Data Protection Act 2025, enforcement, offences and civil remedies

Data Protection Act 2025, ss. 26-31 (complaints, investigations, notices, offences and civil remedies)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

This Act is enacted but not in force: section 2 leaves commencement to a ministerial notice, and none was located as of this review, so no enforcement obligation or exposure applies yet.
On commencement, expect the Digital Transformation Office to admit and investigate a data subject's complaint that is not frivolous or vexatious, and to be able to require attendance, documents, or a sworn statement, or, on a court warrant, to search premises or computer systems and seize items related to a suspected violation.
On commencement, comply with a notice the Office issues after investigation requiring you, within a specified period, to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty of up to $100,000, proportionate to the violation's gravity, your efforts to comply, any profit made, and the harm caused.
On commencement, expect a data subject or another interested person to be able to apply to the appropriate court for judicial review of an Office notice within thirty days, and expect a data subject who suffers injury, loss or harm from a violation to be able to recover damages in a civil proceeding, whether or not that person or a consumer organisation acting for them also received compensation under an Office notice.
On commencement, comply with any notice issued under sections 27 or 28 that is not under a duly made and ongoing appeal, or risk an offence carrying a fine of up to $100,000 and imprisonment of up to ten years, or both; that liability does not release or reduce any liability arising from the underlying notice.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Failing to comply with a notice issued under sections 27 or 28 is an offence carrying a fine not exceeding $100,000 and a term of imprisonment not exceeding 10 years, or both (s. 29(1)). The bill print read $20,000; the Act print reads $100,000. No offence can be committed before commencement.

Penalty structure

The Digital Transformation Office may order an administrative penalty of up to $100,000 for a violation (s. 28(1)(d)); failing to comply with an Office notice is itself an offence carrying a fine of up to $100,000 and imprisonment of up to 10 years, or both (s. 29(1)). Both figures read $20,000 in the bill print this note was first researched from. Kiribati has no currency of its own; the Australian dollar is the currency it uses. Enacted and not yet in force.

Rule: Fixed only
As of: 19 September 2026
Currency: AUD
Fixed cap: 100,000

Who enforces it

Enforcement body

Digital Transformation Office

What it reaches

Obligation class

Governance, Reporting

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 26 lets a data subject aggrieved by a violation of the Act lodge a complaint with the Office, which the Office admits where the complainant has an interest in the matter and the complaint is not frivolous or vexatious.

Section 27 lets the Office investigate on the basis of an admitted complaint or of its own accord where it has reason to believe a person has violated or is likely to violate the Act, with power to require attendance, documents, or a sworn statement, and, on a warrant from the appropriate court, to search premises or computer systems and seize items related to a suspected violation.

Section 28 lets the Office, after completing an investigation, issue a notice requiring a person within a specified period to stop or refrain from the violating act, compel a downstream processor to do the same, remedy the violation including compensating an affected data subject, or pay an administrative penalty not exceeding $100,000, proportionate to the violation's gravity and repetitive nature, the person's efforts to comply, any profits made, and the harm caused.

Section 29(1) makes it an offence, punishable by a fine not exceeding $100,000 and imprisonment not exceeding ten years or both, to fail to comply with a notice issued under section 27 or 28 that is not the subject of a duly made and ongoing appeal.

Section 30 lets an affected data subject, the subject of a section 28 notice, or another interested person apply to the appropriate court for judicial review of the notice within thirty days, and section 31 lets a data subject or a consumer organisation acting on their behalf recover damages in civil proceedings for injury, loss or harm caused by a violation, without duplicating compensation already ordered under a section 28 notice.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

Act text as published by the Ministry of Information
Communications and Transport, which carries it as “Data Protection Act 2025” beside the earlier bill print. The two prints differ: the administrative penalty under s. 28(1)(d) and the fine under s. 29(1) both read $20,000 in the bill and $100,000 in the Act.

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app