One of the more overlooked reforms to the Privacy Act 1988 (Cth) (the Act) has been the new civil penalty provisions. The reforms introduce new ‘low level’ penalty provisions which empower the Office of the Australian Information Commissioner (OAIC) to issue infringement notices or compliance notices where an entity fails to comply with the Australian Privacy Principles (APPs) or where they issue a non-compliant eligible data breach statement.