OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If an Australian organisation has mishandled your personal information — leaked your email, misused your phone number, ignored your access request, or suffered a data breach that exposed your details — you have the right to complain to the Office of the Australian Information Commissioner (OAIC). This guide walks you through exactly how to do it, what evidence helps, and what to expect.

Before we dive in: filing a complaint is only half the story. The other half is finding out where your data has already leaked, locking down what scammers can do with it, and stopping the next breach from hitting you blind. That is where Lunyb comes in — our privacy app continuously monitors your email and phone for breaches, flags scam messages impersonating government bodies (including fake "OAIC" and "myGov" texts), and gives you the evidence trail you need if you ever have to lodge an OAIC complaint.

What the OAIC Does and When You Can Complain

The OAIC is Australia's independent national privacy regulator. It enforces the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs), which govern how most businesses with turnover over $3 million, all federal government agencies, health providers, credit reporting bodies, and TFN recipients handle your personal information.

You can lodge an OAIC complaint if you believe an APP entity has:

• Collected personal information about you unlawfully or without proper notice.
• Used or disclosed your information for a purpose you did not consent to.
• Failed to keep your information secure, leading to a data breach.
• Refused to give you access to, or correct, your personal information.
• Ignored your request to stop direct marketing.
• Mishandled your tax file number, health records, or credit information.

Who the OAIC Cannot Help With

The OAIC generally does not handle complaints about small businesses under $3 million turnover (with exceptions), state and territory government agencies, employee records held by your current employer, or media organisations acting in journalism. For those, you may need a state privacy regulator, the Fair Work Ombudsman, or a different complaints body.

Step 1: Complain Directly to the Organisation First

The OAIC requires you to raise the issue with the organisation before escalating. This is not red tape — it is often the fastest path to a fix, and it builds the paper trail you will need later.

1. Find the right contact. Most APP entities must publish a privacy policy with a privacy officer's email. Look for "Privacy Officer" or "Privacy Contact" on their website.
2. Write a clear complaint in writing. Email is ideal because it timestamps everything. State what happened, when, what APP you believe was breached, and what outcome you want (deletion, correction, apology, compensation).
3. Give them 30 days to respond. This is the standard window the OAIC expects before it will accept an escalated complaint.
4. Keep every reply. Save PDFs of emails, screenshots of chat logs, and reference numbers.

Template Language You Can Reuse

Dear Privacy Officer, I am making a formal privacy complaint under the Privacy Act 1988. On [date] I became aware that [describe what happened]. I believe this breaches Australian Privacy Principle [number]. I request that you [outcome sought] within 30 days. If I do not receive a satisfactory response, I will escalate this matter to the Office of the Australian Information Commissioner.

Step 2: Lodge Your Complaint with the OAIC

If the organisation ignores you, rejects your complaint, or offers a response you consider inadequate after 30 days, you can escalate to the OAIC. There is no fee.

1. Go to oaic.gov.au and open the "Privacy complaint form".
2. Create an OAIC portal account or download the PDF form if you prefer post.
3. Fill in your contact details, the respondent organisation, and a clear chronological account of what happened.
4. Attach your evidence: the original complaint email, the organisation's response (or proof they did not respond), screenshots, breach notification emails, and any scam messages you received afterwards.
5. State the outcome you want: an apology, a change in practice, deletion of your data, or compensation for financial loss or non-economic loss (stress, anxiety, humiliation).
6. Submit and save your reference number.

What Happens Next

The OAIC will typically acknowledge receipt within a few working days. A case officer may contact both parties to attempt conciliation — this is where most complaints resolve. If conciliation fails, the Information Commissioner can make a determination under section 52 of the Privacy Act, which can include binding orders and compensation.

Step 3: Build Strong Evidence Before You File

The complaints that get resolved quickly are the ones with tight, dated evidence. Here is what strengthens a case:

How Lunyb Helps You Spot, Prove, and Prevent Privacy Breaches

Most Australians only find out their data has been breached months after it happens — usually when the scam calls and phishing texts start rolling in. By then the trail is cold, the APP entity has had time to shape its narrative, and you are scrambling to piece together what was exposed. Lunyb flips that timeline in your favour.

Data Breach Alerts

Lunyb continuously monitors your email addresses and phone numbers against known data breaches. When your details show up, we tell you which company leaked them and what fields were exposed (password, address, date of birth, etc). That is exactly the kind of structured evidence the OAIC case officer will ask for, and it is the difference between "I think my data was leaked" and "here is the breach, the date, and the fields exposed".

Scam Checker and Scam Shield

After a breach, criminals weaponise your leaked details — fake ATO debt calls, bogus Australia Post redelivery texts, phishing emails impersonating your bank. Lunyb's Scam Checker lets you paste a suspicious message or link and get an instant read on whether it is dangerous. Scam Shield helps block known scam callers before they reach you. Every scam message you catch is another piece of evidence of downstream harm you can attach to your OAIC complaint.

Privacy Check and Security Score

Privacy Check reviews the permissions your apps have quietly collected — location, contacts, microphone, photos — and shows you what to revoke. Your Security Score gives you a single number that moves as you tighten up, so you can see progress instead of guessing.

Encrypted Password and Photo Vault

Reused passwords are the number-one way one breach becomes five. Lunyb's encrypted vault stores unique passwords and sensitive photos (ID scans, Medicare cards, insurance documents) locally with strong encryption, so a leaked password from one service does not cascade into your inbox, your myGov, or your bank.

On-Device Tracker and Threat Blocking

Lunyb includes a local DNS shield that blocks trackers and known malicious domains at the network level on your device — no complicated setup, no slowdowns. It cuts off a huge chunk of the data collection that feeds future breaches in the first place.

Photo Guard and Browsing-History Eraser

Photo Guard reverse-image checks pictures of you that may be floating online. The browsing-history eraser clears local traces across your device so old sessions do not become tomorrow's leak.

Family Location Sharing

Private, consent-based location sharing for people you actually trust — without handing your family's whereabouts to a free app whose business model is selling location data.

Why Lunyb Is the Smart Next Step After (or Before) an OAIC Complaint

Lodging an OAIC complaint resolves one incident. Lunyb resolves the pattern. Here is the honest case for us:

Plans start from about $19.99/month and renew until you cancel — no lock-in contracts, cancel online whenever you want. Optional Leak Protection is billed separately and can be paused without cancelling your main plan. That is the kind of clarity you want from a privacy company.

If you are comparing privacy tools more broadly, our team also covers the URL and QR side of the product in this honest Lunyb review, and we stack up against competitors in our Rebrandly comparison.

Timelines, Outcomes, and What to Expect

The OAIC does not publish a guaranteed resolution window, but complaints that proceed to conciliation commonly take several months. Determinations under section 52 take longer. Possible outcomes include:

• An apology and a change to the organisation's practices.
• Correction or deletion of your personal information.
• Staff retraining or new security controls.
• Compensation for financial loss and, in some cases, for non-economic loss such as anxiety and distress.

You can also take matters to the Federal Court or Federal Circuit and Family Court in certain circumstances, but most people never need to go that far.

Common Mistakes That Weaken a Complaint

1. Skipping the organisation. If you go straight to the OAIC without complaining to the business first, your file will usually be sent back.
2. Vague timelines. "Sometime last year" is weaker than "on 14 March 2026". Lunyb breach alerts are dated.
3. Deleting the scam messages. Screenshot first, then report. They are evidence.
4. Not asking for a specific outcome. Tell the OAIC what you want — deletion, apology, compensation.
5. Waiting too long. Complaints should generally be made within 12 months of becoming aware of the issue.

Take the Next Step With Lunyb

You cannot stop every Australian company from mishandling data — but you can stop being the last person to know when it happens to you. Lunyb gives you the alerts, the scam filters, the vault, and the on-device protections to turn a potential disaster into a 10-minute cleanup.

1. Visit lunyb.com and take the free privacy quiz to see where your exposure sits right now.
2. Download the Lunyb app from the App Store or Google Play and run Privacy Check on your phone.
3. Turn on Data Breach Alerts for every email and phone number you use.
4. Keep this guide bookmarked — if you ever need to lodge an OAIC complaint, you will already have the evidence.

Frequently Asked Questions

Is there a fee to lodge an OAIC complaint?

No. Lodging a privacy complaint with the OAIC is free. You do not need a lawyer, though you can bring one if you wish.

How long do I have to lodge a complaint?

You should generally lodge within 12 months of becoming aware of the alleged breach. The OAIC can decline complaints that are too old, though it has discretion in some cases.

Can I claim compensation through the OAIC?

Yes. The Information Commissioner can order compensation for financial loss and for non-economic loss such as stress, humiliation, and anxiety, where a breach is established.

Does Lunyb replace the need to complain to the OAIC?

No — Lunyb is a privacy and scam-protection tool, not a regulator. But it dramatically improves your ability to detect a breach early, document it cleanly, and limit the damage while a complaint runs its course.

What if the organisation that leaked my data is overseas?

The Privacy Act can still apply if the overseas entity has an Australian link and handles Australians' personal information. The OAIC can investigate — and Lunyb's breach alerts cover global breach databases, so you will not miss leaks just because they happened offshore.

Ready to stop guessing? Head to lunyb.com, take the free privacy quiz, and let Lunyb do the ongoing watching for you.