OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If your personal information has been mishandled by an Australian business or government agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). But before you reach the complaint stage, you need two things working in your favour: early detection of the breach and clean evidence of what happened. That is exactly where Lunyb fits in.

At Lunyb, we built our privacy app so Australians don't have to find out about a breach six months later from a stranger's spam call. Our Data Breach Alerts, Scam Checker, and Privacy Check tools surface exposures early, give you a timeline you can screenshot, and make it realistic to file a strong OAIC complaint — not a vague one. This guide walks you through the full OAIC complaint process and shows where Lunyb saves you time at each step.

What an OAIC Privacy Complaint Actually Covers

An OAIC privacy complaint is a formal request for the Australian Information Commissioner to investigate an act or practice that may have breached your privacy under the Privacy Act 1988. It applies to most Australian Government agencies and to private sector organisations with an annual turnover of more than $3 million, plus some smaller operators such as health service providers and credit reporting bodies.

Typical issues the OAIC handles include:

• An organisation collecting personal information you never agreed to share.
• A company losing your data in a cyber incident or leaving it exposed.
• An agency using your information for a purpose outside what was disclosed.
• A business refusing to give you access to, or correct, your own data.
• Unwanted direct marketing after you asked to be removed.
• Credit reporting errors that are not fixed after you raise them.

What the OAIC does not handle

The OAIC is not a scam refund service and not a police hotline. For financial fraud, you still report to your bank and to Scamwatch or ReportCyber. For small businesses under the $3 million threshold that are not covered, the OAIC may not be able to investigate — but you can still pursue the matter through consumer channels or state fair trading offices.

Step 1: Confirm a Breach Has Actually Happened

Before lodging anything, you need to know what was exposed and by whom. This is the step most people get stuck on, because breaches rarely come with a polite email that says "we lost your data on this date." Many only come to light when strange logins, scam texts, or credit enquiries start appearing.

Signals that your information has been breached

1. You receive a notification letter or email from a company admitting a data incident.
2. Your email or phone number starts appearing in known breach databases.
3. You get a sudden spike in scam SMS, phishing emails, or spoofed calls.
4. Unknown devices or sessions appear on your accounts.
5. Debt collectors or lenders contact you about accounts you did not open.

How Lunyb helps you detect it early

Lunyb's Data Breach Alerts monitor your email address and phone number against known exposure sources, so if your details surface, you know quickly rather than months later. Our Scam Checker lets you paste any suspicious SMS or link and get a read on whether it looks like a targeted phishing attempt — which is often the first sign your contact details are now on a scammer's list. That early warning is what turns a vague suspicion into a dated, specific complaint.

Step 2: Complain to the Organisation First

This is the step people want to skip, but the OAIC will almost always ask you to do it first. Under the Privacy Act process, you must give the organisation a chance to fix the issue before escalating — usually 30 days to respond.

How to make a first complaint that works

1. Find the right contact. Look for "Privacy Officer" or "Privacy Contact" on the organisation's website. Most Australian businesses list one in their privacy policy.
2. Put it in writing. Email is best because it creates a timestamp. Keep it factual and calm.
3. State what happened. Include dates, account numbers, what information was involved, and how you found out.
4. Say what you want. Common outcomes include an apology, deletion of your data, correction of an error, confirmation of what was exposed, or compensation for direct loss.
5. Give a deadline. A clear line like "please respond within 30 days as required under the Privacy Act" sets expectations.

Keep a complete record

Save the original complaint, any auto-replies, and every message that follows. If you need to escalate to the OAIC, this timeline becomes your evidence. Lunyb's encrypted Password & Photo Vault is a safe place to store screenshots, PDFs of email threads, and sensitive documents (like breach letters with account numbers on them) that you do not want sitting in your camera roll.

Step 3: Escalate to the OAIC

If the organisation does not respond within 30 days, or their response is unsatisfactory, you can lodge a privacy complaint directly with the OAIC.

How to lodge an OAIC complaint

1. Go to the OAIC website (oaic.gov.au) and choose "Make a privacy complaint."
2. Complete the online privacy complaint form, or download the PDF form if you prefer to post it.
3. Provide your contact details, the name of the organisation, and a clear description of what happened.
4. Attach your evidence: your original complaint to the organisation, their reply (or proof they did not reply), and any supporting documents such as breach notification letters, screenshots, or scam messages you received afterwards.
5. Describe the outcome you want.

What happens after you lodge

The OAIC will acknowledge your complaint and may ask the organisation to respond. Most complaints are resolved through conciliation — a negotiated outcome between you and the organisation. If conciliation fails and the Commissioner considers it serious enough, a formal investigation can follow, and in some cases determinations can require compensation.

What Good Evidence Looks Like

OAIC complaints live or die on evidence. Vague stories get closed quickly; dated, specific timelines get taken seriously. Here is what to collect.

How Lunyb Supports You Through the Whole Process

The OAIC complaint process is designed to be accessible, but it still assumes you have the time, the records, and the awareness to use it. Lunyb closes those gaps.

Data Breach Alerts

We monitor your email address and phone number against known data breach sources. When your details appear in a new exposure, you get an alert — often long before a company sends a formal notification letter. That means you can act, change passwords, and start building your file without waiting on someone else's PR cycle.

Scam Checker and Scam Shield

After a breach, scam contact spikes. Our Scam Checker lets you paste a suspicious message or link to assess it, and Scam Shield helps block and screen suspicious callers. Both create a record of the fallout from a breach, which strengthens your OAIC complaint by showing real harm, not just theoretical risk.

Privacy Check

Many complaints involve over-collection — an app or service grabbing more data than it needed. Privacy Check walks through the permissions on your phone so you can see which apps have your location, contacts, microphone, or photos, and tighten them. It is also useful evidence: a screenshot of excessive permissions is a specific, dated artefact.

Encrypted Password & Photo Vault

Everything you collect for an OAIC complaint — screenshots, breach letters, scam texts, correspondence — is sensitive. Our encrypted Vault keeps it protected with on-device encryption so you are not storing your evidence file in a regular photo app or notes app that any new breach could expose again.

Photo Guard and browsing history eraser

If images of yours have appeared where they should not, Photo Guard runs reverse-image checks so you can document unauthorised use. Our browsing history eraser and on-device tracker blocking (a local DNS shield that reduces third-party tracking on your phone) also help prevent future exposure while your current complaint is being resolved.

Security score and family protection

Your Lunyb security score gives you a single, honest view of where you stand — what is protected, what is still exposed, and what to fix next. Family location sharing extends that same protection to the people you care about, which matters because a breach of your data often puts your household at risk too.

Realistic Timelines and Outcomes

OAIC complaints are not instant. Conciliation can take weeks or months depending on how cooperative the organisation is. Here is a realistic shape of the process:

1. Weeks 1-2: You detect the issue and complain to the organisation.
2. Weeks 2-6: You wait up to 30 days for a response.
3. Weeks 6-10: You lodge with the OAIC and receive acknowledgement.
4. Months 2-6: Conciliation discussions, with the OAIC mediating.
5. Months 6+: If conciliation fails, a formal investigation may begin.

Outcomes vary. Many complaints end in an apology, a correction, deletion, improved practices, or a direct remediation such as free credit monitoring. In serious cases, the Commissioner can make a determination that requires compensation. Patience helps — and so does having a clean, well-organised file from day one, which Lunyb makes easier.

Other Australian Channels Worth Knowing

Depending on what happened, you may need to report to more than one place. These channels are complementary, not alternatives.

• Scamwatch (ACCC): for scam contact, phishing, and investment scams.
• ReportCyber: for cybercrime such as account takeover, hacking, and online fraud.
• IDCARE: free support for identity compromise and recovery planning.
• Your bank's fraud team: immediately, for any financial exposure.
• State and territory fair trading or consumer protection: for small businesses outside the OAIC's scope.
• Australian Financial Complaints Authority (AFCA): for disputes with banks, insurers, and super funds.

Quick Comparison: DIY vs With Lunyb

Start Protecting Yourself Today

Lodging an OAIC complaint is your right, and you should use it. But the strongest complaints come from people who caught the problem early, kept clean records, and could show real consequences. Lunyb is built to make all three of those things easy.

Plans start from about $19.99/month and renew until you cancel. You can cancel anytime online — no phone calls, no retention games. Optional Leak Protection is billed separately and can be paused without cancelling the main plan, so you stay in control.

Head to lunyb.com to take our free privacy quiz, or download the Lunyb app from the App Store or Google Play. If you would like to see how we think about transparency as a company, our team's honest review of the Lunyb platform is a good next read.

FAQ

Is there a fee to lodge an OAIC privacy complaint?

No. The OAIC does not charge a fee to make a privacy complaint. You submit the form online or by post and the office assesses it at no cost to you.

How long do I have to lodge an OAIC complaint?

The OAIC generally expects complaints to be made within 12 months of you becoming aware of the issue. Later complaints can still be considered, but you may need to explain the delay. Acting quickly also means your evidence is fresher and easier to verify.

Can the OAIC force a company to pay me compensation?In some cases, yes. Most matters resolve through conciliation, which can include financial remedies. If the Commissioner makes a formal determination, it can require the organisation to pay compensation for loss or damage, including for non-economic harm such as distress.

Does Lunyb file OAIC complaints on my behalf?

No. Lunyb is not a law firm or a representative service. We help you detect breaches early, assess suspicious messages, review your app permissions, and store evidence securely in an encrypted vault — so when you file with the OAIC yourself, your complaint is specific, dated, and well-supported.

What if the breach involves a small business that is not covered by the Privacy Act?

Some small businesses under $3 million turnover are not covered. In that case, you can still approach your state or territory fair trading office, use IDCARE for identity support, report financial losses to your bank, and lodge scam contact with Scamwatch and ReportCyber. Lunyb's tools help you document the harm regardless of which channel takes the case.