From 10 December 2026, Australian businesses covered by the Privacy Act have to disclose something new in their privacy policy: where a computer program uses personal information to make — or to substantially help make — decisions that could significantly affect a person's rights or interests, you must set out what kinds of information and what kinds of decisions. Most businesses are auditing the obvious systems. Almost nobody is auditing the phones, even though a modern contact system verifies identities, blocks numbers, prioritises queues, classifies why someone rang, and scores the staff who took the call. This is a countdown, not a legal essay: five questions to establish whether you are caught, a decision tree for the phone side, a worked example, and a plan that finishes before December rather than during it.