For years the Privacy Act had penalties that most small businesses could ignore. That has changed, and the range of consequences is now much wider.
The headline figures
For serious or repeated interferences with privacy, the maximum civil penalty for a company is the greater of $50 million, three times the benefit obtained from the conduct, or 30 per cent of adjusted turnover during the breach period. Those figures are aimed at serious cases and large organisations, and no small business should expect a penalty of that size.
The smaller penalties are the ones to watch
The 2024 amendments also created lower-tier penalties and the power to issue infringement notices for certain failures, such as not having a compliant privacy policy. For a business, an infringement notice for a policy that does not meet the requirements can be up to $66,000. That amount is realistic for a small business to receive, which is why we use it as the example figure.
Other consequences
- A statutory tort for serious invasions of privacy has applied since June 2025, so individuals can bring claims
- The OAIC can investigate, make determinations and require changes
- Customers and partners increasingly ask about privacy before they sign
What to do about it
The cheapest protection is a current, accurate privacy policy that matches what your website and tools really do. Fixing a policy costs far less than answering a notice about one.
This is general information, not legal advice. Penalty amounts depend on the facts and on decisions of the OAIC and the courts. For advice on your situation, speak with a qualified privacy lawyer.