The OAIC's expanded civil penalty powers after the 2024 reforms

The Office of the Australian Information Commissioner (OAIC) can now seek substantially larger and more flexible penalties for breaches of the *Privacy Act 1988* (Cth). The Privacy and Other Legislation Amendment Act 2024 replaced the old single-penalty model with a three-tier civil penalty regime, lowered the threshold for the most serious cases, and gave the Information Commissioner new infringement-notice powers for administrative breaches.

In short: the headline maximum for a serious interference with privacy by a body corporate can reach into the tens of millions of dollars, a new mid-tier penalty captures less-severe interferences, and low-level administrative breaches can now attract on-the-spot infringement notices. This page explains the structure, the thresholds, and what regulated entities should do.

What changed and who it affects

The reforms apply to APP entities — most Australian Government agencies and private-sector organisations covered by the Privacy Act and bound by the Australian Privacy Principles. That includes organisations that handle personal information and meet the Act's coverage tests (for many businesses, this turns on annual turnover and the nature of their activities).

The key shift is enforcement capacity. Before the 2024 amendments, the OAIC's primary civil penalty applied only to serious or repeated interferences with privacy, leaving a gap for one-off breaches that were neither trivial nor egregious. The reforms close that gap by adding intermediate and low-level tiers, and by removing the "repeated" element so a single, sufficiently serious incident can attract the top-tier penalty.

The relevant amending Act commenced on 10 December 2024, with some measures phased in at later dates as set out in the Act's commencement provisions. Verify the commencement of any specific provision against the Federal Register of Legislation before relying on it.

The new tiered civil penalty regime

The 2024 reforms restructured the penalties into three tiers:

• Tier 1 — serious interference with privacy. The pre-existing top-tier provision (section 13G) was amended so it applies to a serious interference, with the "repeated" requirement removed. The Act also introduces a non-exhaustive list of factors a court may weigh in deciding whether an interference is serious.
• Tier 2 — mid-tier civil penalty. A new civil penalty for interferences that do not reach the "serious" threshold but still warrant a court-imposed penalty.
• Tier 3 — administrative breaches. A lower-level civil penalty, supported by infringement-notice powers, for specified administrative contraventions of the Australian Privacy Principles and for non-compliant eligible data breach statements.

The third tier matters operationally because infringement notices can be issued by the Commissioner without court proceedings, giving the OAIC a faster, lower-friction enforcement tool for clear-cut administrative failures.

How much can the OAIC penalties reach

For a serious interference (Tier 1) by a body corporate, the maximum penalty is the greatest of:

• $50 million;
• three times the value of the benefit obtained directly or indirectly and reasonably attributable to the contravention; or
• if the court cannot determine that benefit, 30% of the entity's adjusted turnover during the relevant period.

For a person other than a body corporate, the maximum is $2.5 million for a serious interference.

Mid-tier and infringement-notice amounts are lower and set by reference to penalty units, which are periodically indexed. Because penalty-unit values change, confirm the exact dollar figures with the OAIC or the current legislation rather than relying on a cached number. The OAIC's guide to privacy regulatory action sets out how it approaches the penalty tiers in practice.

What counts as a 'serious' interference

Removing the "repeated" element means a single incident can now attract the top tier if it is serious. The Act provides a non-exhaustive list of factors a court may consider, which broadly include matters such as:

• the kind or kinds of personal information involved (for example, sensitive information);
• the sensitivity of that information and the risk of harm to affected individuals;
• the number of individuals affected;
• whether the interference was done deliberately, recklessly, or repeatedly; and
• the impact or potential impact on affected individuals.

These factors are illustrative, not exhaustive — a court may weigh other relevant circumstances. The practical takeaway is that severity is assessed on the substance and consequences of the breach, not merely on how often it happened.

Other enforcement powers and the second tranche

Beyond the penalty tiers, the 2024 reforms expanded the OAIC's broader toolkit and enacted several substantive changes, including a statutory tort for serious invasions of privacy and new transparency requirements for automated decision-making that affect individuals. These are legislated, with the automated-decision-making transparency obligations subject to a transition period — check the commencement dates for the provision that applies to you.

A second tranche of Privacy Act reform has been flagged by the Government, covering issues such as the scope of the small-business exemption and a broader "fair and reasonable" handling standard. As at the time of writing, the removal of the small-business exemption is proposed and not yet legislated with a settled commencement date — treat any specific date with caution until it appears in an enacted Act on the Federal Register.

What entities should do now

Practical steps to manage exposure under the expanded penalty regime:

• Map your obligations. Confirm whether you are an APP entity and review your privacy policy and APP-handling practices against current requirements.
• Tighten breach response. The fastest path to penalties is a mishandled breach. Review your Notifiable Data Breaches notification process and use the NDB timer to track the assessment-and-notification clock.
• Reduce data held. Minimising the volume and sensitivity of personal information retained reduces both the likelihood and the "seriousness" of any interference.
• Document governance. Keep records of risk assessments, training, and remediation — evidence of reasonable steps is relevant to how regulators and courts view conduct.
• Watch the second tranche. Monitor the OAIC and Attorney-General's Department for the next reform package.

Common pitfalls

• Assuming one incident is "safe." With "repeated" removed, a single serious breach can attract the top tier.
• Treating the small-business exemption as permanent. Its removal is proposed; build toward compliance rather than relying on the exemption indefinitely.
• Ignoring administrative breaches. Infringement notices target exactly the kind of routine APP failures organisations often overlook.
• Relying on stale penalty figures. Penalty-unit values are indexed; verify current amounts before quoting them internally or to a board.