Chapter 8: Infringement notices

On this page

Published: December 2024

Updated: 09 October 2026

Version 1.0

Version history tabulated from 9 October 2026

Introduction

8.1 An infringement notice is a notice issued by a regulatory authority or enforcement agency to a person or entity that sets out the particulars of an alleged contravention of an offence or civil penalty provision and an amount to be paid. A person who is issued with an infringement notice can choose to pay the penalty amount specified in the notice as an alternative to court proceedings.

8.2 In the OAIC context, if a person does not comply with an infringement notice, the OAIC may commence court proceedings against that person for the alleged contravention the subject of the infringement notice.

8.3 Nonetheless, infringement notices are designed to provide an alternative to potential litigation of a matter and encourage timely and cost-efficient enforcement outcomes in relation to relatively straightforward contraventions of the Privacy Act.

Legislative framework

8.4 Section 80UB of the Privacy Act with Part 5 of the Regulatory Powers (Standard Provisions) Act 2014 (Regulatory Powers Act) empowers the Commissioner and the OAIC Senior Executive Service staff (SES), to issue an infringement notice. The OAIC can issue an infringement notice in the following circumstances:

Failure or refusal to give information, answer a question or produce a document

When there is a belief on reasonable grounds that a person has contravened s 66(1) of the Privacy Act.

A person contravenes s 66(1) if they fail (or refuse) to give information, answer a question or produce a document or record when required to do so under the Privacy Act (for example if they refuse to provide information during the course of an assessment under Division 3A of the Privacy Act or an investigation under Part V of the Privacy Act).

Section 66 is subject to the safeguard in s 66(1B), which provides that a person cannot be penalised if they have a reasonable excuse.

Civil penalty provision for which infringement notices can be issued

When there is a belief on reasonable grounds that an entity has contravened s 13K(1) of the Privacy Act. An entity contravenes s 13K if they engage in an act or practice that breaches any of the following APP provisions: APPs 1.3, 1.4, 2.1, 6.5, 7.2(c) or 7.3(c), 7.3(d), 7.7(a), 7.7(b) and 13.5.

Non-compliant eligible data breach statement

When there is a belief on reasonable grounds that an entity has contravened s 13K(2) of the Privacy Act. An entity contravenes s 13K(2) if the entity prepares a statement under s 26WK of the Privacy Act and the statement does not comply with ss 26WK(3).

Failure to comply with a compliance notice

When there is a belief on reasonable grounds that an entity has contravened s 80UC(4) of the Privacy Act. An entity contravenes section 80UC(4) if the entity is given a compliance notice under s 80UC(1) and the entity fails to comply with the notice.

Requirements under the Digital ID Act

When there is a belief on reasonable grounds that a person has contravened s 136 of the Digital ID Act 2024 (Digital ID Act), or the Digital ID privacy safeguards (Part 2, Division 2 of the Digital ID Act). Section 124 of the Digital ID Act with Part 5 of the Regulatory Powers Act empowers the Commissioner and the OAIC’s SES staff to issue an infringement notice^[1]

Purpose and key features of an infringement notice

8.5 Infringement notices are intended to encourage compliance and enable the OAIC to quickly and effectively resolve privacy complaints and investigations where taking such action is proportionate and consistent with the OAIC’s regulatory approach. They enable the OAIC to respond quickly to contraventions of the Privacy Act that can be determined through straightforward, factual circumstances.^[2]

8.6 Infringement notices issued under s 80UB of the Privacy Act and s 124 of the Digital ID Act are an alternative to litigation and may be used in circumstances where a regulatory response is justified, but where it is preferable to address breaches of identified statutory provisions in a timely and proportionate manner.

When will an infringement notice be issued

8.7 An infringement notice may be issued for a contravention of a statutory provision that is identified as subject to an infringement notice, if the officer believes on reasonable grounds that a person or entity has contravened that section.^[3]

8.8 Whether there are reasonable grounds for forming a belief is both an objective and subjective test. The reasonable belief must be based on the facts of each matter. The reasonable belief must also be held subjectively by the person issuing the notice.

8.9 An infringement notice must be issued within 12 months of an alleged contravention taking place.^[4]

8.10 Once the OAIC issues an infringement notice (and if the notice is not withdrawn), it cannot issue an entity with a compliance notice for the same contravention.^[5]

For a single contravention of s 13K(1) or (2), s 66(1) or s 80UC(4) of the Privacy Act, s 136 of the Digital ID Act or an alleged contravention of a privacy safeguard provision in the Digital ID Act, the amount to be stated in the infringement notice will be the lesser of:

12 penalty units for an individual, and 60 penalty units for bodies corporate and
one-fifth of the maximum penalty that a court could impose on the person for that contravention.

8.12 For a single contravention of s 13K(1) or (2), or s 80UC(4) by a listed corporation, the amount to be stated in the infringement notice will be 200 penalty units.^[6]

8.13 The amount payable in an infringement notice is significantly lower than the civil penalties that a court could impose in relation to the alleged contravention of the infringement notice provisions.^[7]

Multiple infringement notices

An infringement notice under s 80UB of the Privacy Act will set out the particulars of a single alleged contravention of the infringement notice provisions.

8.15 Where there has been more than one contravention of an infringement notice provision, the OAIC may issue a recipient with multiple infringement notices, each relating to a separate contravention.^[8]

8.16 Two or more contraventions of s 66(1) by a body corporate can be considered a criminal offence under s 66(1AA), that may attract a maximum penalty of 300 penalty units, if a body corporate has engaged in serious, systemic conduct or a pattern of behaviour. The Commissioner may refer the matter to the Australian Federal Police or Commonwealth Director of Public Prosecutions.

Content of an infringement notice

8.17 The matters which must be included in an infringement notice that is issued to a recipient include:

information regarding the nature of the alleged contravention of the infringement notice provision
the maximum penalty that a court can impose for each contravention, if the provision were contravened^[9]
the penalty amount to be paid^[10] and the period for payment (usually 28 days) if the person wishes to avoid court action
state that payment of the amount is not an admission of guilt or liability
the name and contact details of the Commissioner or member of the SES who issued the notice
how to seek an extension of time for payment by way of an application to the Commissioner
how to seek withdrawal of a notice by way of written representations to the Commissioner.^[11]

8.18 The infringement notice is also required to state that the person may choose not to pay the penalty and notify them that, if they choose not to pay, proceedings seeking a civil penalty order for a contravention of the infringement notice provision may be brought against them in a court.

The decision to issue an infringement notice

8.19 Whether an infringement notice will be issued will be determined on a case-by-case basis.

8.20 In deciding whether to issue an infringement notice, the OAIC will refer to its statement of regulatory approach^[12] as well as the factors set out in the Privacy regulatory action policy. ^[13]

8.21 The OAIC is less likely to consider issuing an infringement notice where:

the concerns are more serious in nature and warrant consideration by a court
there have been significant impacts arising from the alleged failure to provide the information and/or documentation, or the alleged contravention of APP obligations
there are concerns that the alleged conduct may be continuing
a complex assessment of facts, matters and circumstances is required in order to determine whether a contravention has occurred
there are questions about timing, including whether the alleged conduct occurred within the 12-month period set out at paragraph 8.12.

Issuing an infringement notice

8.22 Where the OAIC intends to issue an infringement notice under s 66(1) of the Privacy Act, the OAIC will generally have engaged with the relevant person or body corporate before it decides that an infringement notice may be an appropriate regulatory response. This is because an infringement notice will only be issued under s 66(1) of the Privacy Act to a recipient following non-compliance with a request for information or production of documents.^[14]

8.23 Where the OAIC has reasonable grounds to believe that an entity has contravened s 13K(1) or (2), or s 80UC(4) of the Privacy Act, it may issue an infringement notice without engaging with the entity first. This is because the infringement notice provisions under s 13K(1) or (2), or s 80UC(4) of the Privacy Act are intended to enable the OAIC to respond quickly to relatively straightforward contraventions of the Privacy Act.^[15]

8.24 Infringement notices under the Digital ID Act can also be issued when there are reasonable grounds to believe that a person has contravened s 136 of the Digital ID Act or the Digital ID privacy safeguards. However, contraventions of s 136 of the Digital ID Act or the Digital ID privacy safeguards may be less straightforward. In practice this means the OAIC may also have engaged with the relevant person or body corporate before it decides an infringement notice under the Digital ID Act may be an appropriate regulatory response in the matter.

Receiving an infringement notice

8.25 The compliance period for payment of an infringement notice penalty is 28 days. The Commissioner may grant an extension of time in relation to an infringement notice more than once.^[16]

8.26 The recipient of an infringement notice should ensure that the payment is received by the OAIC within the compliance period, as set out in the notice.

Seeking an extension of time to pay

The recipient may, before the end of the compliance period, seek an extension of time to pay the amount specified in the notice.^[17] An application for an extension of time must be made in writing to the Commissioner and should include:

whether the recipient intends to pay the infringement notice penalty;
why the recipient is unable to pay the infringement notice penalty within the current compliance period; and
why the recipient anticipates they will be able to comply, if the compliance period is extended.

8.28 If an extension of time is not granted, then the compliance period expires on the later of:

the last day of the period specified in the original notice (this will usually be on the 28th day for the period commencing on the day after the notice is given); or
on the 7th day after the notice of the Commissioner’s decision not to extend the compliance period was given (with that 7 day period commencing the day after the notice is given).^[18]

Seeking withdrawal of an infringement notice

A recipient of an infringement notice is also permitted to seek withdrawal of an infringement notice by way of written representations to the Commissioner.^[19]

8.30 When deciding whether or not to withdraw an infringement notice, the Commissioner will consider the recipient’s written representations and may also take into account:

whether a court has previously imposed a penalty on the recipient for a contravention of an infringement notice provision
the circumstances of the alleged contravention the subject of the notice
whether the recipient has paid an amount in an earlier infringement notice for contravention of an infringement notice provision, where the conduct the subject of that contravention is the same, or substantially the same, as the conduct set out in the current infringement notice (that is sought to be withdrawn)
any other matters that are considered to be relevant.

8.31 If a decision is made to withdraw an infringement notice, a notice of withdrawal must be provided to the recipient. That withdrawal notice must state:

the recipient’s name and address
the day the infringement notice was given
the identifying number of the infringement notice
that the infringement notice is withdrawn
that proceedings seeking a civil penalty order may be brought against them in relation to the alleged contravention of the infringement notice provision.

8.32 If an infringement notice is withdrawn, the OAIC will consider on a case-by-case basis whether further action is appropriate. That action could include the institution of proceedings for the alleged contravention of an infringement notice provision, to seek the civil penalty set out in the relevant section.

Implications of paying an infringement notice amount

8.33 If the recipient pays the penalty amount stated in the infringement notice before the end of the compliance period:

the recipient is discharged from liability in respect of the alleged contravention of the infringement notice provision set out in the notice
the Commissioner cannot commence court proceedings in relation to the alleged contravening act
the recipient is not regarded as having admitted guilt or liability for the alleged contravention.

Implications of not paying an infringement notice amount

8.34 There is no legal obligation to pay an infringement notice penalty. However, if a recipient does not make payment before the end of the compliance period, proceedings may be brought against the recipient in relation to contravention of the infringement notice provision.

8.35 If civil penalty proceedings are brought against the recipient under s 66(1) of the Privacy Act then the maximum penalty is 300 penalty units for a body corporate^[20] and 60 penalty units for an individual.^[21]

8.36 If civil penalty proceedings are brought against the recipient under s 13K(1) or (2), or s 80UC(4) of the Privacy Act, the maximum is 200 penalty units.^[22]

8.37 If civil penalty proceedings are brought against the recipient in relation to contravention of a relevant civil penalty provision in the Digital ID Act, then the maximum penalty is 7500 penalty units for a body corporate and 1500 penalty units for a person who is not a body corporate. ^[23]

8.38 If civil penalty proceedings are brought against the recipient under s 136 of the Digital ID Act then the maximum penalty is 5000 penalty units for a body corporate and 1000 penalty units for a person who is not a body corporate.^[24]

Footnotes

^[1] Section 124 of the Digital ID Act provides that each civil penalty provision of the Act is subject to an infringement notice under Part 5 of the Regulatory Powers Act, with some civil penalty provisions enforceable by the Australian Competition and Consumer Commission.

^[2] See Explanatory Memorandum to the Privacy and other Legislation Amendment Bill 2024.

^[3] See s 80UB(2) of the Privacy Act and s 101 of the Regulatory Powers Act.

^[4] See s 103(2) of the Regulatory Powers Act

^[5] S 80UC(9) and (10) of the Privacy Act. Also, see Chapter 8A of the Guide to Privacy Regulatory Action.

^[6] See s 104(2)(b) of the Regulatory Powers Act and s 80UB(1A) of the Privacy Act. At the current penalty unit value in July 2026, this leads to a maximum penalty of $4,368 for an individual, $21,840 for bodies corporate and $72,000 for listed corporations. Penalty unit values tend to increase over time. The value of a penalty unit is contained in s 4AA of the Crimes Act 1914 (Cth) — see https://www.legislation.gov.au/Series/C1914A00012.

^[7]Section 66(1) is a civil penalty provision, the contravention of which attracts a penalty of 300 penalty units for a body corporate (under section 82(5) of the Regulatory Powers Act, the penalty for bodies corporate (if it is not specified in the civil penalty provision) must not be more than 5 times the penalty specified in the civil penalty provision) and 60 penalty units for an individual. At the current penalty unit value, this leads to a maximum penalty of $21,840 for a person and $109,200 for bodies corporate.

^[8]Where there are separate alleged contraventions of the same provision, each must be the subject of a separate infringement notice. Where an entity has breached multiple subsections of a provision (e.g. APP 1.4 (a), (b) and (c)) subject to the construction of the provision, this may amount to a single contravention.

^[9] For more information see Chapter 7: Civil penalties — serious or repeated interference with privacy and other penalty provisions

^[10]In addition to informing entities of the amount payable under s 104(1)(f) of the Regulatory Powers Act, the OAIC will also inform entities how the amount was calculated (i.e. applying the relevant penalty unit values under s 4AA of the Crimes Act 1914 as at the date of the contravention).

^[11] Section 104(1) of the Regulatory Powers Act sets out the requirements for what should be included in an infringement notice issued to a recipient.

^[12] See Statement of regulatory approach

^[13] See Privacy regulatory action policy

^[14] For example, under ss 33C(3), 44(1), 46(4) or 47(1).

^[15] See Explanatory Memorandum to the Privacy and other Legislation Amendment Bill 2024

^[16]See section 105(5) of the Regulatory Powers Act.

^[17] See section 105 of the Regulatory Powers Act.

^[18] See section 105(4) of the Regulatory Powers Act.

^[19] See section 106 of the Regulatory Powers Act.

^[20] Under section 82(5) of the Regulatory Powers Act, the penalty for body corporates (if it is not specified in the civil penalty provision) must not be more than 5 times the penalty specified in the civil penalty provision.

^[21] At the current penalty unit value, this leads to a maximum penalty of $21,840 for a person and $109,200 for bodies corporate. The value of a penalty unit is contained in s 4AA of the Crimes Act 1914 (Cth) — see https://www.legislation.gov.au/Series/C1914A00012.

^[22]See s 13K(4) and s 82(5) of the Regulatory Powers Act, noting s 13K(4) and s 80UC(6) set out the maximum pecuniary penalty payable for contraventions of s 13K(1) or (2), or s 80UC(6).

^[23]At the current penalty unit value, this leads to a penalty of $2,730,000 for a body corporate and $546,000 for a person who is not a body corporate.

^[24]At the current penalty unit value, this leads to a penalty of $1,650,000 for body corporate and $364,000 for a person who is not a body corporate.