The OAIC's expanded civil penalty powers after the 2024 reforms

The Office of the Australian Information Commissioner (OAIC) can now seek substantially larger and more flexible penalties for breaches of the *Privacy Act 1988* (Cth). The Privacy and Other Legislation Amendment Act 2024 replaced the old single-penalty model with a three-tier civil penalty regime, lowered the threshold for the most serious cases, and gave the Information Commissioner new infringement-notice powers for administrative breaches.

In short: the headline maximum for a serious interference with privacy by a body corporate can reach into the tens of millions of dollars, a new mid-tier penalty captures less-severe interferences, and low-level administrative breaches can now attract on-the-spot infringement notices. This page explains the structure, the thresholds, and what regulated entities should do.

What changed and who it affects

The reforms apply to APP entities — most Australian Government agencies and private-sector organisations covered by the Privacy Act and bound by the Australian Privacy Principles. That includes organisations that handle personal information and meet the Act's coverage tests (for many businesses, this turns on annual turnover and the nature of their activities).

The key shift is enforcement capacity. Before the 2024 amendments, the OAIC's primary civil penalty applied only to serious or repeated interferences with privacy, leaving a gap for one-off breaches that were neither trivial nor egregious. The reforms close that gap by adding intermediate and low-level tiers, and by removing the "repeated" element so a single, sufficiently serious incident can attract the top-tier penalty.

The amending Act received Royal Assent on 10 December 2024. Under its commencement table, the penalty and enforcement amendments in Schedule 1 (Parts 1 to 7 and 9 to 14, and items 48 to 58) commenced on 11 December 2024, the day after Royal Assent, while Schedule 1 Part 15 (the automated decision-making transparency provisions) commences on 10 December 2026. Verify the commencement of any specific provision against the Federal Register of Legislation before relying on it.

The new tiered civil penalty regime

The 2024 reforms restructured the penalties into three tiers:

• Tier 1 — serious interference with privacy. The pre-existing top-tier provision (section 13G) was amended so it applies to a serious interference, with the "repeated" requirement removed. The Act also introduces a non-exhaustive list of factors a court may weigh in deciding whether an interference is serious.
• Tier 2 — mid-tier civil penalty (s 13H). A new civil penalty for any act or practice that is an interference with the privacy of an individual, even if it does not reach the "serious" threshold. The maximum penalty must not exceed 2,000 penalty units (about $728,000 at $364 per penalty unit from 1 July 2026).
• Tier 3 — administrative breaches (s 13K). A lower-level civil penalty, supported by infringement-notice and compliance-notice powers, for specified contraventions of the Australian Privacy Principles (including APP 1.3 and 1.4 on privacy policies, APP 2.1, APP 6.5, specified APP 7 opt-out and notification requirements, and APP 13.5) and for non-compliant eligible data breach statements. The maximum penalty must not exceed 200 penalty units (about $72,800).

The third tier matters operationally because infringement notices can be issued by the Commissioner without court proceedings, giving the OAIC a faster, lower-friction enforcement tool for clear-cut administrative failures.

How much can the OAIC penalties reach

For a serious interference (Tier 1) by a body corporate, the maximum penalty is the greatest of:

• $50 million;
• three times the value of the benefit obtained directly or indirectly and reasonably attributable to the contravention; or
• if the court cannot determine that benefit, 30% of the entity's adjusted turnover during the relevant period.

For a person other than a body corporate, the maximum is $2.5 million for a serious interference.

The mid-tier and administrative amounts are set by reference to Commonwealth penalty units, which are periodically indexed ($364 from 1 July 2026). Confirm the current dollar value when quoting figures. The OAIC's guide to privacy regulatory action sets out how it approaches the penalty tiers in practice.

What counts as a 'serious' interference

Removing the "repeated" element means a single incident can now attract the top tier if it is serious. The Act provides a non-exhaustive list of factors a court may consider, which broadly include matters such as:

• the particular kind or kinds of information involved;
• the sensitivity of the individual's personal information;
• the consequences, or potential consequences, for the individual;
• the number of individuals affected;
• whether the affected individual is a child or a person experiencing vulnerability;
• whether the act was done, or the practice engaged in, repeatedly or continuously; and
• whether the entity failed to take steps to implement practices, procedures and systems to comply with its privacy obligations in a way that contributed to the interference.

These are the matters listed in s 13G(1B); the list ends with "any other relevant matter", so a court may weigh other circumstances. The practical takeaway is that severity is assessed on the substance and consequences of the breach, not merely on how often it happened.

Other enforcement powers and the second tranche

Beyond the penalty tiers, the 2024 reforms expanded the OAIC's broader toolkit and enacted several substantive changes, including a statutory tort for serious invasions of privacy and new transparency requirements for automated decision-making that affect individuals. These are legislated. The automated-decision-making transparency obligations commence on 10 December 2026 (Schedule 1, Part 15).

A second tranche of Privacy Act reform is in development. The Attorney-General's Department consultation page lists an exposure draft, the Privacy Amendment (Personal Data Protection) Bill 2026, with submissions due by 18 September 2026, and states that the Bill "remains subject to further consideration by government" (consultation page). It has not been enacted, and the small-business exemption remains in the Act; treat any specific date with caution until it appears in an enacted Act on the Federal Register.

What entities should do now

Practical steps to manage exposure under the expanded penalty regime:

• Map your obligations. Confirm whether you are an APP entity and review your privacy policy and APP-handling practices against current requirements.
• Tighten breach response. The fastest path to penalties is a mishandled breach. Review your Notifiable Data Breaches notification process and use the NDB timer to track the assessment-and-notification clock.
• Reduce data held. Minimising the volume and sensitivity of personal information retained reduces both the likelihood and the "seriousness" of any interference.
• Document governance. Keep records of risk assessments, training, and remediation — evidence of reasonable steps is relevant to how regulators and courts view conduct.
• Watch the second tranche. Monitor the OAIC and Attorney-General's Department for the next reform package.

Common pitfalls

• Assuming one incident is "safe." With "repeated" removed, a single serious breach can attract the top tier.
• Treating the small-business exemption as permanent. Its removal is under consideration but not enacted; build toward compliance rather than relying on the exemption indefinitely.
• Ignoring administrative breaches. Infringement notices target exactly the kind of routine APP failures organisations often overlook.
• Relying on stale penalty figures. Penalty-unit values are indexed; verify current amounts before quoting them internally or to a board.