Privacy Act penalties 2026: the three tiers

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227, the Regulatory Powers (Standard Provisions) Act 2014 compilation C2024C00118 and the Crimes (Amount of a Penalty Unit) Instrument 2026 (F2026N00424)

s 13H the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

The three tiers at a glance

These are the most a court can order. The court sets the actual amount after weighing the nature and extent of the contravention, any loss or damage, the circumstances, and whether a court has found the entity engaged in similar conduct before.¹ Regulatory Powers Act s 82(6)

The penalty unit

From 1 July 2026 a Commonwealth penalty unit is $364.² Crimes Act s 4AA Section 4AA of the Crimes Act 1914 says an indexed amount applies only to offences committed on or after the indexation day; it does not deal separately with civil penalties. We use the $364 unit for conduct on or after 1 July 2026, and every dollar figure on this page does the same. For conduct before that date, the maximums are lower; ask a lawyer which unit applies to your facts.

For a body corporate, a penalty stated in units is multiplied by 5.¹ Regulatory Powers Act s 82(5)(a) That multiplier does not apply to the dollar maximum in Privacy Act s 13G(3), which the Act sets directly.³ s 13G(4)

Top tier: serious interference (s 13G)

An entity contravenes s 13G(1) if it does an act, or engages in a practice, that is an interference with the privacy of an individual, and the interference is serious.³ An act or practice of an APP entity that breaches an Australian Privacy Principle, or a registered APP code that binds it, in relation to personal information about an individual is an interference with privacy.⁴

In deciding whether an interference is serious, a court may consider:³ s 13G(1B)

• the kind of information involved, and how sensitive it is;
• the consequences, or potential consequences, for the individual;
• the number of individuals affected;
• whether an affected individual is a child or a person experiencing vulnerability;
• whether the conduct was repeated or continuous;
• whether the entity failed to put in place practices, procedures and systems to meet its privacy obligations, in a way that contributed to the interference;
• any other relevant matter.

The maximum for a body corporate is the greatest of:³ s 13G(3)

1. $50,000,000;
2. if the court can determine the value of the benefit the body corporate and any related body corporate obtained that is reasonably attributable to the conduct: 3 times that value;
3. if the court cannot determine that benefit: 30% of the adjusted turnover of the body corporate during the breach turnover period.

Adjusted turnover counts the supplies of the body corporate and its related bodies corporate, leaving out supplies between them and some others (s 13G(5)). The breach turnover period is at least 12 months (s 13G(7)).³ For anyone other than a body corporate, the maximum is $2,500,000.³ s 13G(2)

These maximums were set by the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022. In 2024, Privacy Act s 13G(1) was re-written, and the list of seriousness factors added, by the Privacy and Other Legislation Amendment Act 2024 (the POLA Act).⁵

Middle tier: interference with privacy (s 13H)

An entity contravenes s 13H(1) if it does an act, or engages in a practice, that is an interference with the privacy of an individual. Seriousness does not have to be shown. The maximum is 2,000 penalty units: $728,000, or $3,640,000 for a body corporate.⁶ s 13H(3)

If the Commissioner seeks a penalty under s 13G and the court is satisfied there was an interference but not that it was serious, the court may order a penalty under s 13H instead.⁶ s 13J

Low tier: listed breaches (s 13K)

Section 13K covers a breach of any of these Australian Privacy Principles:⁷ s 13K(1)

• APP 1.3, having an APP privacy policy, and APP 1.4, what it must contain;
• APP 2.1, letting individuals deal with you anonymously or under a pseudonym;
• APP 6.5, a written note of certain uses or disclosures;
• APP 7.2(c), 7.3(c), 7.3(d), 7.7(a) and 7.7(b), direct marketing opt-outs and requests;
• APP 13.5, dealing with correction requests;
• any other APP prescribed by regulations.

It also covers a data breach statement that does not contain what s 26WK(3) requires.⁷ s 13K(2) From 10 December 2026, APP 1.7, the automated-decision content of a privacy policy, joins the list.⁸ POLA Act s 2

The maximum is 200 penalty units: $72,800, or $364,000 for a body corporate.⁷ s 13K(4) The same conduct may also be an interference with privacy under s 13G or s 13H.⁷

Infringement and compliance notices

For a s 13K contravention, the Commissioner can give a notice instead of going to court.⁹

A notice covering more than one alleged contravention multiplies the amount.⁹ If the amount is paid within 28 days after the notice is given, then unless the notice is withdrawn, proceedings for a penalty order will not be brought for that contravention. Paying is not an admission of liability.¹⁰ Regulatory Powers Act s 104(1)

A compliance notice sets out the contravention and the action you must take, or stop taking, within a reasonable period. Failing to comply is itself a contravention, with a maximum of 200 penalty units, and can lead to an infringement notice.¹¹ s 80UC If you comply with a compliance notice, the Commissioner cannot seek a court penalty under ss 13G, 13H or 13K for the same conduct while the notice stands, and complying is not an admission.¹¹

Who enforces, and how

The Commissioner applies to the Federal Court or the Federal Circuit and Family Court of Australia (Division 2) for a civil penalty order.¹² s 80U The application must be made within 6 years of the alleged contravention.¹ Regulatory Powers Act s 82(2) The court can also order an entity to redress loss, pay compensation to an individual, or publish a statement about the contravention.¹² s 80UA

The OAIC's first privacy compliance sweep, announced on 9 December 2025, set out to review the privacy policies of about 60 entities in six sectors that collect information in person, including rental and property, from early 2026.¹³ OAIC Privacy policies are s 13K matters.

What to do

The low tier is the one small practices meet first, and it is about documents you can check today:

• a privacy policy that covers every APP 1.4 matter, and from 10 December 2026 any automated decisions;
• collection notices at the point you collect;
• a data breach plan that can produce a complete s 26WK statement.

These tiers apply only where the Act applies to you. See Does the Privacy Act apply to your small business?

More in the Privacy Act section. Every source we use: sources.

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.