Does your software decide who gets a refund - or a job?

A refund refused. An order blocked. An applicant ruled out.

Retail software does more than process sales. It can flag customers as a fraud risk, screen job applicants, set personalised prices and help decide refund requests.

From 10 December 2026, new privacy requirements mean retailers covered by Australia's privacy laws may need to tell people more about these decisions in their privacy policies.

The change concerns retailers that are subject to the Australian Privacy Principles. Confirm your business is covered before assuming the new requirement applies - or that a smaller business is exempt.

What should retailers look out for?

Think about the systems you use every day:

• Returns: Does your system flag a customer as a "serial returner" and recommend refusing their refund?
• Online orders: Does a fraud tool automatically block a purchase or customer account?
• Recruitment: Does software shortlist applicants or screen people out?
• Loyalty programs: Can your system cancel memberships or remove valuable rewards?
• Pricing: Do customers see different prices because of information you hold about them?
• Store security: Do you use facial recognition to match shoppers against a watchlist?

These activities need checking - not every automated decision will be caught. The key issue is whether software uses someone's personal information to make, or play a substantial and direct part in, a decision that could significantly affect them.

A helpful product suggestion is different from losing access to essential purchases or an employment opportunity. Consider the value, the consequences and the person's circumstances when assessing significance. A small promotional offer will not necessarily meet the threshold.

Turn the examples into questions for your teams

For returns, ask customer service to walk through a real refund journey: what data creates the flag, what the staff member sees and who can change the outcome. For online orders, check whether a fraud score merely triggers a review or actually prevents checkout.

For recruitment, look beyond the final hiring decision. Ask whether applicants disappear from the shortlist before a recruiter sees them. For loyalty and pricing, map which customer details influence eligibility, rewards or the price displayed.

For store security, involve the team that manages the technology and the people who respond to alerts. Record what happens after a match, including any decision to approach a shopper or restrict access.

"We don't use AI" doesn't settle it.

Ordinary rules-based software can be covered too. And having a staff member click "approve" does not automatically remove the need to disclose how the system is used.

Check what happens in practice: does the staff member independently assess the facts, or usually follow the system's score or recommendation? A tool that simply records a decision already made is different from one that meaningfully shapes it.

Include software supplied by third parties. Buying a platform or outsourcing part of the process does not, by itself, transfer your disclosure responsibility to the provider.

What does your privacy policy need to say?

Where the rules apply, explain three things in language your customers and applicants can understand:

• The information used: the categories of personal information involved.
• Decisions made by software: the types of decisions reached without a person making the decision.
• Decisions supported by software: the types of decisions where a system plays a substantial and direct role.

Match the explanation to your actual setup. A general statement that you "use technology to improve customer service" tells a shopper little about a system that assesses their refund request.

As a practical drafting exercise, ask each team to complete: "We use [information categories] in [process] to [decision or recommendation]. The staff member's role is [actual role]." Use the answers to prepare accurate policy wording, rather than publishing the template unchanged.

The OAIC guidance explains that commercially confidential information is excluded. That is not a reason to leave out a meaningful description of the information and decisions involved.

What should you do now?

Use the period before December to work through the systems, not just edit the wording. A practical retailer checklist is:

• Name an owner. Give one person responsibility for coordinating ecommerce, customer service, HR, marketing, loss prevention and IT.
• Make a system list. Include plugins, fraud tools, applicant tracking systems and services operated by suppliers. Record the decision each one makes or supports.
• Follow the information. Identify the customer or applicant details used, including any scores or profiles the tool generates. Check this with the supplier instead of relying on a sales description.
• Test the real workflow. Ask teams to demonstrate a typical case and an exception. Record whether staff review, override or simply accept the system's output.
• Assess the effect. Consider whether the outcome could significantly affect a person's rights or interests. Keep a short record of the reasons for your assessment.
• Update the relevant policies. Check both customer-facing and recruitment privacy information. Have the operational teams confirm that the description matches how they work.
• Keep it current. Add a privacy check when changing providers, enabling new features or introducing new uses of customer data.

Ask suppliers for a written explanation of the data inputs, outputs and available human controls. A short meeting between your privacy lead and the people using the system can uncover gaps that a policy review alone would miss.

Updates must be in place by 10 December 2026.

Need help checking your retail systems and updating your privacy policy? Contact Watchdog Compliance.

Official sources

• OAIC: automated decision-making transparency fact sheet
• OAIC: APP 1 privacy policy guidelines, September 2026