Data Protection Act 2021 Revision, Ombudsman enforcement, monetary penalties and offences
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 30 September 2019.
An enforcement supervision rule binding public and private bodies.
As of 7 September 2026.
What it requires
- Cooperate with a warrant executed under section 52 to investigate a suspected contravention of the data protection principles or an offence under the Act.
- Pay a monetary penalty order the Ombudsman serves for a serious contravention, or make written representations within twenty-one days of a notice of intent.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A person who commits an offence under the Act, except where the Act otherwise provides, is liable on summary conviction to a fine of ten thousand dollars or on conviction on indictment to a fine of twenty thousand dollars, under section 57(1), in addition to any monetary penalty the Ombudsman imposes under section 55.
Penalty structure
Section 55(3) caps a monetary penalty order the Ombudsman may serve for a serious contravention likely to cause substantial damage or distress at two hundred and fifty thousand dollars. A general offence under the Act carries a separate, lower criminal fine (ten thousand dollars summary, twenty thousand dollars on indictment) under section 57(1), which is not folded into this cap because it runs on a different, criminal track.
- Rule
- Fixed only
- As of
- 7 September 2026
- Currency
- KYD
- Fixed cap
- 250,000
Who enforces it
Enforcement body
Office of the Ombudsman
What it reaches
Obligation class
Governance, Reporting
Who checks it
Audit expectation
none
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The Office of the Ombudsman enforces the Act. A judge may grant the Ombudsman a warrant to enter and search premises and inspect or seize equipment and documents where there are reasonable grounds to believe a data controller has contravened the data protection principles or committed an offence.
The Ombudsman may serve a data controller with a monetary penalty order, capped at two hundred and fifty thousand dollars, for a serious contravention likely to cause substantial damage or distress, after a twenty-one day notice-of-intent period. A general offence under the Act is liable, except where the Act otherwise provides, to a fine of ten thousand dollars on summary conviction or twenty thousand dollars on conviction on indictment.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbot
Read the law
Data Protection Act (2021 Revision), Office of the Ombudsman