Free · Instant · No sign-up

Privacy breach penalty calculator

Answer three plain-English questions to see which Privacy Act civil-penalty tier a breach at your agency could fall into, under the maximums introduced by the 2022 and 2024 reforms.

General information, not legal advice. Privaproof is not a law practice. This tool gives a general, illustrative indication of the maximum penalty tiers under the Privacy Act 1988. It does not assess your actual liability, which depends on your circumstances and is decided by the courts and the regulator. Get advice from a qualified lawyer before you rely on it.

Worked out entirely in your browser. Your answers never leave your device. Nothing is sent to us or to any server.

Penalty calculator · Question 1 of 3

What kind of privacy failure are you weighing up?

Pick the closest match. This is the main driver of which penalty tier applies.

Question 2 of 3

Roughly how many people were (or could be) affected?

Scale doesn't set the tier on its own, but a large-scale breach is far more likely to be judged "serious".

Question 3 of 3

What best describes your agency?

Business size affects whether the Privacy Act even applies to you, and how the top-tier maximum is calculated.

Figures are current Commonwealth maximums for a body corporate unless noted. This tool covers Privacy Act civil penalties only, not the Spam Act, the Do Not Call Register, AUSTRAC/AML penalties, or state law.

Exposure tier–

–

Illustrative only, not legal advice. This is a general indication of a maximum penalty tier, not your agency's actual liability, which depends on your circumstances and is decided by the courts and the regulator. Always confirm with a qualified lawyer before relying on this figure.

The three civil-penalty tiers, for context

Low tier

Administrative failures (e.g. no compliant privacy policy under APP 1). The court maximum is up to $364,000 for a body corporate (1,000 penalty units); up to $72,800 for an individual (200 penalty units). Separately, the OAIC can issue an infringement notice directly, without going to court, for a lower-tier contravention. The amount a notice can specify is set under the Regulatory Powers framework and is a fraction of the court maximum above.

Mid tier

An interference with privacy that is not serious. Maximum up to $3.64 million for a body corporate (up to $728,000 for an individual).

High tier

A serious interference with privacy. Maximum is the greater of $50 million, three times the benefit obtained, or 30% of the agency's adjusted turnover for the breach period.

What this is, and isn't. These are maximum penalties a court (or, for the low tier, the regulator) could impose in the most serious cases, not a prediction of what your agency would actually pay. Real outcomes turn on the facts, the harm caused, what you did to prevent and respond to the breach, and the regulator's discretion. Most matters are resolved without a maximum penalty. The reliable way to be in the better version of that conversation is to close the gaps before a breach happens.

Beyond the fine. A breach can also trigger the Notifiable Data Breaches scheme (you must assess a likely-serious-harm breach and notify affected people and the OAIC), and, since the 2024 reforms, individuals can sue directly for a serious invasion of privacy under the statutory tort, in force since 2025. Carelessness alone is not enough: the invasion has to be intentional or reckless.

Sources. Privacy Act 1988 (Cth) ss 13G (serious interference), 13H (mid tier) and 13K (low tier); the tiered civil-penalty regime was introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth) and commenced 11 December 2024, and the s 13G maximum was lifted by the 2022 enforcement amendments. Penalty-unit value is $364 from 1 July 2026 (Crimes Act 1914 (Cth) s 4AA). The largest civil penalty imposed under the Act to date is $5.8 million (Australian Information Commissioner v Australian Clinical Labs Ltd (No 2) [2025] FCA 1224); the Meta/Cambridge Analytica $50 million was a settlement, not a court penalty. Amounts are maximums for context and general information only, not a prediction of any particular outcome.

Not sure where your gaps are?

The cheapest penalty is the one you never trigger. Take the free 2-minute self-audit to see which of the 8 privacy areas your agency still needs to close.

Start the free 2-min audit →