What are the penalties under the Digital Duty of Care Bill?

What are the maximum fines in dollars?

These figures use the current penalty unit of $364. Court-ordered penalties are maximums, and a court sets the actual amount. What is a penalty unit?

Would a small business really be fined $21 million?

Almost certainly not. The maximum is the ceiling a court can order in the worst case, and it is set with global platforms in mind. A court looks at the size of the business, the harm done and whether the breach was deliberate.

The eSafety Commissioner told a Senate hearing on 10 November 2026 that eSafety is not focused on small businesses that have a web presence. What eSafety said.

What would happen before a fine?

The Bill gives eSafety a ladder of options, and the Department says services would generally get the chance to fix problems first.

1. Formal warning. A written notice with no fine.
2. Remedial direction. A written order to fix a specific problem.
3. Infringement notice. A fixed fine without going to court.
4. Court. eSafety asks a court to order a civil penalty.

eSafety does not have to use these in order. It can go straight to court for a serious breach.

What is the most likely fine for a small business?

If a fine came at all, the realistic one is an infringement notice: $4,368 for a sole trader or $218,400 for a company, for each breach. Under the Bill these notices are available for breaches such as having no risk assessment. They are not available for a breach of the general duty.

Is breaching the duty a crime?

No. The penalties in the Bill for the duty and the risk assessment are civil penalties. A civil penalty is a fine ordered by a court in a civil case. There is no conviction and no criminal record.

Can a director or owner be personally liable?

A sole trader is personally the responsible person, so any penalty would be theirs. For a company, the penalty falls on the company. The Bill also places the duty on any person with the greatest day-to-day control of a service, which in some cases could be an individual or an agency. This is a point to raise with a lawyer.

Can a customer sue my business under the duty?

The Bill does not create a right for individuals to sue. The Department has said, though, that the duty would strengthen the basis for negligence claims under the common law. The Greens have called for a direct right to sue to be added.

When could penalties first apply?

Not until the duty starts, which is 12 months after Royal Assent. If the Bill passes in late 2026, that means late 2027 at the earliest. Nothing in the duty applies to conduct before then.

Last updated 14 November 2026