Regulators by country
Data protection regulators in Asia-Pacific
Short answer
- Australia, breach notifications in 2025
- 1,205, up 8% on 2024 1
- Australia, first Privacy Act civil penalty
- AU$5.8 million, Federal Court, October 2025 2
- India, DPDP Rules notified
- 14 November 2025 4
- India, highest penalty
- Up to ₹250 crore for failing to keep reasonable security safeguards 4
- South Korea, PIPC fine on SK Telecom
- 134.8 billion won, as reported by Light Reading 6
- New Zealand, compliance notice deadlines
- 29 January 2027 and 31 August 2027 5
Australia: OAIC
The Office of the Australian Information Commissioner runs the Notifiable Data Breaches scheme. It received 1,205 notifications in calendar year 2025, up from 1,112 in 2024, according to its July 2026 release 1. Its earlier NDB report of 13 May 2025 gave 1,113 for 2024 9. Malicious or criminal attacks caused 716 of them. Health service providers notified the most, 225 1.
In the Australian Clinical Labs case the OAIC sought civil penalties in the Federal Court. On 8 October 2025 the court ordered Australian Clinical Labs to pay AU$5.8 million in civil penalties over a February 2022 cyberattack on Medlab Pathology. That total was AU$4.2 million for failing to protect personal information, AU$800,000 for failing to assess the breach promptly, and AU$800,000 for failing to notify the Commissioner as soon as practicable 2.
Not every large incident leads to an investigation. On 16 July 2026 the OAIC said it would not open a full investigation into the 2025 Qantas incident, which affected about 5 million Australians. The Commissioner said the evidence did not support the likelihood of a breach of privacy law 3.
In 2025-26 the OAIC received 5,268 privacy complaints, up 60%, and made 7 determinations after investigating complaints 7.
New Zealand: Office of the Privacy Commissioner
The Commissioner issues compliance notices that require an agency to fix a breach of the Privacy Act. On 23 September 2026 it issued notices to Manage My Health and Health NZ after the December 2025 cyber attack on Manage My Health. Health NZ has until 29 January 2027 and Manage My Health until 31 August 2027 to complete the required changes 5.
The notices followed a Phase 1 inquiry report that identified seven areas where security protections were ineffective 5.
India: Data Protection Board
India's government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025. The government release describes an eighteen-month period for phased compliance and a fully digital Data Protection Board of four members 4.
Penalties reach up to ₹250 crore for failing to keep reasonable security safeguards and up to ₹200 crore for breach notification or child-related failures. Other breaches can draw up to ₹50 crore. Affected individuals must be told of a breach without delay. Appeals against the Board go to the Telecom Disputes Settlement and Appellate Tribunal 4.
South Korea and Japan
Light Reading reported that South Korea's Personal Information Protection Commission fined SK Telecom 134.8 billion won in August 2025 over a data breach. It reported that SK Telecom sought judicial review in the Seoul Administrative Court in January 2026, on the last day of the 90-day appeal period, and that no ruling had been reported 6.
Japan's Personal Information Protection Commission decided a system reform policy under its triennial review of the Act on the Protection of Personal Information at its 347th meeting, announced on 9 January 2026. This is a policy decision. The page does not mention a bill 8.
Side by side
| Country | Regulator | Money penalty route in the record | Recent record |
|---|---|---|---|
| Australia 2 | OAIC 2 | Civil penalty ordered by the Federal Court 2 | AU$5.8 million, October 2025 2 |
| New Zealand 5 | Privacy Commissioner 5 | None in the release, notices set deadlines 5 | Compliance notices, September 2026 5 |
| India 4 | Data Protection Board 4 | Penalties set in the law, appeal to TDSAT 4 | Rules notified November 2025 4 |
| South Korea 6 | PIPC 6 | Fine by the PIPC 6 | 134.8 billion won fine as reported by Light Reading, under court challenge 6 |
Common questions
What was Australia's first Privacy Act civil penalty?
The Federal Court ordered Australian Clinical Labs to pay AU$5.8 million on 8 October 2025, after a cyberattack on Medlab Pathology in February 2022 2.
Which sector reports the most data breaches in Australia?
Health service providers, with 225 of 1,205 notifications in 2025, followed by financial services with 157 1.
When do India's data protection rules take full effect?
The rules were notified on 14 November 2025 with an eighteen-month period for phased compliance, according to the government release 4.
Is SK Telecom's fine final?
No. Light Reading reported that SK Telecom filed for judicial review in the Seoul Administrative Court in January 2026 6.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- OAIC: Data breach notifications increase to all-time high in 2025, new NDB stats show (6 July 2026)
- OAIC: Australian Clinical Labs ordered to pay penalties in relation to Medlab Pathology data breach in first for Privacy Act (9 October 2025)
- OAIC: Privacy Commissioner completes preliminary inquiries into Qantas 2025 data incident (16 July 2026)
- Press Information Bureau, Government of India: DPDP Rules, 2025 Notified (17 November 2025)
- Office of the Privacy Commissioner: Privacy Commissioner issues Compliance Notices to Manage My Health and Health NZ (23 September 2026)
- Light Reading, Gigi Onag: SKT challenges $91M data breach fine in court (20 January 2026)
- OAIC: OAIC annual report shows growing demand (22 October 2026)
- Personal Information Protection Commission, Japan: System Reform Policy under the Triennial Review of the Act on the Protection of Personal Information (9 January 2026)
- OAIC: Notifiable Data Breaches Report: July to December 2024 (13 May 2025)
Related
- Data breach statistics by sector
Official breach notification counts by sector and cause from regulators in Australia, Canada, Ireland, France, Spain and Luxembourg, with periods.
- Breach notification rules compared
Breach notice deadlines and triggers in the EU, UK, US, Canada, Australia, Singapore, India and Brazil, from laws and regulator pages.
- Data protection regulators in Africa
Enforcement notices, infringement notices, penalty notices and annual figures from South Africa's Information Regulator, Kenya's ODPC and Nigeria's NDPC.
- Data protection regulators in Latin America
Regulators, sanctions and breach rules in Brazil, Chile, Argentina and Colombia, from the laws and the regulators' own pages.
- How long data protection investigations take
Legal deadlines and recorded timelines for data protection complaints, inquiries and court cases in the EU, Ireland, Norway, Australia and Canada.