The OAIC's enforcement toolkit after the 2024 privacy reforms

Before the Privacy and Other Legislation Amendment Act 2024, the Office of the Australian Information Commissioner had a narrow choice. It could investigate and make a determination, or it could go to the Federal Court seeking a civil penalty for a serious or repeated interference with privacy. Part 8 of Schedule 1 to the 2024 Act, which commenced on 11 December 2024, filled the space between those options. The new provisions apply to acts done, or practices engaged in, after that date.

The result is a graduated toolkit. Understanding which tool fits which kind of failure helps organisations decide where to concentrate their compliance effort.

Tier one: serious interference with privacy (section 13G)

Section 13G now applies where an entity’s act or practice is an interference with an individual’s privacy and the interference is serious. The previous “repeated” limb was removed. New subsection 13G(1B) lists factors a court may consider, including the kinds and sensitivity of the information, the actual or potential consequences, the number of people affected, whether those affected include children or people experiencing vulnerability, whether the conduct was repeated or continuous, and whether the entity failed to implement practices, procedures and systems to comply with its privacy obligations.

The maximum penalties for this tier were set by 2022 amendments and remain in place. For a body corporate the maximum is the greatest of $50 million, three times the value of any benefit reasonably attributable to the conduct, or, if that benefit cannot be determined, 30 per cent of adjusted turnover during the breach turnover period. For other persons the maximum is $2.5 million.

Tier two: any interference with privacy (sections 13H and 13J)

Section 13H is a new mid-tier civil penalty provision. It applies to any act or practice that is an interference with the privacy of an individual, with no seriousness threshold. The maximum is 2,000 penalty units. Under the Regulatory Powers (Standard Provisions) Act 2014, a court may impose up to five times that amount on a body corporate.

Section 13J allows a court that is not satisfied an interference was serious to make a penalty order under section 13H instead. In practice, this lowers the risk for the regulator in bringing proceedings under section 13G.

Tier three: infringement notices for specified breaches (sections 13K and 80UB)

Section 13K creates a civil penalty provision, with a maximum of 200 penalty units, for breaches of specified Australian Privacy Principles:

• APP 1.3 and 1.4: having an APP privacy policy and including the required content
• APP 2.1: allowing individuals to deal anonymously or by pseudonym
• APP 6.5: making a written note of certain uses or disclosures
• APP 7.2(c), 7.3(c), 7.3(d), 7.7(a) and 7.7(b): direct marketing opt-outs and related requests
• APP 13.5: dealing with correction requests
• any other APP prescribed by regulations.

Section 13K(2) also covers a data breach statement that does not comply with section 26WK(3).

These contraventions are subject to infringement notices under Part 5 of the Regulatory Powers Act (section 80UB). For a listed corporation, the amount stated in a notice is 200 penalty units for each alleged contravention. Paying an infringement notice avoids court proceedings for the alleged contravention. The value of a penalty unit is set under the Crimes Act 1914 and indexed, so dollar figures change over time.

Compliance notices (sections 80UC and 80UD)

The Commissioner, or a senior OAIC officer, may give a compliance notice where they reasonably believe an entity has contravened section 13K. The notice sets out the contravention and the action the entity must take, or stop taking, within a reasonable period, and may require evidence of compliance. Failing to comply is itself a civil penalty provision with a maximum of 200 penalty units.

Complying with a notice is not an admission. If the entity complies, the Commissioner cannot seek a civil penalty for the same conduct. A compliance notice cannot be given while an infringement notice or an enforceable undertaking for the same contravention remains on foot. An entity may apply to the Federal Court or the Federal Circuit and Family Court for review on the grounds that it did not commit the contravention or that the notice is defective (section 80UD).

Wider court orders and other powers

New section 80UA allows the Federal Court, or the Federal Circuit and Family Court (Division 2), to make further orders once it determines that an entity has contravened a civil penalty provision. Examples include orders to redress loss or damage, to pay compensation to any individual, to engage or not engage in specified conduct, and to publish a statement about the contravention. Affected individuals or the Commissioner can apply within six years of the contravention, and the section applies to proceedings instituted after commencement whether the contravention occurred before or after that date.

The 2024 Act also allowed determinations under section 52 to require steps to prevent or reduce reasonably foreseeable loss, introduced public inquiries directed or approved by the Minister (section 33E), and aligned the OAIC’s monitoring and investigation powers with the Regulatory Powers Act.

How the powers are being used

The first civil penalty judgment under the Privacy Act was Australian Information Commissioner v Australian Clinical Labs Limited (No 2) [2025] FCA 1224. On 8 October 2025, Justice Halley ordered agreed penalties totalling $5.8 million arising from a 2022 cyber incident at the company’s Medlab Pathology business: $4.2 million for failing to take reasonable steps under APP 11.1(b) to protect personal information, $800,000 for failing to carry out a reasonable and expeditious assessment under section 26WH(2), and $800,000 for failing to give the Commissioner a statement as soon as practicable under section 26WK(2). The company was also ordered to contribute $400,000 to the Commissioner’s costs. The conduct predated the 2022 increases, so the maximum was $2.22 million per contravention. The court accepted that each of more than 223,000 affected individuals represented a separate contravention, while treating the security failures as one course of conduct in fixing the penalty.

Two larger proceedings are before the Federal Court. The OAIC announced civil penalty proceedings against Medibank Private on 5 June 2024, alleging failures to protect the personal information of 9.7 million Australians between March 2021 and October 2022. On 8 August 2025 it announced proceedings against Optus, alleging failures affecting about 9.5 million Australians between October 2019 and September 2022. Both are framed as serious interferences under section 13G, with one contravention alleged per affected individual. Whether penalties are ordered, and in what amount, is a matter for the court.

The new lower tiers are also in use. On 9 December 2025 the OAIC announced its first privacy compliance sweep, reviewing the privacy policies of about 60 businesses across six sectors against APP 1.4, and noted that compliance and infringement notices were available. In June 2026 the Privacy Commissioner published determinations that Medmate Australia and Monash IVF had interfered with privacy by collecting health information through third-party tracking pixels without consent.

The OAIC’s 2025–26 regulatory action priorities focus on power and information imbalances, naming sectors such as rental and property, credit reporting and data brokerage, and practices such as pixel tracking. They also cover facial recognition, biometrics, location tracking and artificial intelligence. Its 2026–27 corporate plan states that it will continue to progress civil penalty proceedings against a number of entities.

General information, not legal advice. Confirm how these enforcement provisions apply to your organisation with your legal adviser.