Risk Of Non-Compliance

The risk of non-compliance is the exposure an organisation carries when it fails to meet an obligation that applies to it. In Australia that exposure is financial, criminal and reputational, and its scale has shifted. Penalties once treated as a cost of doing business now reach into the millions, and in some cases into prison sentences.

The privacy regime shows how far it has moved. In October 2025 the Federal Court ordered Australian Clinical Labs to pay $5.8 million in civil penalties over a data breach affecting more than 223,000 people. These were the first civil penalties ever ordered under the Privacy Act 1988. Most of it, $4.2 million, was for failing to take reasonable steps to protect the information the company held. Two further penalties of $800,000 each followed from not assessing the breach promptly and not notifying the Commissioner as soon as practicable.

One detail in that judgment deserves more attention than the headline figure. The Court reduced the penalty in part because the company had started a programme of work to lift its cyber security capability, which the judge accepted showed meaningful steps towards a satisfactory culture of compliance. What an organisation can demonstrate it did, and when it did it, changes the outcome.

The exposure reaches well beyond privacy. Since 1 January 2025, intentionally underpaying employees has been a criminal offence under the Fair Work Act, with a maximum of 10 years imprisonment for individuals. Serious interferences with privacy now carry maximum civil penalties of the greater of $50 million, three times any benefit obtained, or 30% of adjusted turnover.

In everyday practice, the risk usually surfaces through:

• Privacy and how personal information is collected, stored and disposed of
• Internet and social media use that exposes confidential or personal information
• Workplace policies people have genuinely read and accepted, not just been sent
• Records management that evidences who did what, and when, if you are ever asked

Obligations differ across states and territories and change over time, so treat this as general information rather than legal advice and take proper advice on anything contentious. Browse Sentrient’s workplace compliance training courses to see how these areas are covered.