The first civil penalty handed down under Australia’s Privacy Act 1988 landed in 2025, and it was not a small one. The Federal Court ordered Australian Clinical Labs to pay $5.8 million for a data breach that exposed the personal information of more than 223,000 people. That case was the opening move in what looks like a sustained period of legal exposure for Australian companies across multiple fronts.
Disclosure: Some links on this page are affiliate links. If you make a purchase through them, Britwealth may earn a commission at no extra cost to you. We only include products and services that are relevant to the topic.
This article is general information only and does not constitute professional advice. For your specific situation, consult a qualified professional.
What stands out is not just the size of these figures but the range of areas they cover. Privacy breaches, superannuation claims handling, misleading environmental claims, and class actions are all producing court outcomes that carry serious financial consequences. The way Australian businesses manage risk is being tested from multiple directions at once. Here’s what you actually need to know.
Four Things to Know About Australian Business Disputes
The term class action appears regularly in Australian dispute reporting, and for good reason. A class action is a legal proceeding where one person or a small group represents a larger group of people who have suffered similar harm. Australian companies now face class actions across consumer, employment, financial services, shareholder, product liability, privacy, and government categories. What I tend to notice is that many businesses still treat class action risk as something that only affects large corporations, when in practice the net is widening to include mid-sized firms in sectors like healthcare, construction, and retail. The pressure on Australian businesses from economic conditions only adds to the strain when legal disputes arise.
What the Penalties Actually Cost
The $23.5 million penalty imposed on United Super Pty Ltd in November 2025 for failing to process death, terminal illness, and total and permanent disability claims within a reasonable time affected 7,402 claimants. That is not a theoretical risk — it is a concrete outcome of a regulator deciding that slow internal processes amount to a compliance failure. The Federal Court agreed, and the penalty reflected the scale of the harm.
The privacy penalty regime is structured in three tiers, with Tier 3 reserved for the most serious interferences. The Australian Clinical Labs case was the first civil penalty imposed under the Act, but the Office of the Australian Information Commissioner (OAIC) received 532 data breach notifications in just the first half of 2025, with an average of more than 10,000 individuals affected per incident. Malicious or criminal attacks accounted for 59% of those notifications. For a business, the cost is not just the fine itself — it includes legal fees, remediation work, reputational damage, and the distraction of defending a regulatory action while trying to operate normally.
Shareholder class actions add another layer. Despite the volume of cases filed, no shareholder class action in Australia has resulted in court-awarded damages. That does not mean the risk is low — it means cases tend to settle before trial, often for substantial sums. The High Court has also confirmed that damages should not include the costs of obtaining litigation funding, which shifts more of the financial burden onto defendants in settlement negotiations.
Where Businesses Commonly Get Caught Out
Failing to Preserve Electronic Evidence Early
Commercial litigation in Australia is becoming front-loaded. Courts now expect early evidence preservation, tighter pleadings, and faster case management from the outset. The first 90 days of a dispute determine the evidence available, the shape of the pleadings, and the strategic leverage each side holds. Electronic material can disappear quickly through device replacement, staff turnover, and routine file overwriting. A business that waits until a formal claim is filed to start preserving documents has already lost ground. The Federal Court’s Central Practice Note emphasises proportionality and reduced delay, which means courts are less willing to grant extensions for late evidence gathering.
Treating Privacy as an IT Problem Rather Than a Legal Risk
The OAIC announced its first privacy compliance sweep of Australian businesses in December 2025, checking whether internal data practices match published privacy statements. A company that says one thing in its privacy policy and does another in practice is exposed to enforcement action regardless of whether a data breach occurs. The statutory tort for serious invasions of privacy commenced on 10 June 2025, meaning individuals can now take direct legal action for privacy harms without waiting for a regulator to step in. The first application for relief under this tort was heard in Kurraba Group Pty Ltd & Anor v Williams regarding unauthorised use of private wedding photos. This is not a theoretical change — it is already being tested in court.
Underestimating Director Duties in New Risk Areas
Directors face greater scrutiny over cybersecurity preparedness, anti-money laundering obligations, and financial reporting accuracy. The ASIC v Noumi decision confirmed that a voluntary disclosure agreement with a regulator does not waive legal privilege when the regulator makes “derivative use” of a privileged report. That matters because it changes how directors and their legal teams approach confidential disclosures to regulators. A director who assumes that cooperating fully with a regulator automatically protects the company from subsequent litigation may find that assumption tested in court.
Ignoring the Shift in Class Action Procedures
The High Court in Lendlease Corporation Ltd v Pallas confirmed that the NSW Supreme Court can make “soft” class closure orders, requiring class members to register claims within a specified timeframe. This decision is expected to accelerate early mediation and settlement strategies in class actions. For a business facing a class action, the timeline for making strategic decisions has shortened. Waiting to see how many claimants join the action before engaging in settlement talks is no longer a viable approach.
→ Scroll right to see all columns
| Risk Type | Key Trigger | Maximum Penalty | Trend |
|---|---|---|---|
| Privacy / data breach | Failure to protect personal data or misaligned privacy practices | $50M or 30% of turnover | Rising sharply with new enforcement |
| Class action | Widespread consumer, shareholder, or employee harm | Unlimited (settlements + costs) | Expanding to new sectors |
| Regulatory enforcement | Non-compliance with specific obligations | Varies by regulator (up to $23.5M seen) | More proactive and targeted |
| ESG / climate litigation | Misleading environmental claims or inadequate disclosure | No cap established; $12.9M seen | Emerging and growing |
| AI-related dispute | Copyright infringement, privacy breach, or bias from AI use | Unsettled | Rapidly emerging |
Building a Defensible Legal Position
Document Retention That Matches Court Expectations
The front-loading of commercial litigation means a business needs its document retention systems working before a dispute arises. That means identifying decision-makers, preserving communications across devices, and having a clear internal escalation process for any event that might lead to a claim. Courts now expect early and comprehensive disclosure, and the cost of reconstructing lost evidence late in a proceeding can be substantial. A practical step is to run a document retention audit at least once a year, covering emails, messaging apps, file shares, and cloud storage. Using a business VPN for secure communications can also help protect sensitive internal discussions from interception or accidental exposure.
Aligning Privacy Practices With Published Statements
The OAIC’s compliance sweep means a business cannot afford a gap between what its privacy policy says and what its staff actually do with customer data. The sweep checks internal practices against published statements, so a policy that promises limited data collection while the marketing team shares customer lists with third parties is a direct enforcement risk. The fix involves mapping every data flow in the business, documenting who has access to what, and training staff on the difference between what the policy says and what they are allowed to do. For businesses that handle sensitive health or financial data, the three-tier penalty regime means the cost of getting this wrong can reach into the millions.
Board-Level Oversight of Emerging Legal Risks
Director duties now extend to cybersecurity preparedness, anti-money laundering compliance, and the accuracy of non-financial disclosures such as environmental claims. The $12.9 million penalty against Vanguard Investments Australia for misleading environmental representations shows that ESG claims are being treated as seriously as financial statements. Boards need a structured process for reviewing legal risk across all these areas, not just the traditional ones. That includes understanding how generative AI tools are being used in the business — the NSW Supreme Court’s Practice Note effective 3 February 2025 prohibits AI-generated content in affidavits, witness statements, and character references, and requires independent verification of AI-generated legal citations. A business that uses AI for contract drafting or customer communications needs to know where the legal exposure sits.
Preparing for the Mandatory Merger Control Regime
Australia is introducing a mandatory pre-merger notification regime in 2026. For any business considering an acquisition, this means early engagement with competition lawyers and a compliance checklist that covers notification thresholds, serial acquirer rules, and waiver applications. The regime increases the importance of getting legal review done before a deal is announced, not after. Companies that have never needed to notify the ACCC before will now need to factor in additional time and cost for merger clearance. The role of AI in Australian business also intersects here, since AI-driven due diligence tools can help identify competition issues earlier in the deal process.
Frequently Asked Questions
Can an individual sue my company directly for a privacy breach now? ▾
What counts as a “serious” invasion of privacy under the new tort? ▾
Do I need to notify the OAIC about every data breach? ▾
What is the difference between a soft class closure order and a hard one? ▾
Are shareholder class actions succeeding in Australian courts? ▾
Does the new merger control regime apply to small acquisitions? ▾
What the Next Year Brings
The legal landscape for Australian companies is not settling down. Insolvency-related litigation is expected to rise due to tighter financial conditions and interest rate pressure, including claims by liquidators, disputes over voidable transactions, and creditor enforcement actions. Cross-border disputes are likely to increase as geopolitical tensions encourage business diversification beyond China and the United States, raising Australia’s role in international commercial activity. The High Court is also hearing an appeal in Republic of India v CCDM regarding foreign state immunity and the enforcement of investment arbitration awards, which could affect how Australian companies enforce international contracts. The direction is clear: more fronts, higher penalties, and less time to prepare.
Remember: this article is general information only. For advice on your specific situation, speak to a qualified professional.
If this was useful, you might also want to read Ethical Business Practices: Navigating the Moral Maze in Australia.
Sources and Further Reading
Wasting Resources: A Major Issue for Australian Companies — Explores how operational inefficiencies compound legal and compliance risks for Australian businesses.
Bird & Bird (2026). Australian dispute resolution: 2025 in review, 2026 in focus. 🔗
Ashurst Perkins Coie (2026). Current trends in Australian disputes 2025–26. 🔗
Groom Kennedy (2026). Legal trends and regulatory risks for Australian companies in 2026. 🔗
JCL (2026). Commercial litigation trends in Australia. 🔗
