Regulatory Assessment
What Do Regulators Check Under the Privacy Act, and What Happens If You Breach It?
The OAIC looks at whether a business covered by the Privacy Act did what the law required at the time. Usually that means whether it took reasonable steps to protect personal information and handled any breach the way the Act requires. If the OAIC finds a breach, the outcome can be an agreed fix, a public determination, a compliance or infringement notice for certain breaches, or civil penalty proceedings in the Federal Court for the most serious ones.
How the OAIC comes to look at a business
Regulatory attention does not need a major breach. Most matters start in one of four ways, and the first question is always whether the business is covered by the Act at all. Most businesses with turnover of $3 million or less are not, though many are. Check whether the Privacy Act applies. Published determinations and breach notices are collected in Cleverer Breach Watch.
A complaint
One person who believes their information was mishandled can complain, usually after raising it with the business first.
A breach notification
Every notifiable data breach statement lands with the OAIC, and it can follow up on any of them.
Its own initiative
The Commissioner can investigate without a complaint, for example after media reports.
An assessment
The OAIC can assess how a business handles personal information, and can require it to produce information and documents.
What the OAIC looks at when it assesses reasonable steps
APP 11 sets no checklist. The OAIC’s APP guidelines say reasonable steps should include attention to the areas below, scaled to the information held and the risks. That is guidance, not a statutory list, but it is the lens the regulator uses.
Areas in the OAIC’s APP 11 guidance
- Governance, culture and training
- Internal practices, procedures and systems
- ICT security and access security
- Third-party providers, including cloud services
- Data breach response
- Physical security
- Destruction and de-identification
What recent decisions turned on
- Whether policies and training were actually embedded, not just written
- Whether the business knew of security weaknesses and left them
- How quickly and carefully it assessed a suspected breach
- Whether it told the OAIC as soon as practicable
The Act itself points the same way. One of the factors a court weighs in deciding whether an interference with privacy is serious is whether the business failed to take steps to implement practices, procedures and systems to comply with its obligations.
Sources: OAIC, APP Guidelines Chapter 11 · Privacy Act 1988 (Cth), s 13G · OAIC, Vinomofo determination
Would your compliance posture withstand OAIC scrutiny?
Answer 10 questions to assess whether your business is taking reasonable steps and whether you could demonstrate them.
Are You Meeting Your Privacy Act Obligations?
The Privacy Act 1988 and APP 11 require organisations covered by the Act to take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access. This assessment helps identify where your obligations may not be met.
Answer 10 questions to identify where your business may not be taking reasonable steps.
What happens if the OAIC finds a Privacy Act breach?
The OAIC has a range of tools, and since December 2024 the range has been wider. Which one it uses depends on the breach, how serious it is, and how the business responds.
| Outcome | What it involves | When it is used |
|---|---|---|
| Conciliation | The OAIC helps the person and the business agree on a resolution, such as an apology, a fix or compensation. | Most individual complaints |
| Enforceable undertaking | The business offers written commitments, such as specific improvements and reporting. If the Commissioner accepts, they can be enforced in court. | Where the business is willing to commit to fixing a problem |
| Determination | A published finding that the business interfered with privacy, with declarations that it must not repeat the conduct, must take specified steps, or must compensate people for loss or damage. | After an investigation |
| Compliance notice | A notice requiring the business to fix the breach within a reasonable period, and possibly to produce reasonable evidence that it has. Ignoring it is a separate contravention. | Only specified breaches: mainly privacy policy content, anonymity options, direct marketing opt-outs, responses to correction requests and the content of NDB statements. From 10 December 2026 this includes the automated decision disclosure. Not available for APP 11 security failures. |
| Infringement notice | A fixed penalty paid without going to court. | The same specified breaches, plus failing to give the OAIC information or to comply with a compliance notice |
| Civil penalty proceedings | The OAIC asks the Federal Court to order a penalty. For a serious interference with privacy, the maximum for a company is the greatest of $50 million, three times the value of any benefit obtained from the contravention or, where that benefit cannot be determined, 30% of adjusted turnover during the breach turnover period. Lower tiers apply to other breaches. | Serious matters, including major breaches |
The first Privacy Act civil penalty came in October 2025, when the Federal Court ordered Australian Clinical Labs to pay $5.8 million: $4.2 million for failing to take reasonable steps under APP 11.1, and $800,000 each for failing to assess its breach reasonably and expeditiously and for not notifying the OAIC as soon as practicable. Separately, since June 2025 individuals can sue directly for a serious invasion of privacy under a new statutory tort, without going through the OAIC.
Sources: OAIC, Guide to privacy regulatory action, Chapter 8A (October 2026) · OAIC, Australian Clinical Labs penalty
What Defensible Compliance Looks Like to a Regulator
When the OAIC asks what was in place, a business needs to answer with records made at the time. How it responds once a problem is found matters too: in setting Australian Clinical Labs’ penalty, the court took into account its cooperation, its cyber security uplift program, its apologies and its admission of liability.
Documented measures
- Policies that name who is responsible and are actually followed
- Training records by person, matched to role
- A breach response process people know how to use
Active maintenance
- Reviews with a date, a reviewer and an outcome
- Known weaknesses recorded, assigned and fixed
- Changes made when systems, suppliers or risks change
Retrievable evidence
- Records you can produce quickly when asked
- Dates that show what existed before an incident
- Remediation you can show was completed
Cleverer keeps that record for the organisational side: owners for each safeguard, dated reviews, issues tracked to closure and an evidence pack you can hand over. It does not assess your technical configuration or decide whether you have met the Act. More on how to prove cyber compliance.
Common questions about OAIC enforcement
Can the OAIC fine my business?
It can issue infringement notices for certain specified breaches, and it can ask the Federal Court to impose civil penalties for others. It does not set large penalties itself; those are ordered by a court.
Can the OAIC issue an infringement notice for a data breach?
Not for failing to protect information under APP 11. Infringement and compliance notices are limited to a specified list of breaches, which includes a notifiable data breach statement that leaves out required content. A security failure behind a breach is dealt with through investigation, determinations or court proceedings.
What is an OAIC compliance notice?
A power added in December 2024. If the OAIC reasonably believes a business has committed one of the specified breaches, it can require the business to fix it within a reasonable period and to produce reasonable evidence that it has. Failing to comply is a further contravention.
Are OAIC determinations public?
Yes. Determinations are published, usually naming the business, and they are commonly reported in the media.
Can directors be personally liable under the Privacy Act?
The Act’s penalties are aimed at the organisation. A director’s personal exposure comes mainly from the Corporations Act duty of care and diligence: ASIC’s chair has said that boards failing to prioritise cyber risk expose their directors to potential enforcement action on that basis. See cyber governance for directors.
Be ready to prove it.
The OAIC asks what was in place at the time. The answer that holds up is a record kept as the work happened: owners, reviews, evidence and fixes, each with a date.
General information only. This page is not legal advice.
