment is a decision about access to a healthcare service, the same category as the memorandum’s other examples, a housing benefit or a life insurance contract decision. Whether a specific triage rule on a specific clinic’s site clears that bar is a judgement call for that clinic, and the OAIC’s guidance due September 2026 should sharpen the line.
Takeaway: “significantly affect rights or interests” is the filter, and access to healthcare is one of the regulator’s own named examples of what clears it.
The issues paper cites the OAIC’s own research: 89% of Australians believe they should know when their data is used in ADM that could affect them, and 86% believe government should publicly report on the technology used. Those numbers sit at the top of the paper’s executive summary, ahead of the legal detail.
Takeaway: almost nine in ten Australians already expect this disclosure. A privacy policy update is the low-cost way to meet that expectation before December.
What to Add to Your Privacy Policy Before 10 December 2026
Under APP 1.8, the disclosure has three parts. Here is what each one could look like on a clinic website, illustratively.
| APP 1.8 disclosure item | What it could cover for a clinic site |
|---|---|
| Kinds of personal information used | Contact details, requested appointment time, intake or quiz answers fed into the booking or triage logic |
| Kinds of decisions made solely by the program | An appointment auto-accepted or auto-declined without a staff check |
| Kinds of decisions the program substantially contributes to | A chatbot’s routing recommendation, or a quiz score, that staff act on without materially changing it |
Commercial-in-confidence detail about how a system works internally is excluded. You name the categories, not hand over your booking platform’s source code.
Takeaway: the disclosure is about categories of data and categories of decisions, not a technical audit of your booking software.
How This Compares to Western Australia’s Own ADM Rule
If your clinic operates in Western Australia, a second obligation is already in effect. The Privacy and Responsible Information Sharing Act 2024 (WA) commenced its own ADM provision, Principle 10, on 1 July 2026, asking for more than the federal privacy policy line.
| Feature | Federal APP 1 obligation | WA Privacy and Responsible Information Sharing Act 2024, Principle 10 |
|---|---|---|
| Commencement | 10 December 2026 | 1 July 2026 |
| Where disclosure appears | Privacy policy | Direct notification to the individual, plus information on request |
| Right to request human intervention | Not included | Included |
The federal rule only requires the information to sit in your privacy policy. The WA rule requires direct notification and a right to request human review. If both apply, the WA obligation is the stricter one to design around.
Takeaway: the two rules commence months apart and ask for different things. Building to the WA standard covers the federal one, not the other way around.
A Simple Audit for This Week
List every point on your site where a system decides something without a staff member’s input first:
- Booking or scheduling widgets that auto-accept or auto-decline
- Suitability or eligibility quizzes that route an enquiry
- Chatbots that triage a question before a human replies
- Waitlist logic that reorders requests automatically
- Finance or payment-plan pre-qualification widgets
For each, note what personal information it uses and what decision it feeds into. That list is the raw material for the privacy policy update, and a sensible addition to a wider AHPRA compliance review of your site.
Takeaway: the audit is a five-item checklist, not a rebuild.
FAQ
What is the OAIC’s automated decision-making transparency obligation, and when does it start?
From 10 December 2026, APP entities using personal information in ADM that could significantly affect someone’s rights or interests must disclose the kinds of personal information used and decisions made, under APP 1.7 and 1.8, added by the Privacy and Other Legislation Amendment Act 2024.
Does a clinic’s booking widget count as automated decision-making?
It can. The OAIC defines computer program broadly to include rule-based processes, not just AI, and lists software that automatically approves or declines applications as a worked example. Whether disclosure is triggered then depends on whether the decision could significantly affect a patient’s rights or interests, and the Explanatory Memorandum names access to healthcare services as an example of exactly that.
Do chatbots and suitability quizzes on a clinic website count too?
Yes. The OAIC’s issues paper states that generative AI tools, including chatbots, fall within the definition of computer program for this obligation. A triage chatbot or suitability quiz that routes an enquiry is doing something substantially and directly related to a decision, the first limb of the APP 1.7 test.
What exactly has to go in the privacy policy?
Under APP 1.8, entities disclose the kinds of personal information used by the relevant computer programs, the kinds of decisions those programs make alone, and the kinds of decisions they substantially and directly contribute to, even where a human makes the final call. Commercial-in-confidence detail is excluded.
Get Your Clinic’s Website Checked Before December
RockingWeb builds and audits websites for AHPRA-regulated clinics, including the booking systems and chatbots behind the enquiry form. Get a plain-language walkthrough of what your site’s automated components are doing before the deadline lands.
Talk to us about your clinic’s website
Sources and References
OAIC - consultation page: publish date, deadline and commencement date
OAIC - Automated Decision-Making Transparency Obligation (APP 1) Issues Paper, May 2026: the test, disclosure requirements, worked examples and research findings
Norton Rose Fulbright - secondary source corroborating the definition and commencement date
Western Australian Legislation - Privacy and Responsible Information Sharing Act 2024, Schedule 1 Principle 10 (Automated decision-making), current as at 1 July 2026
Related reading:
- Talk to RockingWeb: a full review of your clinic’s site against current advertising and compliance rules
- Cosmetic Clinic Websites: compliant website builds for AHPRA-regulated clinics
For a website build that keeps pace with rules like this one, see ClinicPipeline or talk to us about your clinic’s marketing.
Vikas Thakur
Founder of RockingWeb. 16 years building for companies like TPG, iiNet and Monadelphous, now focused on websites and marketing that comply with AHPRA's advertising guidelines and still book patients.
