By Ross Heron | CEO, Australian Payroll Association
A team leader rings payroll. One of their staff worked a double shift last week, but the overtime never showed up in their pay. Payroll checks the roster, then the timesheet and finds the cause: an approval rule set up years ago quietly knocked it back. No one made that call. The software did.
Moments like this are becoming more common. Award interpretation picks the rate, timesheet rules approve or reject hours and remediation tools calculate back pay for thousands of people at once.
From 10 December 2026, a change to the Privacy Act asks organisations to be more open about how software shapes decisions like these. It's a small change on paper, but it points to where payroll is heading: you need to be able to show your workings.
What is changing on 10 December?
From 10 December 2026, organisations covered by the Privacy Act must say in their privacy policy when software makes, or substantially helps make, a decision that could significantly affect a person, for better or worse.
Think of it like an ingredients label. It tells people what goes into the decision, not how their particular result was worked out. The policy needs to describe:
- the kinds of personal information the software uses
- the kinds of decisions the software makes on its own
- the kinds of decisions where the software does something closely tied to a person's decision, such as making a recommendation.
This is broader than "advanced AI". Simple rules-based tools and formulas can count, including software you've used for years. Having a person sign off doesn't automatically take a decision outside the rule either. If the software's output is a key factor in what that person decides, it can still be caught.
The rule applies to decisions made from 10 December, even if the system was set up long before.
The privacy regulator, the OAIC, has now published guidance on how it will apply the rule.
What it doesn't do
It's important not to overstate this change.
- It's not a right to an explanation. An employee can't use it to demand how their own pay was calculated. Unlike Europe's rules, there's no right to request information, to challenge the decision, or to be told individually. The Government has agreed to introduce a right to ask how automated decisions are made, but that's expected in a later round of reforms, with no date set.
- It doesn't cover every business. Most small businesses with annual turnover of $3 million or less sit outside the Privacy Act.
- It may not reach current employees' pay. Private sector employers have an "employee records exemption" for records about their own current and former employees. That exemption doesn't cover job applicants, contractors or workers employed by someone else, and it is being read more narrowly than it once was.
So for many private sector payroll teams, the legal change is modest. Australian Government agencies and larger organisations making decisions about contractors and job applicants are more likely to be affected. Payroll providers and outsourcers should also check where they stand.
Working in the WA public sector? Western Australia's own privacy law has applied since 1 July 2026 and goes further. Organisations it covers must tell people about significant automated decisions, explain them on request and let a person step in.
The system doesn't own the outcome. You do.
Whether or not the new rule applies to you, one thing hasn't changed. "The system calculated it" has never been a defence.
- If software underpays someone, the employer must fix it, with back pay and possible penalties under the Fair Work Act.
- Intentional underpayment has been a criminal offence since 1 January 2025. An honest system error isn't intentional, but ignoring known errors is a different story.
- If a tool produces unfair or biased results, anti-discrimination law and the Fair Work Act still apply.
In short, the software does the work but people own the result. Every automated pay outcome needs a person who understands it and stands behind it.
What to do now
Payroll professionals
- Map it. List every point where software decides or shapes a pay result: award interpretation, timesheet approvals, overtime rules, payment holds, back-pay calculators and bonus tools.
- Understand it. If you couldn't explain a result to the employee in plain English, flag it.
- Record it. Keep a trail of the inputs, the rules applied and who checked and signed off.
- Check it. Build a human review into high-impact results, such as remediation, back pay and final pays.
Bookkeepers
- Know your clients. Check whether each client is covered by the Privacy Act. Turnover above $3 million is the usual trigger.
- Know the tools. Note which client payroll systems automate decisions and who at the client reviews the results.
- Agree the roles. Set out in your engagement who reviews automated results. The legal obligation stays with the employer.
- Check your own practice. If your business is covered, your own privacy policy may need updating too.
HR professionals
- Start with recruitment. Screening software, AI interview scoring and assessment tools affect job applicants, who aren't covered by the employee records exemption.
- Look at performance and bonus tools. If software produces ratings or recommendations that drive pay, find out how it works.
- Work with your privacy lead. Agree what needs to go in the privacy policy before 10 December.
- Prepare a plain answer. Employees may ask "how was this decided?" Have a clear response ready, even though the law doesn't yet require one.
Business executives
- Confirm your position. Is the organisation covered by the Privacy Act, and who owns the review? Leaving the disclosure out after 10 December is a breach the regulator can act on.
- Ask for the list. Where do we let software make or shape decisions about people?
- Name an owner. Every automated pay outcome should have a person accountable for it.
- Ask your vendors. Find out how their systems reach results and what changes they're making for 10 December. A right to an explanation is likely coming, so systems that can't show their workings will become a risk.
Start with one payslip
This change is small on paper, but the direction is clear: payroll needs to be able to show its workings.
Practical tip: Pick one automated result from your last pay run. Can you explain, in plain English, how it was calculated and who checked it? If not, that's your starting point.
If you'd like an independent review of your payroll processes and controls, APA Consulting can help. To see how payroll teams are using AI today, download the Payroll AI Adoption Report.
Related reading from APA:
- AI in Payroll: The Question Isn't What We Can Automate
- AI in payroll: 5 guardrails for shift-based workplaces
This article is general information only and is not legal advice. Check the OAIC's guidance or speak with your legal adviser about your organisation's obligations.
Sources
