OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If your personal information has been mishandled by an Australian business or government agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). But before you lodge that complaint, you need to know exactly what counts as a privacy breach, what evidence the OAIC expects, and how to protect yourself while the investigation plays out.

At Lunyb, we help Australians detect data breaches early, monitor exposed email addresses and phone numbers, and lock down the accounts that criminals target after a leak. This guide walks you through the OAIC complaints process step by step — and shows you how to turn a privacy breach into a clear, actionable response instead of a panic.

Why Lunyb Is the Smart Starting Point for a Privacy Breach

An OAIC complaint can take weeks or months to resolve. During that window, your exposed data is already in circulation. That's why the practical first move isn't paperwork — it's protection.

Lunyb gives you the tools to act immediately:

• Data Breach Alerts scan whether your email address or phone number has appeared in known breaches, so you can document exposure before lodging a complaint.
• Scam Checker lets you paste suspicious messages or links you receive after a breach and get a clear risk read.
• Scam Shield helps screen the follow-up calls scammers often make once your number is exposed.
• Encrypted Password & Photo Vault secures the credentials and sensitive images that breached services may have put at risk.
• Privacy Check reviews which apps on your phone can access your contacts, location, microphone, and camera — the exact permissions that often cause breaches in the first place.

You can start a free privacy quiz at lunyb.com to see your current exposure in a few minutes. That gives you both the evidence and the protection you need before you contact the OAIC.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner is the independent regulator that enforces the Privacy Act 1988 and the Australian Privacy Principles (APPs). You can complain to the OAIC when an organisation covered by the Privacy Act mishandles your personal information.

Who the OAIC regulates

• Australian Government agencies.
• Private sector organisations with an annual turnover of more than $3 million.
• Some small businesses, including health service providers, credit reporting bodies, and businesses that trade in personal information.
• All organisations covered by the Notifiable Data Breaches (NDB) scheme.

What counts as a privacy breach

A privacy breach happens when an organisation handles your personal information in a way that breaches the Australian Privacy Principles. Common examples include:

• Unauthorised access or disclosure of your data after a cyber incident.
• Collecting information you didn't consent to provide.
• Failing to keep your data secure, accurate, or up to date.
• Refusing to give you access to or correct your own personal information.
• Using your data for a purpose you never agreed to (for example, on-selling to third parties).

Step 1: Complain to the Organisation First

The OAIC generally requires you to raise the issue directly with the organisation before escalating. This is called an internal complaint, and it's a mandatory first step in almost every case.

1. Find the organisation's privacy officer or privacy policy — it must be available on their website.
2. Write to them explaining what happened, what personal information was affected, and what you want them to do.
3. Give them a reasonable time to respond. The OAIC expects at least 30 days.
4. Keep a copy of everything — emails, reference numbers, and any written responses.

What to include in your internal complaint

• Your full name and contact details.
• A clear description of the privacy breach and when you became aware of it.
• Dates, screenshots, breach notifications, or any supporting evidence.
• The outcome you're seeking: an apology, correction of your records, compensation, or confirmation of deletion.

If you received a Notifiable Data Breach email from the organisation, attach it. Lunyb's Data Breach Alerts can also surface third-party exposure records that strengthen your complaint.

Step 2: Lodge Your OAIC Complaint

If the organisation doesn't respond within 30 days, refuses to act, or gives an unsatisfactory response, you can escalate to the OAIC.

How to lodge the complaint

1. Go to the OAIC website (oaic.gov.au) and open the privacy complaint form.
2. Choose the type of complaint — privacy, freedom of information, or consumer data right.
3. Fill in your personal and contact details.
4. Describe the breach, the organisation involved, and the steps you've already taken.
5. Upload supporting documents: your original complaint, the organisation's response, breach notifications, and any evidence of harm.
6. Submit and keep the reference number.

What happens after you lodge

Timelines depend on complexity. During this period, continue monitoring your email, phone, and financial accounts.

Step 3: Protect Yourself While the Complaint Is Being Processed

OAIC complaints move at a regulatory pace. Scammers move at internet speed. The gap between a breach and a resolution is exactly when identity fraud, phishing, and account takeover attempts spike.

Immediate protective actions

1. Change passwords on any account tied to the breached email or service, and use unique passwords stored in an encrypted vault.
2. Enable multi-factor authentication everywhere — especially email, banking, and government logins like myGov.
3. Place a temporary ban on your credit file with Equifax, Experian, and illion if financial data was exposed.
4. Watch your inbox and SMS for phishing attempts that reference the breach.
5. Report scam calls and texts to Scamwatch, and keep records in case your OAIC complaint needs updated evidence.

How Lunyb Supports Every Stage of a Privacy Breach Response

Dealing with a privacy breach involves three jobs at once: documenting what happened, protecting what's exposed, and watching for new attacks. Lunyb was built to handle all three from a single app and web dashboard.

Detect: know what's been exposed

Our Data Breach Alerts continuously scan for your email and phone number across known breach datasets. When something new appears, you get notified — not months later when scammers are already using your information. This is exactly the kind of evidence an OAIC complaint benefits from: a timeline of when data appeared where.

Defend: lock the doors scammers will try next

• Encrypted Password & Photo Vault gives every account its own strong password and secures sensitive images, so a leaked credential from one site doesn't cascade.
• Privacy Check audits app permissions on your phone and flags apps quietly accessing contacts, location, or microphone — a frequent source of complaints to the OAIC.
• On-device tracker and threat blocking uses a local DNS shield to stop known malicious domains and trackers before your phone connects to them.
• Browsing-history eraser clears residual traces that could be exploited if your device is compromised.

Respond: shut down the follow-up attacks

• Scam Checker lets you paste any suspicious message or link — the kind that flood in after a breach — and get a risk assessment in seconds.
• Scam Shield helps screen suspicious callers who got your number from a leaked database.
• Photo Guard reverse-image check helps you see if images of you are circulating in unexpected places.
• Family location sharing keeps you connected with household members without handing data to a third-party ad network.

Plans start from about $19.99/month and renew until you cancel, which you can do online at any time. Optional Leak Protection is billed separately and can be paused without cancelling your main plan — useful transparency when you're already dealing with one organisation that mishandled your data.

Start with the free privacy quiz at lunyb.com, or download the Lunyb app from the App Store or Google Play.

What the OAIC Can and Can't Do

Setting realistic expectations matters. The OAIC is a regulator, not a courtroom, and understanding its powers helps you decide what outcome to pursue.

What the OAIC can do

• Investigate complaints and conciliate between you and the organisation.
• Make a determination that the organisation must apologise, correct records, change its practices, or pay compensation.
• Impose civil penalties on organisations for serious or repeated breaches of the Privacy Act.
• Accept enforceable undertakings and issue public statements.

What the OAIC generally won't do

• Act as your personal lawyer or recover money directly on your behalf outside of a determination.
• Pursue complaints that are purely commercial disputes unrelated to privacy.
• Investigate matters that are more than 12 months old without a good reason for the delay.
• Handle complaints against organisations outside its jurisdiction — for example, most small businesses under $3 million turnover (with exceptions).

Special Situations: Notifiable Data Breaches and Credit Reporting

Notifiable Data Breach (NDB) scheme

Under the NDB scheme, organisations covered by the Privacy Act must notify both you and the OAIC when a data breach is likely to result in serious harm. If you received an NDB notification and the organisation's response is inadequate — for example, no clear remediation or ongoing monitoring — you can complain to the OAIC about how they handled it.

Credit reporting complaints

If a credit reporting body (Equifax, Experian, illion) or a credit provider mishandles your credit information, you can lodge a specific credit reporting complaint with the OAIC after first raising it with the organisation.

Government agency complaints

Complaints about Services Australia, the ATO, or other Commonwealth agencies follow the same process. Start with the agency's privacy officer, then escalate to the OAIC if unresolved.

Evidence Checklist Before You Lodge

A well-documented complaint moves faster. Before you hit submit, gather:

1. Copies of all correspondence with the organisation, including dates and reference numbers.
2. Any breach notification emails or letters you received.
3. Screenshots of exposed data, suspicious messages, or scam attempts linked to the breach.
4. Records from breach monitoring tools showing when and where your details appeared.
5. Evidence of harm: unauthorised transactions, identity fraud reports, or emotional distress documentation.
6. A clear statement of the outcome you want.

Lunyb's dashboard can help you pull together exposure records in a structured format you can export and attach to your complaint.

After the OAIC Decision: What Comes Next

If the OAIC finds in your favour and issues a determination, the organisation must comply. If you're unhappy with the outcome, you can apply to the Administrative Appeals Tribunal (AAT) for a review within 28 days.

Regardless of the outcome, treat the breach as permanent exposure. Your email, phone number, address, or ID details may continue to appear in criminal databases for years. Ongoing monitoring with tools like Lunyb's Data Breach Alerts and Scam Shield isn't optional — it's how you stop the same data being used against you again and again.

Start Protecting Yourself Today

Lodging an OAIC complaint is important. It holds organisations accountable and improves privacy standards across Australia. But a complaint on its own won't stop the phishing texts, fraudulent calls, or account takeover attempts that follow a breach.

That's where Lunyb comes in. One app covers breach monitoring, scam checking, call screening, encrypted password storage, app permission audits, and on-device threat blocking — all the practical defences you need while the regulatory process plays out.

Take the next step now:

• Take the free privacy quiz at lunyb.com to see your current exposure.
• Download the Lunyb app from the App Store or Google Play.
• Set up Data Breach Alerts for every email address and phone number you use.

If you also manage links for a small business or community group affected by a breach, our secure link shortening and QR tools let you share updates without exposing recipients to risky third-party trackers. Compare our approach in our Rebrandly review and see what Lunyb customers say in our honest product review.

Frequently Asked Questions

How long do I have to lodge an OAIC complaint?

The OAIC can decline to investigate complaints made more than 12 months after you became aware of the privacy breach, unless there's a good reason for the delay. Lodge as soon as possible after the organisation's response — or lack of response — to your internal complaint.

Does lodging an OAIC complaint cost anything?

No. Making a complaint to the OAIC is free. You don't need a lawyer, although you can choose to get legal advice if your case is complex or involves significant financial harm.

Can I complain about a small business?

Usually no, unless the small business is a health service provider, trades in personal information, is a credit reporting body, or falls under another specific exception. The OAIC website lists which small businesses are covered.

What if the breach came from an overseas company?

The Privacy Act can apply to overseas organisations that have an Australian link — for example, if they collect data from Australians or operate through an Australian website. The OAIC will assess jurisdiction as part of its preliminary inquiries.

How does Lunyb help after I've already lodged a complaint?

Lunyb helps you detect new exposure, block scam calls and messages triggered by the breach, audit app permissions, and secure passwords and sensitive photos in an encrypted vault. You can start with the free privacy quiz at lunyb.com and add the app on iOS or Android for ongoing protection.