LexLint

Know the law where your app runs.

Law / Australia

Privacy Act 1988 (Cth), Comprehensive Regime and Civil Penalties

Privacy Act 1988 (Cth), No. 119, 1988, ss. 6, 13, 13G, 13H, 14, 15

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 1 January 1989.

A comprehensive regime rule binding public and private bodies.

As of 6 September 2026.

What it requires

  • Comply with the Australian Privacy Principles in Schedule 1 to the Privacy Act 1988 for any personal information about an individual, if the entity is an Australian Government agency or an organisation with an annual turnover over $3,000,000.
  • Comply with the Australian Privacy Principles for an act done, or a practice engaged in, outside Australia if the entity has an Australian link.

If you get it wrong

Private right of actionNo

Penalty structure

Section 13G applies to a serious interference with privacy: for a body corporate the ceiling is the greatest of $50,000,000, three times the value of the benefit obtained from the contravention, or 30% of adjusted turnover during the breach turnover period; for an individual the ceiling is $2,500,000. A non-serious interference is a lower civil penalty of up to 2,000 penalty units under s. 13H.

Rule
Higher of
As of
6 September 2026
Currency
AUD
Fixed cap
50,000,000
Turnover percentage cap
30

Who enforces it

Enforcement body

Office of the Australian Information Commissioner (OAIC)

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Binds Commonwealth agencies and organisations, including businesses with an annual turnover over $3,000,000, to comply with the Australian Privacy Principles in Schedule 1. It also extends to an act done or a practice engaged in outside Australia by an entity with an Australian link.

An entity contravening the Act through a serious interference with privacy faces a civil penalty of up to $50,000,000, three times the value of the benefit obtained, or 30% of adjusted turnover during the breach period, whichever is greatest, for a body corporate, or up to $2,500,000 for an individual; a non-serious interference carries a lower civil penalty of up to 2,000 penalty units.

When LexLint raises it

  • crawls_web
  • trains_models
  • generates_content
  • processes_biometrics
  • high_risk_decisions

Read the law

official consolidated Act text, Federal Register of Legislation

Back to the example  ·  Lint your app