Privacy Act penalties rise to $50 million as OAIC powers expand

From 13 December 2022, serious privacy breaches can cost companies $50 million or more. What the higher penalties and new OAIC powers mean for practices.

13 December 202211 min read

On 13 December 2022 the maximum penalty for a serious interference with privacy under the Privacy Act 1988 jumped from a little over $2 million per contravention to $50 million or more for companies. The change came through the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022, which received assent on 12 December 2022 and commenced the next day. The same Act gave the Information Commissioner a set of new investigation, information-sharing and publication powers.

For practices, this matters because so much patient information now moves through marketing tools: enquiry forms, booking widgets, email platforms, CRMs and advertising pixels. Every one of those is part of how your practice handles personal and health information, and the cost of getting it seriously wrong became very different overnight.

Later changes: the penalty framework described here was reshaped by the Privacy and Other Legislation Amendment Act 2024. From 11 December 2024 that Act added a list of factors for deciding whether an interference is “serious”, a new mid-tier civil penalty and a lower tier enforced by OAIC infringement notices and compliance notices. The $50 million ceiling remains, but it now sits at the top of a three-tier system. We cover the 2024 changes in our article on the Privacy and Other Legislation Amendment Act 2024. In October 2025 the Federal Court imposed the first civil penalties under the Privacy Act, against Australian Clinical Labs, under the older maximums because the conduct happened before this Act commenced.

What changed

The Act is No. 83 of 2022. It amended the Privacy Act, the Australian Information Commissioner Act 2010 and the Australian Communications and Media Authority Act 2005. The whole Act commenced on 13 December 2022, the day after assent.

Higher maximum penalties for serious or repeated interferences

Section 13G of the Privacy Act deals with serious or repeated interferences with the privacy of an individual. The Act made section 13G a civil penalty provision with new maximums:

Individuals: up to $2,500,000 per contravention.
Bodies corporate: up to the greater of $50,000,000; or, if the court can work out the value of the benefit the company and any related companies obtained from the conduct, three times that benefit; or, if the court cannot work out the benefit, 30% of the company’s adjusted turnover during the “breach turnover period”.

The breach turnover period is at least 12 months. Adjusted turnover is calculated broadly, including supplies made by related bodies corporate, with some exclusions such as supplies between related companies.

For context, the OAIC has said that before this change the Federal Court could impose up to $2.22 million for each contravention of section 13G (the rate that applied from May 2021 to September 2022).

No backdating

The Act states that the amended section 13G does not apply to acts or practices that happened before commencement. That is why the Australian Clinical Labs case in 2025, which concerned a February 2022 data breach, was decided under the old maximum.

New powers for the Information Commissioner

The Act also gave the Commissioner more ways to find out what happened and to tell the public about it:

Data breach information notices (new section 26WU). Where the Commissioner believes a person or entity has information or documents about an actual or suspected eligible data breach, or about an entity’s compliance with the notification rules, the Commissioner can issue a written notice requiring that information, documents or answers.
Assessment notices and publication (section 33C). During a privacy assessment, the Commissioner can require an entity to give information or produce documents within at least 14 days. The Commissioner can also publish information about an assessment on the OAIC website, and assessments can now look at whether an entity has processes to assess suspected breaches and notify them.
Information sharing (new section 33A). The Commissioner can share information with enforcement bodies, alternative complaint bodies (the eSafety Commissioner was added to that list) and state, territory or foreign privacy authorities, subject to safeguards.
Public interest disclosure (new section 33B). The Commissioner can disclose information acquired in the course of their functions where satisfied it is in the public interest, after weighing listed factors.
Stronger determinations (section 52 and new section 52A). After an investigation, a determination can now require the practice or business to prepare and publish, or otherwise communicate, a statement about the conduct, generally within 14 days. It can also require the respondent to engage a suitably qualified independent adviser to review the conduct and the steps taken to stop it happening again. The Commissioner can publish determinations on the OAIC website.
Failing to give information. Refusing or failing to give information, answer a question or produce a document when required became a civil penalty of 60 penalty units, with an offence of 300 penalty units for a corporation whose system of conduct or pattern of behaviour results in two or more contraventions. Infringement notices can be issued for the basic contravention.

Who it applies to

The penalties apply to APP entities, which are the organisations and agencies bound by the Australian Privacy Principles. Most small businesses with an annual turnover of $3 million or less are not covered by the Privacy Act, but the OAIC is clear that, regardless of turnover, the Act covers any business that is a health service provider. An organisation that provides a health service and holds health information is covered even if it is a small business or health is not its main activity.

In practical terms, that includes general practices, specialist rooms, dental practices, allied health clinics, psychology practices, cosmetic clinics and telehealth services, whatever their size. It also means a sole practitioner is not exempt simply because the business is small.

What the rules require

The Act did not add new privacy principles. The obligations themselves are the existing Australian Privacy Principles (APPs). What changed was the consequence of a serious breach and the regulator’s ability to investigate. The APPs most relevant to marketing are:

Collecting only what you need, and sensitive information only with consent

Health information is “sensitive information” under the Privacy Act. As a general rule, you can only collect it with consent and where it is reasonably necessary for your functions or activities. An enquiry form asking about symptoms, or a tracking tool that records which condition pages someone visited, can involve health information.

Using and disclosing information for the right purpose

Information collected to book an appointment or provide care should only be used or disclosed for that purpose, or for a related purpose the person would reasonably expect, unless an exception applies. Using sensitive information for direct marketing requires consent.

Keeping information secure

APP 11.1 requires reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. The first penalties ever imposed under the Privacy Act, in 2025, included $4.2 million for failures under APP 11.1.

Responding properly to data breaches

The Notifiable Data Breaches scheme requires you to assess suspected eligible data breaches and notify the Commissioner and affected individuals where required. In the Australian Clinical Labs case, separate penalties of $800,000 each were imposed for failing to assess a suspected breach promptly and for failing to notify the Commissioner as soon as practicable.

What it means for your marketing

The higher penalties are aimed at serious interferences, not every small slip. But marketing is where many practices unknowingly move patient information outside the clinical system, so it is worth looking at each channel.

Website and enquiry forms

Your website is often the first place a patient shares information about their health. Check what each form collects, where submissions go (email inboxes, a CRM, a third-party form service), who can access them and how long they are kept. Avoid free-text fields that invite detailed medical history when a simple callback request would do. If submissions are emailed to a shared inbox that half the team can read, that is a security question as much as a convenience one.

Tracking pixels and analytics

Advertising pixels from social media and search platforms can send page addresses, button clicks and form details to those platforms. On a health website, a page address alone can reveal a condition or treatment. The OAIC later published specific guidance on tracking pixels (November 2024) and, in June 2026, determinations against two health providers. We cover those in separate articles.

Email, SMS and your CRM

Patient lists exported into an email platform or CRM are still patient information. Keep exports to the fields you need, restrict access, use strong passwords and two-factor authentication, and make sure your breach response plan covers these systems, not just your practice management software.

Custom audiences and paid ads

Uploading patient lists to advertising platforms to build audiences is a disclosure of personal information to a third party. For a health practice, a list of patients who had a particular treatment is very likely to be health information. Do not do this without a clear legal basis, and get advice before treating it as routine.

Google Business Profile and review replies

Replying to a review by confirming that the reviewer is a patient, or mentioning their treatment, can disclose health information. Keep replies general and move any specific discussion offline.

Agencies and contractors

If an agency, developer or freelancer manages your website, ads or email, they are handling information on your behalf. Know who has access, what tools they have installed and what happens to your data when the relationship ends.

Common mistakes we see

Assuming the Privacy Act does not apply because the practice is small. Health service providers are covered regardless of turnover.
Treating marketing systems as separate from patient records, so they miss out on the security and access controls applied to clinical software.
Installing pixels or chat widgets on every page of a website, including condition and treatment pages, without checking what they send.
Keeping years of old enquiry form submissions in a website database or inbox with no reason to retain them.
Having no breach response plan, or one that does not mention the website, email platform or CRM.
Letting former staff or past agencies keep logins to ad accounts, email platforms and website admin.

A practical checklist

List every system that holds patient or enquiry information, including website forms, email marketing, SMS, CRM, booking tools and ad accounts.
For each, record what information it holds, who can access it and where the data is stored.
Remove form fields you do not need, especially open health questions on general enquiry forms.
Check which tracking scripts and pixels run on your site and which pages they run on.
Confirm that patient lists are not uploaded to advertising platforms without a proper basis and advice.
Turn on two-factor authentication for website admin, email marketing and ad accounts.
Remove access for former staff and past contractors.
Set a retention period for enquiry data and delete what you no longer need.
Update your data breach response plan to include marketing systems and name who assesses a suspected breach.
Make sure your privacy policy accurately describes how marketing tools use personal information.

How this fits with other rules

Privacy law sits alongside, not instead of, your advertising obligations. The National Law and Ahpra’s advertising guidelines govern what your advertising says, such as testimonials and claims. The Australian Consumer Law covers misleading conduct, and its maximum penalties also increased in November 2022 and again for conduct from 28 March 2026. The Privacy Act governs how you collect, use, disclose and protect personal information while you market.

One campaign can engage all three. A before-and-after post, for example, has to satisfy Ahpra’s advertising rules, must not mislead under consumer law, and involves the patient’s health information and image under privacy law.

Frequently asked questions

Does the $50 million maximum apply to every privacy breach?

No. The $50 million figure is the starting point of the maximum for a body corporate under section 13G, which deals with serious interferences with privacy. Courts decide whether to impose a penalty and how much. Since 11 December 2024 there are also lower penalty tiers for less serious contraventions.

Is my practice covered if our turnover is under $3 million?

Yes, if you provide a health service and hold health information. The OAIC states that the Privacy Act covers health service providers regardless of turnover.

Did the new penalties apply to breaches before December 2022?

No. The Act says the amended section 13G does not apply to acts or practices before commencement on 13 December 2022.

What new powers does the OAIC have that could affect a practice?

The Commissioner can require information about actual or suspected data breaches, require documents during assessments, publish assessment information and determinations, share information with other regulators, and require a respondent to publish a statement about its conduct or engage an independent adviser.

Are marketing tools really part of privacy compliance?

Yes. If a tool collects, stores or sends personal information, including health information inferred from what someone views or types on your website, it is part of how your practice handles personal information under the APPs.

Need a hand?

If you are not sure what your website, forms and marketing tools are collecting or sending, a structured review is the place to start. Our compliance audit covers patient data flows across your site and marketing channels, and our clinic websites team can rebuild forms and tracking so they collect only what you need. If your team runs its own email marketing, our patient email marketing service is set up with privacy in mind.

This article is general guidance based on the published rules, not legal advice. Final responsibility for how your marketing handles personal information sits with your practice, and complex situations may need independent legal or privacy advice.