Australia · Retail privacy
Does your software decide who gets a refund - or a job?
Your privacy policy may need an update.
Retail software does more than process sales. It can flag customers as a fraud risk, screen job applicants, set personalised prices and help decide refund requests.
From 10 December 2026, new privacy requirements mean retailers covered by Australia's privacy laws may need to tell people more about these decisions in their privacy policies.
What should retailers look out for?
Think about the systems you use every day:
- Returns: Does your system flag a customer as a "serial returner" and recommend refusing their refund?
- Online orders: Does a fraud tool automatically block a purchase or customer account?
- Recruitment: Does software shortlist applicants or screen people out?
- Loyalty programs: Can your system cancel memberships or remove valuable rewards?
- Pricing: Do customers see different prices because of information you hold about them?
- Store security: Do you use facial recognition to match shoppers against a watchlist?
These activities need checking - not every automated decision will be caught. The key issue is whether software uses someone's personal information to make, or play a substantial and direct part in, a decision that could significantly affect them.
The OAIC's examples include recruitment screening, retail facial recognition and personalised pricing for significant goods. Routine product recommendations or small promotional offers will not necessarily meet the threshold.
"We don't use AI" doesn't settle it.
Ordinary software can be covered too. And having a staff member click "approve" does not automatically remove the need to disclose how the system is used.
What should you do now?
Start with a simple question for your ecommerce, customer service and HR teams:
Include marketing and IT, and check with your software providers if you are unsure.
Where the new rules apply, your privacy policy needs to explain what types of personal information are used, which decisions the software makes on its own and which decisions it substantially and directly helps people make.
Updates must be in place by 10 December 2026.
Need help checking your retail systems and updating your privacy policy? Contact Watchdog Compliance.