Privacy Act Penalty Calculator
Enter your business's turnover or contravention count and get an estimated maximum penalty exposure at a permanent URL you can bookmark or share.
Serious or repeated breaches of the Privacy Act 1988 (Cth) carry civil penalties of up to $50 million, 3 times the benefit obtained, or 30% of adjusted turnover — whichever is greatest. Non-serious contraventions carry penalties of up to $66,000 per contravention. Enter your numbers below for an estimated maximum exposure figure.
Last updated: 3 July 2026
Penalty reference table
| Contravention type | Maximum penalty |
|---|---|
| Serious or repeated interference with privacy | Greatest of $50 million, 3× benefit obtained, or 30% of adjusted turnover |
| Non-serious contravention | Up to $66,000 per contravention |
Estimate your exposure
Choose the type of breach, enter your numbers, and get an instant estimate at a shareable URL.
When to check your penalty exposure
- — You're assessing the business case for compliance work before a deadline
- — You've had a data breach and need an indicative worst case for a board or client conversation
- — You're newly covered from 1 July 2026 and want to understand the scale of the risk
- — You're deciding how much to invest in a compliance workspace versus doing nothing
Relevant free tools
Frequently asked questions
How much can a business be fined for breaching the Privacy Act?
For a serious or repeated interference with privacy, penalties reach the greatest of $50 million, 3 times the benefit obtained from the breach, or 30% of adjusted turnover during the breach period. Non-serious contraventions carry penalties of up to $66,000 per contravention for a body corporate.
What decides whether a breach is serious or non-serious?
The OAIC assesses seriousness based on the sensitivity of the information involved, the number of individuals affected, whether the conduct was repeated, and whether the entity had reasonable safeguards in place under APP 11. A single limited incident is more likely to be treated as a non-serious contravention.
Is this penalty calculator legal advice?
No. This calculator applies the statutory maximum penalty formulas under the Privacy Act 1988 (Cth) to estimate a ceiling figure. Courts determine actual penalties case by case, and actual outcomes are typically well below the statutory maximum. Get advice from a privacy professional for your specific situation.
Want the full picture — what triggers enforcement, recent OAIC activity, and the statutory tort? Read the penalties guide.
Read the penalties guide →Don't have a privacy policy yet?
Generate a custom, APP 1.3-compliant privacy policy draft — including the automated decision-making disclosure required from 10 December 2026 — in about 60 seconds. Free, no account required.
Generate my privacy policy →