Insight, published 13 November 2026, 5 min read
What the 10 December 2026 automated-decision rules mean for your data
A plain-English guide to the Privacy Act automated decision-making transparency duties starting 10 December 2026, and the data work behind meeting them.
The short version
From 10 December 2026, organisations covered by the Privacy Act 1988 must add information to their privacy policy when they use computer programs to make, or help make, decisions that significantly affect individuals' rights or interests. The change came in through the Privacy and Other Legislation Amendment Act 2024 and sits in Australian Privacy Principle 1.
What must be disclosed
The policy needs to describe the kinds of personal information used in these decisions and the kinds of decisions made or substantially assisted by software. The duty applies to decisions made after the start date, even where the system or the data pre-dates it.
Why this is a data problem, not just a policy problem
You cannot describe what you cannot find. Most organisations have automated or semi-automated decisions scattered across credit, claims, hiring, pricing, eligibility and service allocation. Few can list them, name an owner for each, or show which fields of personal information feed them.
A practical path in four steps
First, inventory every place software makes or informs a decision about a person. Second, classify which decisions are significant using the OAIC guidance published on 30 September 2026 and your own legal advice. Third, record the data inputs, the owner and the human review step for each. Fourth, update the privacy policy from that register, and keep the register current.
Where we help
We build the automated-decision register, trace the personal information that feeds each decision and prepare plain-language inputs for your privacy team. We do not give legal advice, and we work alongside your counsel.
Sources
General information only, not legal advice. Facts checked 13 November 2026; confirm with your own counsel.
Book a readiness review
Insight, published 13 November 2026, 5 min read
Climate reporting data: building a Scope 3 spine before your second reporting year
ASRS Group 2 began on 1 July 2026 and Group 3 follows on 1 July 2027. Here is how to prepare the data behind Scope 3 emissions disclosure.
The timetable
Mandatory climate reporting under the Australian Sustainability Reporting Standards started with Group 1 for years beginning on or after 1 January 2025. Group 2 began for years starting on or after 1 July 2026, and Group 3 follows for years starting on or after 1 July 2027. Which group applies depends on size and other thresholds.
Why Scope 3 is the long pole
Scope 3 emissions are not required in an entity's first reporting period, but they apply from the second. They depend on supplier and customer data that most organisations do not collect in a usable, auditable form today.
Suppliers will ask first
Smaller businesses that supply into a Group 2 entity are likely to receive data requests well before their own obligations start. A clear, repeatable way to answer them is a commercial advantage as well as a compliance step.
What a data spine looks like
Start with a supplier and category map. Define the calculation method and emission factors once. Pull activity data from procurement, finance and operations systems with lineage back to source. Keep an audit trail of every adjustment so limited assurance reviewers can follow it.
Where we help
We design and run the Scope 3 data spine: the supplier data model, the calculation engine and the evidence trail. We work with your sustainability, finance and assurance teams rather than around them.
Sources
General information only, not legal advice. Facts checked 13 November 2026; confirm with your own counsel.
Book a readiness review
Insight, published 13 November 2026, 4 min read
CPS 230 and your data: a practical checklist for APRA-regulated entities
APRA's CPS 230 has been in force since 1 July 2025. These are the data questions that sit underneath critical operations and service provider risk.
Where CPS 230 stands
CPS 230 Operational Risk Management took effect on 1 July 2025 for APRA-regulated entities, replacing the earlier outsourcing and business continuity standards. Contracts with existing service providers must comply from the earlier of their next renewal or 1 July 2026. APRA published targeted amendments to the standard in April 2026.
Why data sits underneath it
The standard asks entities to know their critical operations and the providers they depend on. Each critical operation relies on specific data, systems and people. If those dependencies are not mapped, impact tolerances and service provider registers are guesses.
A checklist to start
List your critical operations. For each, record the systems, datasets and material service providers it depends on. Record the owner and the recovery expectation. Test whether you can reconstruct key data after a disruption. Keep the evidence where an auditor can find it.
Where we help
We map critical operations to the data and services behind them, build the supporting register and prepare evidence packs for your risk committee and board.
Sources
General information only, not legal advice. Facts checked 13 November 2026; confirm with your own counsel.
Book a readiness review
Insight, published 13 November 2026, 4 min read
Six questions that show how ready your data is for AI
Published surveys suggest most Australian organisations lack a data readiness baseline. Six questions a board can ask this month.
The gap is measurable
Surveys published by SAP and Elastic in 2026 found that 73% of Australian organisations reported poor data quality, 72% had no baseline for AI readiness, and only 8% tracked what their AI delivered. Both companies sell in this market, so read the numbers as indicative.
The six questions
Do you know where your critical data lives? Is data quality measured against agreed rules? Does each automated decision have a logged owner? Do high-impact decisions have a defined human review step? Do you track whether AI delivers its promised outcome? Could you show data lineage to an auditor tomorrow?
How to use them
Score each question as yes, partly or no. Two or more answers of no in the first four questions means foundations and assurance should come before new AI projects.
Try it
Our self-assessment on this page turns the six questions into a score and a suggested first move. It is for orientation, not an audit.
Sources
General information only, not legal advice. Facts checked 13 November 2026; confirm with your own counsel.
Book a readiness review
Insight, published 13 November 2026, 4 min read
AI agents need a control tower: governing agentic AI in Australian organisations
As AI agents take actions on their own, organisations need one view of what each can access and what it has done.
Agents act, so governance must too
AI agents do more than answer questions. They call systems, change records and trigger payments. That makes the governance questions sharper: what can this agent reach, who approved it, and who is watching.
What the surveys suggest
In Elastic's published research on Australian organisations, 49% of respondents said AI agents had taken incorrect actions, and only 31% reported a central view of their agents. Treat the figures as indicative, since Elastic is a vendor in this space.
What a control tower provides
An inventory of every agent and its owner. The data and systems each can access. An activity log with human intervention points. Policy limits on spend and permissions. A way to pause or roll back.
Start small
Begin with the three agents that touch customers or money. Register them, log them and define the review step. Expand from there.
Sources
General information only, not legal advice. Facts checked 13 November 2026; confirm with your own counsel.
Book a readiness review
Insight, published 13 November 2026, 4 min read
Sovereign, hybrid or cloud-first: choosing where Australian data lives
A neutral framework for comparing cloud, sovereign and hybrid data platforms for Australian organisations.
Three questions before three options
Where must the data physically reside? Which legal jurisdictions can compel access to it? Who holds the encryption keys? Answers to these narrow the field before any vendor is considered.
Comparing the options
Cloud-first offers speed and a wide service catalogue. Sovereign options offer clearer jurisdiction and control, sometimes with a narrower catalogue. Hybrid keeps the most sensitive data under tighter control while using cloud services for the rest, at the cost of more complexity.
Design for exit
Whatever you choose, document how you would move. Portable formats, tested backups and contract terms that support exit protect you from lock-in and are consistent with the direction of regulatory expectations on service providers.
Where we help
We run a structured comparison against your obligations and risk appetite, and design the target architecture and migration path. We do not sell cloud capacity, so the comparison stays neutral.
Sources
General information only, not legal advice. Facts checked 13 November 2026; confirm with your own counsel.
Book a readiness review
