Financial risks and remedies
| Type | Maximum | Imposed by |
|---|---|---|
| Administrative monetary penalty (s. 90.1 and seq.) | $10M or 2 % of worldwide turnover of the previous fiscal year (whichever is higher) | CAI |
| Penal fine (s. 91) | $25M or 4 % of worldwide turnover (whichever is higher) | Court |
| Civil remedy (s. 93.1) | Punitive damages of at least $1,000 for intentional breach or gross fault | Court |
A decision-maker's reading
- These are ceilings: the actual penalty depends on severity, duration, cooperation and measures taken.
- The civil remedy applies per affected person: an incident affecting thousands may multiply exposure.
- On top of penalties come real costs: investigation, notification, lost customers, reputational damage, litigation.
Example (SaaS). A cross-customer leak in a multi-tenant product affects employees of dozens of companies: regulatory, contractual (DPA clauses) and reputational exposure at once.
Example (SMB). A 12-person SMB faces the same obligations as a large company; only the scale of penalties (calculated on turnover) differs.
Detailed legal framework: see the reference guide — Myths and financial penalties.