Privacy Act penalties after a breach: civil penalties, infringement notices and compliance notices

Why this matters during an incident. A data breach puts your whole privacy program under the regulator's eye, not just the breach itself. When the OAIC looks at a notified breach it can also see a stale privacy policy, a notification statement missing required details, or a request for information you never answered. Since the Privacy and Other Legislation Amendment Act 2024, each of those can lead to a penalty without going to court. The OAIC says infringement and compliance notices can only be issued for conduct after 11 December 2024.

Level 1: civil penalty for serious or repeated interference (s 13G)

Only a court can impose this. The Commissioner applies for a civil penalty order, and under s 80U(2) must do so within six years of the alleged contravention. According to the OAIC's Guide to Privacy Regulatory Action (Chapter 7), the maximum for a body corporate is the greatest of $50 million, three times the benefit it and related bodies corporate obtained from the conduct, or, if the court cannot work out the benefit, 30% of adjusted turnover over the breach turnover period, which is at least 12 months. For a person other than a body corporate the maximum is $2.5 million. If the court finds there was no benefit, the cap is $50 million.

What counts as serious. The Act does not define 'serious' or 'repeated', so the ordinary meaning applies, judged by what a reasonable person would consider serious. The OAIC lists the factors it weighs: how many individuals were potentially affected; whether sensitive information was involved; whether significant adverse consequences were or are likely to be caused; whether vulnerable or disadvantaged people were affected or targeted; whether the conduct was deliberate or reckless; and whether senior or experienced staff were responsible. It is more likely to go to court when a matter is particularly serious or egregious, when the entity has a history of serious interferences, or when the entity appears not to take its obligations seriously. The OAIC says a single breach can be enough.

What counts as repeated. Interferences on two or more separate occasions. One act that hits many people at once, such as the OAIC's example of a mail-merge error, or one act that breaches several APPs, is not 'repeated' in itself. The OAIC is more likely to act where the entity did not take reasonable steps to fix its practices after earlier interferences, for example audits, staff training, updated procedures and better information security.

Breach-handling failures feed this level. Under s 13(4A), failing to assess a suspected eligible data breach (s 26WH(2)), to prepare a statement and give it to the Commissioner as soon as practicable (s 26WK(2)), to notify affected individuals as soon as practicable (s 26WL(3)), or to comply with a Commissioner's direction to notify (s 26WR(10)) is itself an interference with privacy. A slow or missing notification can therefore be part of a s 13G case on top of the security failure that caused the breach.

The OAIC says it is unlikely to seek a civil penalty for minor or inadvertent contraventions where the entity cooperated with the investigation and took steps to avoid a repeat. Where conduct breaches several civil penalty provisions, the entity can only be liable for one penalty for that conduct.

Level 2: infringement notices (s 80UB)

An infringement notice is a fixed penalty you can pay instead of facing court. The OAIC Commissioner or OAIC Senior Executive Service staff can issue one if they believe on reasonable grounds that you have contravened one of these provisions: s 13K(1), which covers breaches of APPs 1.3 and 1.4 (a clearly expressed, up-to-date privacy policy with the required content), 2.1 (anonymity and pseudonymity), 6.5 (written note of disclosures for enforcement-related activities), 7.2(c), 7.3(c), 7.3(d), 7.7(a) and 7.7(b) (direct marketing opt-outs and source of information) and 13.5 (responding to correction requests in time and free of charge); s 13K(2), an eligible data breach statement under s 26WK that does not comply with s 26WK(3); s 66(1), failing or refusing to give information, answer a question or produce a document when required; and s 80UC(4), failing to comply with a compliance notice. The OAIC's guide chapters describe s 13K(2) as a statement that does not comply with s 26WK(3), while its infringement-notice page describes it as failing to submit the statement as soon as practicable. Treat both the content and the timing of your statement as in scope.

Amounts. According to the OAIC (infringement notices page, published 22 September 2026), a single contravention costs up to 12 penalty units for an individual (currently $4,368) and up to 60 penalty units for a body corporate (currently $21,840). A listed corporation pays 200 penalty units (currently $72,800) for each contravention of s 13K(1) or (2) or s 80UC(4). Each notice covers one alleged contravention, but the OAIC can issue several notices for several contraventions. Penalty units are indexed each 1 July under s 4AA of the Crimes Act 1914, so check the current figure.

Timing and options. A notice must be issued within 12 months of the alleged contravention. For s 13K and s 80UC(4) matters the OAIC can issue one without talking to you first. You normally have 28 days to pay. Paying is not an admission and ends your liability for that contravention; the OAIC then cannot take you to court for it. Before the due date you can apply in writing for more time or ask for the notice to be withdrawn; asking for withdrawal does not move the due date. If you do not pay, the OAIC can seek a civil penalty in court: up to 200 penalty units for s 13K or s 80UC(4), and for s 66(1) up to 300 penalty units for a body corporate or 60 for an individual (OAIC Chapter 8). Two or more s 66(1) contraventions by a body corporate showing serious, systemic conduct can be a criminal offence under s 66(1AA), with a maximum of 300 penalty units, and may be referred to the Australian Federal Police or the CDPP.

Level 3: compliance notices (s 80UC)

If the OAIC reasonably believes you have contravened s 13K(1) or (2), it can issue a compliance notice instead of, or before, any penalty. The notice sets out the contravention and either the action you must take or stop taking, or the steps you must take so it does not happen again, within a reasonable period; it may also require evidence that you have complied. The OAIC says it uses them where the problem can reasonably be fixed by the entity, and is less likely to where concerns are serious enough for a court or the impact has been significant. You can apply to the Federal Court or the Federal Circuit and Family Court (Division 2) to review a notice on the grounds that you did not commit the contravention or that the notice does not meet s 80UC(2). Complying is not an admission. While the notice stands and you have complied, or while your review application is still being dealt with, the OAIC cannot seek a civil penalty under s 13G(1), s 13H(1) or s 13K for the same conduct. If you ignore it, the OAIC can issue an infringement notice under s 80UC(4).

Practitioner checklist

1. Read your privacy policy against APP 1.3 and 1.4 now. It is the easiest infringement for the OAIC to prove and the first document it will open after a breach notification.

2. Test the boring APPs: can people deal with you anonymously where practicable (APP 2.1)? Does every direct-marketing message offer a working opt-out that you act on within a reasonable period (APP 7)? Are correction requests answered on time and free of charge (APP 13.5)? Do you record disclosures for enforcement-related activities (APP 6.5)?

3. Before you send an eligible data breach statement, check it against the s 26WK(3) contents (see the NDB statement page) and log when you became aware and when you filed (see the NDB clock page).

4. Treat every OAIC request for information, including s 26WU notices to third parties such as your cloud or managed service provider, as a deadline with a penalty attached. Make one person own the reply.

5. Keep evidence of the reasonable steps you took after earlier incidents: audits, fixes, training. That evidence is what separates an isolated breach from a 'repeated' interference.

6. If a notice arrives, diarise the 28-day payment date and the 12-month window from the conduct, decide quickly whether to pay, seek more time or seek withdrawal, and get legal advice before the due date.