Singapore company, Australian customers: the 10 December rule may be yours too

Almost everything written about Australia's new automated decision-making rule assumes an Australian business. Singapore companies with Australian customers, members, applicants or staff are mostly left out of the conversation, even though the rule can reach them.

This is a technical explainer, not legal advice. Whether the Australian Privacy Act applies to your company is a question for counsel.

What starts on 10 December

From 10 December 2026, APPs 1.7 to 1.9 of Australia's Privacy Act require a privacy policy to describe where a computer program makes, or substantially helps make, decisions that could significantly affect someone's rights or interests. The policy must cover the kinds of personal information used, the kinds of decisions made solely by a program, and the kinds of decisions where a program does something substantially and directly related to the decision.

"Computer program" is broad. It covers rules engines, scoring formulas, workflow automation, vendor platforms and spreadsheets, not only AI. A person approving the final outcome does not take a decision out of scope if the software shaped it.

Why a Singapore company can be caught

The Privacy Act applies to overseas organisations with an "Australian link". Since amendments in late 2022, carrying on business in Australia is enough to create that link, whether or not the company collects or holds personal information in Australia.

"Carrying on business" is not defined in the Act and is read broadly. Factors that can point to it include an Australian office, selling goods or services to people in Australia through a website, and owning Australian registered trade marks.

If your company has Australian operations, sells to Australians, or runs regional systems that make decisions about Australian customers or staff, it is worth asking counsel whether APP 1.7 applies.

Where Singapore companies tend to have Australian decisions

The usual pattern is a regional platform run from Singapore that serves Australia too:

• Customer onboarding and eligibility: account approvals, credit or payment terms, identity checks.
• Pricing and offers: personalised pricing, discounts, fees applied by region.
• Fraud and risk: holds, flags and blocks on Australian accounts.
• Hiring and rostering: screening and shortlisting for Australian roles, shift allocation.
• Service prioritisation: which customers or cases get handled first.

These often live in shared systems configured once for the whole region. The Australian team may not know the rules exist, and the Singapore team may not know an Australian disclosure is due.

The same work supports your PDPC position

Singapore's PDPC published Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems on 1 March 2024. They are not legally binding, but the PDPC is likely to interpret the PDPA consistently with them. They expect organisations deploying AI that makes recommendations, predictions or decisions about people to be transparent about how personal data is used, and to be able to explain how those systems work.

Australia's rule covers any computer program, not only machine learning, so it is the wider of the two. But both start from the same question: where do our systems make or shape decisions about people, and what data do they use?

One decision inventory answers that question for both markets.

What a decision inventory gives you

For each decision point, a usable inventory records:

• the decision, in plain words,
• the system and the step where it happens,
• how automated it is,
• the personal information it uses,
• what happens to the person,
• which markets it affects,
• who owns it.

With that list, counsel can decide what the Australian privacy policy must say, what Singapore transparency material should cover, and which decisions need no disclosure at all.

Five weeks out

If your company might carry on business in Australia and your privacy policy says nothing about automated decisions:

1. Ask counsel whether the Australian Privacy Act applies.
2. Find the decisions your regional systems make about Australian customers, applicants or staff.
3. Let counsel apply the tests and write the disclosure from facts.
4. Reuse the same list for your Singapore AI governance and transparency work.

Hezico Pte. Ltd. is based in Singapore and maps where your systems make decisions about people, across any platform and both markets, in two weeks at a fixed fee. We supply the facts. Your lawyers make the legal calls. See what the Decision Inventory includes.

---

Sources

• Privacy and Other Legislation Amendment Act 2024 (Cth); OAIC, APP 1.7 to 1.9 transparency obligation fact sheet and updated APP 1 guidelines, 30 September 2026.
• Clayton Utz, "More overseas companies to be subject to the Australian Privacy Act", 6 April 2023.
• Linklaters, "Data Protected: Australia".
• PDPC, Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems, 1 March 2024; Bird & Bird summary, 2024.