Property Managers and the 10 December Privacy Deadline for Automated Decisions
On 10 December 2026, a small new rule in the Privacy Act switches on, and it lands squarely on property management.
It does not ban anything. It does not stop you using AI. What it does is require your privacy policy to say, in plain terms, where software is making or heavily shaping decisions about people. And in a rent roll, the decisions that matter most to people are about whether they get a home.
Plenty of agencies have not looked at this yet. Some assume it only applies to "real AI". Some assume the small business exemption covers them. Some assume that because a human clicks approve, nothing is automated. All three assumptions are shakier than they look.
Here is what the rule actually says, which parts of a property management business it is likely to touch, and a practical checklist to be ready with weeks to spare.
Quick answer: From 10 December 2026, businesses covered by the Privacy Act must state in their privacy policy when software makes, or substantially helps make, decisions that could significantly affect a person using their personal information. For property managers, tenancy screening is the main risk. A human clicking "approve" does not switch the rule off.
What the new rule says, in plain English
The rule sits in Australian Privacy Principle 1, the one that governs your privacy policy. It was added by privacy reforms passed in late 2024, with a two-year runway that ends on 10 December 2026.
It is triggered when three things are all true:
- You have arranged for a computer program to make a decision, or to do something that is substantially and directly related to making a decision.
- The decision could reasonably be expected to significantly affect the rights or interests of an individual.
- Personal information about that person is used in the operation of the program.
When all three are true, your privacy policy must describe:
- the kinds of personal information used by those programs,
- the kinds of decisions made solely by a program, and
- the kinds of decisions where a program does something substantially and directly related to the decision (in other words, where software is shaping a human's call).
That last category is the one most businesses miss.
Four words that decide whether you are in scope
The Office of the Australian Information Commissioner (OAIC) published an issues paper in May 2026 as it prepared its guidance, and it is worth reading closely, because it signals a broad reading. You can see the OAIC consultation on automated decision-making transparency directly.
| Term | What it means in practice | Why property managers should care |
|---|---|---|
| Computer program | Deliberately broad. Rule-based formulas, AI, machine learning, chatbots, even commonly used software and spreadsheets | This is not only about "AI". A scoring formula in a spreadsheet can count |
| Substantially | The program's output is a key factor in the human's decision | A score or ranking your team relies on to shortlist applicants is likely a key factor |
| Directly | The output has a direct connection to making the decision | A risk flag that feeds straight into approve or decline is direct |
| Arranged for | The business responsible for putting the program in place, even if someone else operates it | Buying a third-party screening product does not move the obligation to the vendor |
The OAIC's own example makes the point well. A spreadsheet formula that scores callers to a crisis line, where that score is a key factor in who gets helped first, is caught. The same spreadsheet working out someone's age from their date of birth is not. The tool is identical. What matters is the role its output plays in the decision.
Also note that "making a decision" includes refusing or failing to make one. A tenancy application quietly dropped to the bottom of the pile by a scoring system is still a decision.
Where this shows up in a property management agency
Here is an honest map of common property management processes against the rule. This is a risk view, not a legal ruling, and your answer depends on exactly how each process works in your office.
| Process | Likely in scope? | What decides it |
|---|---|---|
| Tenancy application screening with a score, ranking or risk rating | High risk | A decision about whether someone gets a lease plainly affects their interests, and a score is designed to be a key factor |
| Checking applicants against a tenancy database or verification service | Medium to high | Depends on whether the result automatically filters people out or drives the call |
| AI summary of an application that a property manager reads | Medium | A neutral factual summary is lower risk. A summary that labels someone "high risk" starts to look like a key factor |
| Automated arrears escalation and breach notices | Medium | If software decides who gets a breach notice and when, it shapes a decision about the tenancy |
| Maintenance triage and job routing | Low | Mostly decisions about properties and trades, not about a person's rights |
| AI drafting of tenant and owner emails | Low | A person writes, reviews and sends. The AI is not making a decision about anyone |
| Listing copy, owner reports, internal notes | Very low | No decision about an individual |
The pattern is clear. The more a system sorts, scores or filters people, the more likely it is caught. The more it drafts or summarises for a human who genuinely decides, the less likely.
"But a human always approves it"
This is the most common reason agencies assume they are fine, so it deserves a straight answer.
The rule explicitly covers decisions where a program "does a thing that is substantially and directly related to making the decision". That wording exists precisely because software is often used to recommend or guide a human decision-maker. If the property manager approves whoever the system ranked first, a human pressed the button but the program was a key factor. That is a disclosable category in its own right.
A human in the loop is still the right design. It is what keeps the decision fair, explainable and defensible, and it matters well beyond privacy, including under anti-discrimination law. It just does not make the transparency obligation disappear. The goal is a real human judgement, and an honest description of the role the software plays.
"We are a small business, so the Privacy Act does not apply"
Maybe. But property management is one of the worst industries in which to lean on that assumption.
The small business exemption (for businesses turning over under $3 million) has exceptions, and handling residential tenancy database information is one of them. Agencies can also bind themselves to Privacy Act standards through contracts, and removing the exemption altogether has been on the reform agenda for years.
The regulator is also looking at this sector specifically. In January 2026 the OAIC began its first ever privacy compliance sweep, checking the privacy policies of around 60 businesses across six sectors that collect personal information in person. Rental and property was one of the six. The OAIC noted penalties for infringements of up to $66,000.
The sensible operating stance: build as if the Australian Privacy Principles already apply to you, and get advice on your specific position.
The 10 December checklist for property managers
You do not need a big project. You need an honest inventory and a clear paragraph. Here is the sequence I recommend.
- List every tool that touches an applicant or tenant. Screening and verification services, your property management software's automations, spreadsheets with formulas, AI assistants, chatbots. Include anything staff set up themselves.
- For each one, ask the three questions. Does it make or substantially shape a decision? Could that decision significantly affect the person? Does it use their personal information?
- Ask your vendors directly. "Does your product score, rank or filter applicants? What data does it use? Is any of it automated end to end?" You arranged for it, so you need the answer.
- Decide where a human genuinely decides. For anything touching tenancy approval, write down who makes the call, what they look at, and that they can and do override the system.
- Update your privacy policy in plain language. Describe the kinds of personal information used, the kinds of decisions made solely by software, and the kinds of decisions software substantially helps with. Clear categories, not source code.
- Train the team. Your staff need to know which tools are approved for applicant data and which are not. Personal AI accounts holding tenant information are a separate and very common problem, and a short written AI policy fixes most of it. Our guide on how to write an AI policy for your business walks through it.
- Put a review date in the diary. New automations get added quietly. Check every quarter what has become automated since the policy was written.
The OAIC said it intends to publish its guidance before the rule commences. Check oaic.gov.au for the final version before you lock your wording in.
This is general information, not legal advice. Confirm your obligations with a privacy or property lawyer.
Why this is good news for agencies that get it right
It is easy to read a new compliance rule as another cost. I would push back on that.
Every agency is about to be asked the same question by an increasingly informed rental market: "Did a computer decide this?" The agency that can answer calmly, in plain English, with a named person accountable for every tenancy decision, is the one landlords and tenants trust. The agency that has to go and find out is the one that ends up in a complaint.
And the work that makes you compliant is the same work that makes AI safe and useful in the first place: know what your tools do, keep humans on the decisions that matter, and let the software take the grind. If you want the broader picture of where AI genuinely helps a rent roll, read our guide to AI for property managers in Australia.
Frequently asked questions
When does the automated decision-making rule start? 10 December 2026. From that date, businesses covered by the Australian Privacy Principles must include the required information about automated decisions in their privacy policy.
Does the rule stop property managers using AI to screen tenants? No. It is a transparency rule, not a ban. It requires you to disclose the kinds of personal information and decisions involved. Anti-discrimination law, consumer law and your real estate licensing obligations still apply to how you screen, whatever tools you use.
If a property manager makes the final call, is the process still automated decision-making? It can be. The rule covers programs that do something substantially and directly related to a decision, such as a score or ranking that is a key factor in the human's call. Human approval does not remove the obligation if the software heavily shaped the outcome.
Does this only apply to AI tools like ChatGPT? No. "Computer program" is read broadly and includes rule-based formulas, spreadsheets, screening software and chatbots. What matters is the role the output plays in a decision about a person, not how advanced the technology is.
What do we actually have to write in our privacy policy? Three things, in general terms: the kinds of personal information your programs use, the kinds of decisions made solely by software, and the kinds of decisions where software substantially helps a person decide. You do not have to publish commercially sensitive detail about how a system works.
Is our small agency exempt? Possibly not. The small business exemption has exceptions, including for handling residential tenancy database information, and it may be removed in future reforms. Get advice on your specific position and plan as if the rules apply.
Get it sorted before the deadline, not after the complaint
Ten weeks is plenty of time to do this properly, and not much time to do it in a panic.
If you want a clear view of which of your processes are caught, where AI can safely save your team hours, and what to fix first, book a free 60-minute AI Game Plan Session. You get a written summary with a real return on investment number attached, and no obligation to do anything with it.
Third Vision helps Australian businesses put AI to work safely, backed by 25 years in IT and security. See how we work with property teams in our solutions, or read more about the Fractional AI Officer approach behind Your AI Growth Department.
