OAIC Complaints: How to Report a Privacy Breach in Australia (2026)

If an Australian business, agency, or health provider has mishandled your personal information, you have a clear legal path to push back — and you don't need a lawyer to start. The Office of the Australian Information Commissioner (OAIC) accepts privacy complaints from anyone covered by the Privacy Act 1988, and the process is free.

At Lunyb, we help Australians spot data breaches, scam messages, and exposed personal details before they turn into something worse. This guide walks you through the OAIC complaints process end-to-end, and shows how pairing it with Lunyb's privacy tools gives you the evidence, alerts, and protection you need to act quickly.

What is an OAIC privacy complaint?

An OAIC privacy complaint is a formal report you lodge with the Office of the Australian Information Commissioner when you believe an organisation has mishandled your personal information in breach of the Australian Privacy Principles (APPs) or another part of the Privacy Act 1988. The OAIC is Australia's national privacy regulator and can investigate, conciliate, and in some cases direct an organisation to fix the problem or compensate you.

You can complain about things like:

• A company losing your data in a breach and not telling you properly.
• An organisation using your personal information for something you didn't agree to.
• Being refused access to your own personal information or your health records.
• A business ignoring your request to correct inaccurate information.
• Unwanted direct marketing after you've opted out.
• Misuse of your Tax File Number or credit reporting information.

Who can you complain about?

The OAIC can investigate complaints about:

• Australian Government agencies.
• Private sector organisations with an annual turnover of more than $3 million (and some smaller ones, such as health service providers, regardless of turnover).
• Credit reporting bodies and credit providers.
• Tax File Number recipients.

Some small businesses are exempt from the Privacy Act, so the OAIC may not be able to act in every case. If that happens, state-based privacy or consumer bodies may still help.

When should you lodge an OAIC complaint?

The OAIC generally expects you to complain to the organisation first and give them 30 days to respond before escalating. That first step matters — it's often the fastest way to get the issue fixed and it creates the paper trail the OAIC will want to see.

You should consider lodging with the OAIC when:

1. You've complained to the organisation in writing and 30 days have passed with no reply.
2. They replied, but the response didn't fix the problem or didn't take your concerns seriously.
3. The breach is serious — for example, your identity documents, health information, or financial details have been exposed.
4. You're being harmed right now (scam calls, fraud attempts, stalking, harassment linked to the leak).

Time limits to know

You generally need to lodge within 12 months of becoming aware of the issue. The OAIC can refuse complaints that are too old, trivial, or already being handled elsewhere, so don't sit on it.

How to report a privacy breach to the OAIC: step by step

Here is the full process for lodging an OAIC privacy complaint in Australia.

Step 1: Complain to the organisation first

Write to the organisation's privacy officer. Most Australian businesses and agencies list a privacy contact in their privacy policy. Keep it short and factual:

• Your name and the account, customer number, or reference involved.
• What happened and when you found out.
• What you want them to do (delete data, correct it, explain the breach, compensate you).
• A deadline — 30 days is standard.

Send it by email so you have a timestamp, and keep a copy.

Step 2: Gather your evidence

Before you escalate, pull together everything that proves what happened. This is where most complaints succeed or fall apart. Collect:

• Screenshots of breach notifications, scam texts, phishing emails, or suspicious account activity.
• Copies of your complaint to the organisation and their response (or proof they didn't reply).
• Dates — when the breach happened, when you found out, when you complained.
• Evidence of harm — fraud attempts, identity theft, emotional distress, out-of-pocket costs.

Step 3: Lodge your complaint with the OAIC

Go to oaic.gov.au and use the online privacy complaint form. You can also lodge by email, post, or phone if you need accessibility support. You'll need to provide:

1. Your contact details.
2. The name of the organisation you're complaining about.
3. A clear summary of what happened.
4. What you've already done to resolve it.
5. The outcome you're seeking.
6. Your supporting documents.

Step 4: Work with the OAIC

Once lodged, the OAIC will acknowledge your complaint and may ask the organisation to respond. Most complaints are resolved through conciliation — a structured conversation to reach an outcome you can both live with. If that fails, the Information Commissioner can make a formal determination, which can include orders to stop the conduct, change practices, or pay compensation.

Step 5: Follow up and protect yourself

Regulatory action can take months. While the OAIC does its work, you still need to protect yourself from the fallout of the breach — scam calls, phishing attempts, credential stuffing, and identity fraud. This is where ongoing monitoring matters, and it's exactly what Lunyb was built for.

Why Lunyb is the practical next step after a privacy breach

Reporting a breach to the OAIC holds the organisation accountable. But it doesn't claw back the data that's already out there, and it doesn't stop the scammers who buy leaked lists. Lunyb fills that gap — it's a privacy and scam-protection app designed to catch exposure early and give you real tools to respond.

Data Breach Alerts for your email and phone

Lunyb's Data Breach Alerts continuously monitor whether your email address and phone number show up in known breaches. If your details appear in a new leak, you get notified — which is often the first concrete evidence you'll have to support an OAIC complaint. Instead of finding out months later through a vague company email, you'll know quickly and can act.

Scam Checker and Scam Shield

After a breach, you can expect a spike in scam texts, phishing emails, and suspicious calls. Lunyb's Scam Checker lets you paste any suspicious message or link to see whether it looks dangerous, and Scam Shield helps block unwanted caller activity on your phone. This is exactly the kind of harm the OAIC wants evidence of — and Lunyb helps you capture and avoid it at the same time.

Privacy Check and Security Score

Our Privacy Check reviews the permissions apps are quietly using on your phone, and the Security Score gives you a running view of your overall exposure. If you're already dealing with one breach, the last thing you need is a leaky app on your device making it worse.

Encrypted Password and Photo Vault

Lunyb includes an encrypted Password Vault and Photo Vault so the sensitive stuff — logins, ID photos, recovery codes — stays locked down on your device. If reused passwords were part of your breach exposure, this is the fastest way to stop the bleeding.

Photo Guard, tracker blocking, and browsing-history eraser

Our Photo Guard runs reverse-image checks to see where your pictures might be showing up online. On-device tracker and threat blocking uses a local DNS shield to stop sketchy domains before your apps and browser ever reach them. And the browsing-history eraser cleans up the trails that data brokers love to piece together.

Family location sharing and data-broker help

If the breach involves family members or children, family location sharing gives you peace of mind without handing data to a third party. Lunyb also provides data-broker style exposure help so you can start pulling your details off the lists that make breaches so profitable in the first place.

Plans start from about $19.99/month and renew until cancelled — you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. No lock-in, no hidden fees.

OAIC complaint vs. doing it yourself: what you actually get

The point is simple: the OAIC gives you a legal lever. Lunyb gives you the day-to-day protection and evidence that make the lever worth pulling.

What outcomes can an OAIC complaint actually deliver?

The OAIC can resolve complaints in several ways depending on the facts and how far the matter goes.

Conciliation outcomes

Most complaints resolve through conciliation. Typical outcomes include:

• A written apology.
• Correction or deletion of your personal information.
• Changes to the organisation's privacy practices or staff training.
• A payment for financial loss or non-economic harm (stress, embarrassment).

Formal determinations

If conciliation fails and the Commissioner believes the Privacy Act was breached, a formal determination can:

• Declare the conduct an interference with privacy.
• Order the organisation to stop or not repeat the conduct.
• Order specific steps to repair the harm.
• Order compensation.

Civil penalties for serious breaches

For serious or repeated breaches, the Commissioner can pursue civil penalty proceedings in the Federal Court. These penalties have been significantly strengthened under recent Privacy Act reforms, which is one reason organisations now take privacy complaints more seriously than they used to.

Common mistakes that weaken OAIC complaints

If you want the OAIC to take your complaint seriously, avoid these traps.

Skipping the first complaint to the organisation

The OAIC will usually send you back to the organisation if you haven't complained to them first and waited 30 days. Don't skip this step.

Vague descriptions of the harm

"I feel my privacy was invaded" is not enough. Spell out exactly what information was involved, how you found out, what has happened since, and what harm you've suffered. Lunyb's alerts and scam logs are useful here because they give you dated, concrete evidence.

Not keeping copies

If you don't keep the email trail, you're relying on the organisation's version of events. Always email, always keep copies, and always note dates.

Waiting too long

Twelve months goes faster than you think. If you suspect a breach, start documenting now — even if you decide later not to escalate.

Only playing defence on paper

Lodging an OAIC complaint doesn't stop the scam calls, phishing emails, or credential stuffing attempts that follow a breach. You need live protection on your device while the paperwork runs its course. That's the role Lunyb plays.

Start protecting yourself today

Reporting a privacy breach to the OAIC is the right move when an organisation has let you down — and we encourage every Australian to use that channel. But a complaint takes time, and the people misusing your data don't wait.

Here's the simplest way to get on the front foot:

1. Go to lunyb.com and take the free privacy quiz to see where you're exposed.
2. Download the Lunyb app from the App Store or Google Play.
3. Turn on Data Breach Alerts for your email and phone, and run the Privacy Check on your device.
4. If a suspicious message lands, paste it into Scam Checker before you click anything.

If you're curious about how Lunyb stacks up as a product, our team has written a transparent breakdown in Is Lunyb Legit? Honest Review of the Privacy-First URL Shortener (2026). And if you also use short links or QR codes for work, take a look at Rebrandly Review 2026: Is It Worth the Price (or Try Lunyb)? to see how our link and QR tools compare.

Frequently asked questions

How much does it cost to lodge an OAIC privacy complaint?

It's free. The OAIC does not charge to lodge or investigate a privacy complaint. You also don't need a lawyer, though you can bring one if you want.

How long does an OAIC investigation take?

It varies. Straightforward complaints that settle through conciliation can resolve in a few months. Complex matters, especially those involving large breaches or formal determinations, can take considerably longer. In the meantime, use tools like Lunyb to protect yourself from day-to-day harm.

Can I get compensation through the OAIC?

Yes, in some cases. Conciliated outcomes can include payments for financial loss or non-economic harm such as stress and embarrassment, and formal determinations can order compensation. The amount depends on the seriousness of the breach and the harm you can evidence.

What if the organisation is a small business and not covered by the Privacy Act?

Some small businesses with turnover under $3 million are exempt, with important exceptions like health service providers. If the OAIC can't act, you may still have options through state-based privacy regulators, consumer protection bodies like the ACCC, or industry ombudsmen. Lunyb can still help you monitor for leaked data and block scam activity regardless of who the organisation was.

Does Lunyb replace the OAIC?No, and it shouldn't. The OAIC is Australia's privacy regulator and the right place to lodge formal complaints. Lunyb is the practical layer on top — early breach alerts, scam protection, encrypted vaults, and on-device shielding — so that while the regulator does its work, you're not left exposed. Use both together.

Ready to take back control? Start at lunyb.com, take the free privacy quiz, and download the Lunyb app today. Your OAIC complaint holds them accountable. Lunyb keeps you protected while it happens.