Australia's top civil penalty for a serious privacy breach stands at AUD 50 million, a threshold that has applied since December 2022 and was left untouched when the first tranche of the country's broader Privacy Act reform program, the Privacy and Other Legislation Amendment Act 2024, took effect in December 2024. That figure headlines a reform program that also added a new mid-tier penalty, a doxxing offense, a statutory privacy tort, and an active OAIC enforcement push, all of which are now producing real, if still sparse, enforcement numbers.
The reform program has moved in stages rather than one clean sweep: a 2022 penalty hike, a 2024 tranche covering enforcement powers and new offenses, a mid-2025 statutory tort, and a still-undrafted second tranche. The figures below track what changed, what the OAIC has done with its new powers, and what is still only a government commitment.
What is the maximum penalty under Australia's Privacy Act in 2026?
Australia now runs a three-tier civil penalty structure. The top tier, covering a serious or repeated interference with privacy, caps out at the greater of AUD 50 million, three times the value of any benefit obtained from the conduct, or 30% of the company's adjusted turnover during the breach period. That ceiling has been in place since the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 commenced on 13 December 2022, an expedited response to the 2022 Optus and Medibank breaches, and it replaced a previous cap of just AUD 2.22 million, a more than 22-fold jump.
Figure 1: Australia's top Privacy Act penalty cap, before and after the 2022 amendment. Source: Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022; Allens, "Privacy Act changes raise the bar" (2022).
The Privacy and Other Legislation Amendment Act 2024 left that top tier alone but built two lower tiers underneath it. A new mid-tier civil penalty of up to AUD 3.3 million now applies to an interference with privacy that does not meet the "serious" threshold, and a new infringement notice power lets the OAIC issue an on-the-spot penalty of up to 1,000 penalty units, AUD 364,000 for a body corporate as of 1 July 2026, for narrow, easily proven administrative failures such as not having a compliant APP 1.4 privacy policy.
| Penalty tier | Maximum penalty | Who decides it | In force since |
|---|---|---|---|
| Serious or repeated interference | AUD 50 million (or 3x benefit, or 30% of turnover) | Federal Court | 13 December 2022 |
| Non-serious interference | AUD 3.3 million | Federal Court | 11 December 2024 |
| Infringement notice (body corporate) | AUD 364,000 per contravention | OAIC directly | 11 December 2024 (indexed to AUD 364,000 from 1 July 2026) |
| Infringement notice (individual) | AUD 72,800 per contravention | OAIC directly | 11 December 2024 (indexed to AUD 72,800 from 1 July 2026) |
If you handle Australian personal information and have not reviewed your privacy policy against APP 1.4's disclosure requirements since these figures changed, that infringement notice tier is the one most likely to reach an ordinary business first: it needs no court proceeding, only a documented failure the OAIC can point to. You can generate an Australian-Privacy-Act-ready privacy policy that covers the collection, use, and disclosure statements APP 1 requires.
How does a court decide which penalty tier applies?
Not every APP breach reaches the AUD 50 million tier. The distinction turns on whether the conduct amounts to a serious or repeated interference with privacy, a threshold the Act does not define with a fixed test, leaving courts to weigh the sensitivity of the data, the scale of the breach, and whether the entity acted intentionally or recklessly.
Figure 2: How Australia's three-tier Privacy Act penalty structure routes a breach. Source: Privacy and Other Legislation Amendment Act 2024; Addisons, "The New Civil Penalties Provisions in the Privacy Act" (2024).
In practice, the top tier is reserved for conduct a court is willing to call serious, which is a higher bar than most administrative slip-ups clear. The Federal Court's own commentary in the one civil penalty case decided so far suggests the threshold, and the resulting penalty, still leaves room for penalties well below the AUD 50 million ceiling even where the court considers the outcome inadequate.
What has the OAIC actually enforced since Tranche 1 took effect?
The first, and so far only, civil penalty ever ordered under the Privacy Act is AUD 5.8 million, against Australian Clinical Labs Limited, ordered by the Federal Court on 8 October 2025 over a February 2022 ransomware breach of its Medlab Pathology business that exposed the personal and health information of more than 223,000 people. Justice Halley's judgment described the penalty as manifestly inadequate given the scale of harm, but found it fell within the permissible range because the company did not profit from the breach, cooperated with the OAIC's investigation, and had no prior contraventions.
| Enforcement outcome | Entity | Amount | Date |
|---|---|---|---|
| Civil penalty (Federal Court order) | Australian Clinical Labs | AUD 5.8 million | 8 October 2025 |
| Enforceable undertaking | Meta Platforms | AUD 50 million (compensation program) | December 2024 |
| Enforceable undertaking | Oxfam Australia | Not disclosed | 2025 |
The Meta figure in that table is a separate AUD 50 million, and it is easy to confuse with the statutory penalty cap discussed above. It is not a court-ordered fine: it is a compensation payment program Meta agreed to as an enforceable undertaking over the 2018 Cambridge Analytica matter, without admitting any breach of the Privacy Act, open to more than 300,000 Australian Facebook users who registered by 31 December 2025.
Figure 3: The OAIC's formal enforcement outcomes in FY2024-25. Source: OAIC Annual Report 2024-25 (published 5 November 2025).
Set against that enforcement record, the OAIC's day-to-day caseload is large but slow to convert into public outcomes. The regulator finalized 3,123 privacy complaints in FY2024-25, barely above the 3,103 finalized the year before, but issued only 10 determinations from those investigations, plus a further 3 published in the second half of 2025. In January 2026 the OAIC opened its first-ever privacy compliance sweep, reviewing the privacy policies of roughly 60 businesses across six sectors, including pawnbrokers, car rental firms, and licensed venues, for compliance with APP 1.4. As of August 2026, the OAIC has not published how many of those businesses received a compliance or infringement notice.
Scale still matters more than process in what the OAIC chooses to formally pursue: its July 2026 preliminary inquiry into the 2025 Qantas breach, which exposed personal information belonging to roughly 5 million Australians, closed without a formal investigation or any regulatory action, on the finding that Qantas could not reasonably have foreseen or prevented the third-party social-engineering attack behind it.
What new legal protections came with the statutory tort and doxxing offense?
Two protections from the 2024 reform tranche sit outside the civil penalty structure entirely, because they do not depend on the OAIC bringing an action at all. A new statutory tort for serious invasions of privacy commenced on 10 June 2025, letting an individual sue directly, in their own name, over an intentional or reckless intrusion on their seclusion or misuse of their information, provided their expectation of privacy in the circumstances outweighs any competing public interest. Only individuals can sue, corporations cannot, and journalists acting in a professional capacity are exempt.
Separately, a new doxxing offense under the Criminal Code took effect on 11 December 2024, making it a crime to share someone's personal information online with the intent to menace or harass them, carrying a maximum penalty of 7 years' imprisonment, rising to 6 years for a baseline offense and up to 7 years where the doxxing targets a person because of a protected attribute such as race or religion. Unlike the civil penalty tiers, this offense is prosecuted through the ordinary criminal justice system, not by the OAIC.
How has Australia's privacy reform program unfolded since 2022?
The reform program has landed in five distinct steps over roughly four years rather than as a single law.
Figure 4: Milestone dates across the reform program. Source: OAIC, Federal Register of Legislation, Attorney-General's Department media releases.
Each step layered new enforcement machinery on top of the last rather than replacing it, which is why a business assessing its exposure in 2026 has to track the 2022 penalty cap, the 2024 tranche's new tiers and offenses, and the 2025 statutory tort together, not any one of them in isolation.
What is still coming: Tranche 2 and the Children's Online Privacy Code?
Two significant pieces of the reform program are not yet law. A second reform tranche, expected to introduce a "fair and reasonable" test for collecting and using personal information, a GDPR-style right to erasure, and a narrower small-business exemption, has been a government commitment since 2023 but still has no bill before parliament. At February 2026 Senate estimates, Attorney-General Michelle Rowland confirmed the government is "progressing" a Tranche 2 bill, without offering a timetable, meaning the most consequential proposed changes, including whether small businesses lose their current exemption, remain undecided as of August 2026.
The Children's Online Privacy Code is further along. The OAIC released an exposure draft on 31 March 2026, covering online services likely to be accessed by children, with public consultation closing 5 June 2026. Under the Privacy Act, the Code must be registered, and takes effect, by 10 December 2026, though the length of any transition period for affected businesses had not been set as of this post's most recent check.
One structural driver behind all three tiers keeps working in the background regardless of what Tranche 2 does: the Commonwealth penalty unit that scales infringement notice amounts is indexed periodically, and it has climbed from AUD 222 in 2020 to AUD 364 as of 1 July 2026, a 64% increase in six years that raises every infringement notice ceiling tied to it without parliament passing anything new.
Figure 5: The Commonwealth penalty unit value, which sets Australia's infringement notice ceilings, 2020 to 2026. Source: Crimes Act 1914 indexation notices; ASIC, "Fines and penalties."
The Bottom Line
Australia's headline privacy penalty figure, AUD 50 million, has been on the books since 2022 and has never actually been used: the only civil penalty issued so far, AUD 5.8 million against Australian Clinical Labs, came from a case with mitigating factors the court itself said kept the number well below what the harm warranted. The practical risk for most businesses in 2026 sits lower down the penalty ladder, in the AUD 364,000 infringement notice tier the OAIC can issue directly for a non-compliant privacy policy, which is exactly the kind of gap its January 2026 compliance sweep was built to find. With a second reform tranche still undrafted and the Children's Online Privacy Code taking effect in December 2026, the safest position is a privacy policy that already meets APP 1.4's disclosure requirements rather than one that assumes the current rules are the final version.
Frequently Asked Questions
What is the maximum penalty under Australia's Privacy Act in 2026? AUD 50 million, or three times the value of any benefit obtained, or 30% of a company's adjusted turnover during the breach period, whichever is greatest, for a serious or repeated interference with privacy. That top tier has applied since 13 December 2022 and was left in place, alongside two new lower tiers, when the Privacy and Other Legislation Amendment Act 2024 took effect.
Has anyone actually been fined AUD 50 million under Australia's Privacy Act? No. As of August 2026, the only civil penalty ever ordered under the Privacy Act is AUD 5.8 million, against Australian Clinical Labs in October 2025, for a 2022 data breach affecting more than 223,000 people. The Federal Court itself called that amount manifestly inadequate but said it was constrained by the penalty regime that applied at the time of the conduct.
When did Australia's statutory tort for serious invasions of privacy start? 10 June 2025. It lets an individual, not a company, sue directly over an intentional or reckless invasion of privacy, separate from any OAIC enforcement action, and it excludes journalists acting in their professional capacity.
Is Australia's Privacy Act reform finished? No. Only the first of two planned reform tranches has passed. As of February 2026 Senate estimates, the Attorney-General confirmed a second tranche, covering a fair-and-reasonable test, a right to erasure, and narrower small-business exemptions, is still being drafted with no fixed introduction date.
Where the Numbers Come From
- Office of the Australian Information Commissioner. (2025). "Australian Clinical Labs Ordered to Pay Penalties in Relation to Medlab Pathology Data Breach in First for Privacy Act." AUD 5.8 million civil penalty, 8 October 2025.
- Office of the Australian Information Commissioner. "Statutory Tort for Serious Invasions of Privacy." Commencement date and elements of the tort, 10 June 2025.
- Office of the Australian Information Commissioner. (2025). "Annual Report 2024-25." 3,123 complaints finalized, 10 determinations issued, Meta and Oxfam enforceable undertakings. Published 5 November 2025.
- Office of the Australian Information Commissioner. (2025). "Privacy Compliance Sweep to Put Privacy Policies Under the Spotlight." Approximately 60 businesses, six sectors, announced 9 December 2025.
- Office of the Australian Information Commissioner. (2026). "Privacy Commissioner Completes Preliminary Inquiries Into Qantas 2025 Data Incident." Published 16 July 2026.
- Attorney-General's Department. (2026). "Draft Children's Online Privacy Code Released." Exposure draft published 31 March 2026, registration deadline 10 December 2026.
- Office of the Australian Information Commissioner. (2024). "Landmark Settlement of $50m From Meta for Australian Users Impacted by Cambridge Analytica Incident." Enforceable undertaking accepted December 2024, registration deadline 31 December 2025.
- Australian Government Solicitor. "Legal Update No. 310." Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, penalty cap increase from AUD 2.22 million to AUD 50 million, effective 13 December 2022.
- Addisons. (2024). "The New Civil Penalties Provisions in the Privacy Act: What You Need to Know." Three-tier penalty structure, infringement notice amounts, Privacy and Other Legislation Amendment Act 2024.
- Australian Securities and Investments Commission. "Fines and Penalties." Commonwealth penalty unit values, including the AUD 364 rate effective 1 July 2026.
Note: All figures verified as of August 2026. The Tranche 2 timetable and the OAIC's January 2026 compliance sweep outcomes are both unresolved as of this writing and will be updated once a bill is introduced or the OAIC publishes sweep results. Figures are refreshed at least twice a year to track new OAIC annual reports and Privacy Act amendments.
