The premise

From 10 December 2026, if a computer program uses someone's personal information to make a decision that could significantly affect them, you have to say so in your privacy policy. You have to describe the kinds of personal information that go in, and the kinds of decisions that come out. That is the law now, not a guideline. It is the Privacy and Other Legislation Amendment Act 2024, and the clock has been running since it got assent on 10 December 2024.

This guide is about the gap between that obligation and where most customer-intelligence stacks sit today. The decision that has to explain itself, the loyalty tier, the credit nudge, the next-best-action, the propensity score that routes a customer one way and not another, is increasingly made by a model. And in a lot of stacks that model, and the record of why it decided, lives in someone else's environment. When the question comes, and it will come from a regulator, a journalist or a customer's lawyer, you have to be able to answer for it. You can't answer for a thing you rent.

So this is not a guide about buying better software. It's a guide about which parts of your customer intelligence are worth owning, in your own environment and your own name, before the date when you'll have to explain the decision. Quiet intelligence you own beats a loud platform you don't.

A note on what this is and isn't. We didn't write this to sell you a stack. We wrote down the part of the job the global playbook skips, because it's the part that lands hardest here. Read it as a practitioner wrote it for a peer.

1. The shift is real, and it already has a name

Q: What does warehouse-native, composable customer intelligence mean?

It means the customer data platform stops being a separate system you load a copy of your data into, and becomes a set of capabilities that run directly on the data warehouse you already have. Profiles, identity, audiences and the models that score them sit next to your data, governed in one place. Custom AI agents act on that data where it lives, rather than somewhere else. That is the direction the whole market has now taken.

We'll credit this plainly: the clearest recent map of where customer intelligence is going is Scott Brinker's March 2026 report on the composable, agentic stack. It describes the marketing stack dissolving into a flexible canvas on one data foundation, with custom agents as the working edge. We think it's right. We're not going to rebut a good map.

And it isn't just one report. The wider market arrived at the same place in 2026, from three independent directions:

The analysts. The 2025 Gartner Magic Quadrant for Customer Data Platforms, published January 2026, has the category forking into platformisation on one side and agentification on the other. Hightouch entered as a Leader on the strength of warehouse-native composability, activating data directly from cloud warehouses without copying it out. The buyer guidance is to activate data where it lives and to invest in agentic AI.
The neutral body. The CDP Institute's 18th Industry Update, covering the second half of 2025, found composable and warehouse-native vendors grew headcount by 7.8 per cent, about six times the 1.3 per cent industry average. That is the non-vendor number. The work, and the hiring, is moving to where the data already sits.
The lakehouse itself. On 16 June 2026, at its Data and AI Summit, Databricks announced CustomerLake into private preview, an agentic CDP built into the lakehouse and governed by Unity Catalog. The platform that holds the data is now declaring itself the CDP. The "second copy of your data in a vendor's tool" model is the one being left behind.

So composable, warehouse-native and agentic are not the future. They're table stakes for 2026. Every warehouse-native vendor will be waving this same direction-of-travel around by the third quarter. If the shift is settled, the only question left worth arguing is who owns the part of it that has to explain itself. That part has an Australian deadline the global playbook does not mention.

2. The part the global playbook skips: in Australia, the "why" is the law

Q: What must Australian brands disclose about automated decisions from December 2026?

From 10 December 2026, where you've arranged for a computer program to use personal information to make a decision that could reasonably be expected to significantly affect a person's rights or interests, your privacy policy must disclose it. It must set out the kinds of personal information used and the kinds of decisions made that way. This sits in Australian Privacy Principle 1, the open-and-transparent principle, as new clause 1.7.

That is the wedge, and it's the part the international reports leave out, because they describe a global best practice and this is a specific local requirement. Here is the rest of it, dated and sourced, without the scaremongering.

The Act and the date. The Privacy and Other Legislation Amendment Act 2024 received Royal Assent on 10 December 2024. The automated-decision-making transparency obligation was given a 24-month runway, so it commences on 10 December 2026. The OAIC ran a consultation on its guidance for the obligation, with submissions closing 15 June 2026 and final guidance expected around September 2026. The direction of that consultation has been a broad reading of what counts as a decision that significantly affects a person, so the safe planning assumption is wide, not narrow.

The penalties. The same reform package sharpened enforcement. For a serious or repeated interference with privacy, a body corporate now faces a maximum civil penalty of AU$50 million, or three times the benefit obtained, or 30 per cent of adjusted turnover for the relevant period, whichever is greatest. The OAIC also holds mid-tier and infringement-notice powers below that. The point is not the headline number. The point is that "we can't readily explain how that decision was made" is no longer a quiet operational gap. It is now a disclosure you are legally required to make, backed by penalties that make it a board-level risk.

The wider direction. This sits inside a broader expansion of data obligations, not a one-off. The Consumer Data Right keeps widening: under the registered rules it reaches non-bank lending in 2026, with consumer data-sharing obligations in that sector beginning 9 November 2026. The pattern is consistent. More of your customer data carries an obligation attached, and more of the decisions you make on it have to be explainable to someone outside your building.

What this asks of you is concrete. By 10 December 2026 you need to be able to point at the automated decisions in your customer operation that meet the threshold, describe in your privacy policy the personal information they use and the kinds of decisions they make, and, when pressed beyond the policy, actually produce the working. The next three sections are about where that working has to live for that to be possible.

3. The trap: renting your intelligence back

Q: Who owns my customer data, a packaged CDP or a warehouse-native one?

With a packaged CDP, you load a copy of your data into the vendor's environment, and the profiles, the model logic and the record of how a decision was reached are reconstructed and held there, on their terms. With a warehouse-native design, the data never leaves your environment. The profiles, the governance and the semantics are derived in place, under your own access controls. You own the data, and you own the explanation of what was done with it.

Here is the trap, and it's a quiet one, because it rarely shows up as a single bad decision. You assemble a modern stack from rented parts. Each part is individually fine. But the canvas built from rented parts cannot answer for itself, because the explanation of any given decision is spread across other people's systems, on other people's terms, behind other people's roadmaps and outage windows. On the ordinary days that costs you nothing. On the day a regulator, a board or a customer's lawyer asks you to explain a decision that significantly affected someone, you discover the record you legally need is not yours to produce on demand.

This is why we frame ownership as risk management, not ideology. We're not making a philosophical argument about data sovereignty. We're making a practical one about who can answer the December question. If the obligation is to disclose, and on request to substantiate, the logic of an automated decision, then the record of that logic has to be somewhere your own Legal and Risk teams can reach, read and stand behind. It has to be a thing they can audit, not a thing they have to trust a vendor to surface accurately and quickly under pressure.

Ownership also has a plainer commercial edge. When the intelligence is rebuilt inside a vendor's product, you're renting back, every year, the understanding of your own customers. The asset that should compound on your balance sheet sits on someone else's, and you pay for access to it. Warehouse-native changes the economics as much as the governance.

One quiet line on how we build, because it matters here and we'll only say it once. We build on the warehouse you choose or already have, and the capability is yours regardless of vendor. We're not selling you a thing to rent. We're helping you own a thing.

4. The four pieces worth owning first

You do not have to own the whole stack. The enterprise "single foundation for everything" programme is a multi-year, whole-estate commitment, and most brands neither need it nor should start there. You have to own the four pieces that have to explain themselves. Here they are, in the order we'd build them, each with what it is, why it's worth owning, and what renting it costs you.

Q: What is a semantic layer and who should own it?

A semantic layer is the agreed, written-down set of definitions that sit between your raw data and everything that acts on it: what "active customer" means, what counts as "high-value", how "churn" is measured. It is the dictionary your reports, models and agents all read from. It should be owned by you, in your environment. If it lives in a vendor's tool, the meaning of your own business is defined on their terms, and every automated decision inherits it.

1. Data consolidation. What it is: one place where your customer data is brought together and identity is resolved, in your own warehouse, rather than scattered across tools each holding a partial copy. Why own it: it's the foundation the other three stand on, and it's the difference between explaining a decision from one source of truth and reverse-engineering it from five. What renting it costs you: every additional copy in a vendor's system is another place the record of "why" can diverge from what actually happened, and another export you have to trust.

2. The semantic layer. What it is: the one agreed definition of the terms your decisions turn on, as above. Why own it: it's the cheapest piece to own and the most expensive to get wrong, because a quiet difference in how "high-value customer" is defined changes who gets offered what. When you have to disclose the kinds of decisions you make, you'll be describing decisions built on these definitions. They should be yours, legible, and in one place. What renting it costs you: definitions drift between tools, nobody can say which one is authoritative, and the answer to "why was this customer treated this way" depends on which system you ask.

3. The first custom agents on your own data. What it is: a small number of AI agents that do real, narrow work on your consolidated data, scoring, segmenting, drafting a next-best-action, running against your definitions, in your environment. Why own it: this is where the warehouse-native, agentic shift actually earns its keep, and starting with one or two narrow agents on data you own is how you get the benefit without handing the decisioning to a system you can't inspect. What renting it costs you: an agent inside a vendor's product makes decisions you may not be able to fully reconstruct, which is exactly the kind of decision the December obligation is about.

4. The decision-trace layer. What it is: the record of why. For a decision that significantly affects a person, it's the inputs that were used, the logic that was applied, and the outcome, captured as a matter of course, in your environment, in your name. We call it the decision trail, or showing your working. Why own it: this is the piece that directly answers the December obligation, and it's the piece no packaged platform can hand you as yours, because by design it's reconstructed inside theirs. The explanation a regulator will ask for should already be written, in your environment, under your control. What renting it costs you: on the day you're asked, you're dependent on a third party to surface, accurately and fast, the one record that determines whether you've met a legal obligation. That is the dependency to remove first.

If you own these four, you can answer for your customer intelligence. You can own them incrementally, and you can own the first one this quarter.

5. What real-time actually asks of you

Q: What is a real-time owned customer loop?

It's a closed loop that runs on your own data, in your own environment: a fresh signal arrives, a decision is made on it against your own definitions, an action follows, and the result becomes the next signal, all in the moment rather than in last night's batch. "Real-time" is not a faster export. It's the intelligence sitting next to the live data, acting on what is true right now and keeping a record of each decision as it goes.

Here's what that looks like on the ground, told generically. Take a retailer with a loyalty programme and live inventory across stores and a warehouse. A member opens the app. The useful decision is to offer them something they actually want, that's actually in stock near them, at a margin that makes sense, right now. To do that well, the loop has to read live inventory, the member's history and value tier, and the current margin position, decide in the moment, act, and then learn from whether the member took it.

Notice what real-time quietly asks of you once a person is significantly affected by that decision. If the offer, the tier or the exclusion is driven by an automated model, the December obligation applies to it. Every one of those in-the-moment decisions is one you may have to describe and, on request, substantiate. A loop that runs fast but keeps no legible record of why it did what it did is a loop that's fast at creating obligations it can't answer for. So the owned loop has two jobs at once: act on what's true right now, and write down why, as it goes. That second job is only reliably yours if the loop runs in your environment.

This is illustrative, not a promise to build you a whole real-time loyalty engine. The point is narrower and more useful: the faster and more automated your customer decisions get, the more the record of why has to be owned, because you can't keep a trustworthy record of a decision that happened inside a system you don't control.

6. The 90-day first move

Q: How do I start owning my customer intelligence in 90 days?

Start with the piece that meets the December obligation, on one real decision, in your own environment. In the first fortnight, consolidate the data behind that decision and agree the one definition it turns on. Over the next weeks, stand up the semantic layer and put one narrow agent on it. In the final weeks, add the decision-trace layer so the decision explains itself, then run a readiness check. You finish the quarter owning one decision, with the record in your name.

Here is the move in detail. It's deliberately small. One decision, owned properly, beats a whole-estate programme that never ships.

Weeks 1 to 2: consolidate, and define the one metric. Pick one automated decision that could significantly affect a customer and that you'd have to disclose: a loyalty tier, a retention offer, a credit or risk nudge, a lead score. Bring together the data behind that one decision in your own warehouse. Agree, and write down, the single definition it turns on. This is the unglamorous part and it's the part everything else depends on.

Weeks 3 to 8: the semantic layer and the first agent. Turn that definition into a semantic layer that your reports, models and agents read from. Then put one narrow custom agent on it, doing the actual scoring or segmenting, on your data, in your environment. Keep the scope tight. The aim is one decision made well and inspectably, not a fleet of agents.

Weeks 9 to 12: the decision-trace layer and the readiness check. Add the layer that records, for each instance of that decision, the inputs, the logic and the outcome. Then run the readiness check: can you describe this decision in your privacy policy in the terms the law asks for, and can Legal and Risk audit the record rather than take it on trust. The one-page December 2026 readiness checklist that comes with this guide is the tool for that last step.

At the end of 90 days you don't have a finished platform. You have one decision you fully own, a record you can stand behind, and a repeatable pattern for the next decision. That's the move. It's ownable this quarter, and it's the honest first step toward being ready by 10 December 2026.

7. Who we are, and how we hand it over

We're NTWRK, an Australian consultancy. We build AI-native customer-intelligence systems that live inside your own data stack: warehouse-native, AI-native, and yours to keep. We don't sell you a product to rent. We build a capability in your environment and hand it over.

How the handover works. We work in five phases, and the design is removable at any boundary. At the end of each phase, what we've built is in your environment, in your name, and you could carry on without us. We're not trying to become a dependency you can't end. The test we hold ourselves to is the one this guide is about: when the question comes, the people who have to answer it are your people, reading a record they own, not waiting on ours.

The proof is the work. We've built this kind of owned, warehouse-native customer intelligence for Isuzu, Mecca, Colliers and REMONDIS: across automotive and a dealer network, prestige retail and loyalty, property and lead generation, and long-cycle B2B retention. Different shapes, same principle. The intelligence is theirs, in their stack, under their governance, and it can explain itself.

If the December obligation is on your desk and you want to own the part of your customer intelligence that has to answer for itself, the 90-day move in section 6 is where to start, and the checklist overleaf is how to know if you're ready.

The December 2026 readiness checklist

The one-page version of this guide travels with a checklist: the concrete questions a brand must be able to answer to be ready for 10 December 2026. It's reproduced as a standalone page alongside this guide, and it's the tool for the readiness check in the 90-day move. The short version is one question. When someone asks you to explain a decision a machine made about a customer, can you, from a record you own?

Sources

The legal claims in this guide are drawn from the Act and from the Office of the Australian Information Commissioner. The market claims are drawn from the nine-source pack below: analyst coverage, a neutral industry body, independent trade press and vendor statements, dated and attributed so the guide is checkable.

Primary legal sources

Privacy and Other Legislation Amendment Act 2024 (Cth). Received Royal Assent 10 December 2024; the automated-decision-making transparency obligation (APP 1.7) commences 10 December 2026 (24-month runway). Federal Register of Legislation.
Office of the Australian Information Commissioner. Australian Privacy Principle 1: open and transparent management of personal information (APP 1 guidelines), and Consultation on guidance for transparency in automated decision-making (submissions closed 15 June 2026; final guidance expected around September 2026). oaic.gov.au.
Civil penalties: serious or repeated interference with privacy carries, for a body corporate, a maximum of AU$50 million, or three times the benefit obtained, or 30 per cent of adjusted turnover for the relevant period, whichever is greater (Privacy Act 1988 (Cth) as amended by the 2024 Act). OAIC, Guide to privacy regulatory action.
Consumer Data Right expansion to non-bank lending, registered rules: product data-sharing from 13 July 2026 and consumer data-sharing obligations from 9 November 2026 for initial providers. cdr.gov.au; Treasury.

Market-confirmation sources (the nine-source pack)

2025 Gartner Magic Quadrant for Customer Data Platforms (published January 2026), as covered by CX Today and MarTech Therapy: the category forks into platformisation and agentification; Hightouch enters as a Leader on warehouse-native composability; buyer guidance to activate data where it lives and invest in agentic AI.
CDP Institute / Customer Data Alliance, Industry Update, 18th edition (released 11 February 2026, covering H2 2025): composable and warehouse-native vendors grew headcount 7.8 per cent, about six times the 1.3 per cent industry average; more than a quarter of CDPs now warehouse-centric.
Databricks, CustomerLake, announced into private preview (16 June 2026, Data and AI Summit): an agentic CDP built into the lakehouse and governed by Unity Catalog; profiles, governance and semantics inherit from the platform and the data does not leave the customer's environment. Databricks newsroom.
CMSWire (Kihlstrom), "Why Databricks CustomerLake just upended the CDP space," 19 June 2026: the CDP becomes a function of the platform where the data already sits, and the enterprise can own the data and the governance.
MarTech Therapy, "Databricks CustomerLake: the lakehouse is now the CDP," 16 June 2026: profiles, governance and semantics inherit from Unity Catalog rather than being reconstructed by a third party; the customer still owns the data, in their own environment, under their own governance.
MarTech (Pastore), "Ready or not, welcome to the era of the agentic CDP," 22 June 2026 (citing Forrester's Stanhope): the arc from packaged to composable to agentic, with agentic AI as the new decisioning model on owned data.
Integral Ad Science with Databricks CustomerLake, 16 June 2026 (vendor): an agentic CDP on a governed first-party foundation, evidence the model is shipping in market.
Hightouch, Traditional CDP vs Composable CDP (vendor POV): a composable CDP must run on your own infrastructure and must not store a separate copy of your data.
Snowflake and Databricks clean rooms / zero-copy data sharing (2025 to 2026): first-party collaboration without moving the data, the "partner on data you still own" half of the thesis.

This guide describes a legal obligation in general terms and is not legal advice. Confirm your specific obligations under the Privacy Act 1988 (Cth) and the OAIC's final guidance with your own legal advisers.

You'll have to explain the decision.