OAIC Complaints: How to Report a Privacy Breach in Australia (2026)

If an organisation has mishandled your personal information, you have a clear route in Australia: lodge a complaint with the Office of the Australian Information Commissioner (OAIC). But before you reach for the complaint form, there is work worth doing to make your case strong, and ongoing protection worth setting up so you are not back in the same position next year. That is where Lunyb comes in — our privacy app is built to help Australians spot data breaches early, document the damage, and lock down exposed accounts quickly.

This guide walks you through the OAIC complaints process end to end, then shows you exactly how Lunyb fits alongside it as your practical privacy toolkit.

What an OAIC Privacy Complaint Actually Is

An OAIC complaint is a formal request for the Australian Information Commissioner to investigate whether an organisation or Australian Government agency has breached the Privacy Act 1988, including the 13 Australian Privacy Principles (APPs). The OAIC can facilitate resolution, conduct an investigation, and in some cases make determinations that include compensation.

You can complain about things like:

• An organisation collecting personal information it did not need
• Your data being used or disclosed for a purpose you did not consent to
• A business refusing to give you access to your own information
• A failure to keep your data secure, including a data breach
• Mishandling of your tax file number or credit information

The OAIC generally handles complaints about organisations with an annual turnover above $3 million, Australian Government agencies, private health providers, and some small businesses that trade in personal information. State and territory government complaints usually go to the relevant state privacy regulator.

Before You Complain: Contact the Organisation First

The OAIC expects you to raise your concern with the organisation first and give them a reasonable chance to respond — usually 30 days. This step is not optional in most cases, and doing it well can resolve the issue faster than a formal complaint.

How to Raise It Directly

1. Find the privacy contact. Look for a Privacy Officer, Data Protection Officer, or a privacy email in the organisation's privacy policy.
2. Write a clear, dated complaint. Describe what happened, when, what information was involved, and what you want them to do (fix a record, delete data, apologise, compensate, improve security).
3. Keep everything in writing. Email is ideal. If you phone, follow up with a written summary.
4. Set a deadline. State that if you do not receive a substantive response within 30 days, you will escalate to the OAIC.
5. Save evidence. Screenshots, breach notification emails, suspicious messages, transaction records, and any replies you receive.

How to Lodge an OAIC Complaint Step by Step

Once the 30 days have passed without a satisfactory response — or the organisation refuses to engage — you can lodge with the OAIC.

1. Go to oaic.gov.au and open the privacy complaint form. You can submit online, by email, by post, or request an accessible format.
2. Identify the respondent — the organisation or agency you are complaining about. Include trading names and ABNs if you have them.
3. Describe the incident in plain language: dates, what personal information was involved, how you discovered the problem, and the impact on you.
4. Attach evidence. Upload the breach notice, your original complaint to the organisation, their response (or proof you contacted them), and any supporting screenshots.
5. State the outcome you want. Common outcomes include an apology, correction or deletion of data, a change in the organisation's practices, or compensation for financial loss or psychological harm.
6. Submit and keep your reference number. The OAIC will acknowledge your complaint and assign a case officer.

What Happens After You Lodge

The OAIC process is designed to be conciliatory first, investigative second. Expect a staged approach rather than an instant ruling.

1. Preliminary Assessment

The OAIC checks it has jurisdiction, that you contacted the organisation first, and that the complaint falls within scope. They may ask for more information.

2. Early Resolution or Conciliation

Most complaints are resolved informally. A case officer may contact the organisation and facilitate an outcome — a refund, record correction, apology, or process change.

3. Investigation

If early resolution fails and the matter is serious, the Commissioner can formally investigate, require documents, and make a determination. Determinations can include declarations that conduct was an interference with privacy and awards of compensation.

4. Review

If you disagree with the outcome, limited review options exist, including application to the Administrative Review Tribunal in certain circumstances.

Timelines vary. Simple matters can resolve in weeks; complex investigations can take many months.

Notifiable Data Breaches: What You Should Already Be Receiving

Under the Notifiable Data Breaches (NDB) scheme, organisations covered by the Privacy Act must notify both the OAIC and affected individuals when a data breach is likely to result in serious harm. If you got a breach letter or email, that notification is itself strong evidence for your complaint.

Keep the full notification, including:

• The date you were notified
• What categories of information were exposed (name, email, phone, ID documents, health, financial)
• The steps the organisation says it has taken
• Recommendations they gave you

The hard part is that many Australians never get notified — either because the breach is below the "serious harm" threshold, or because their data was exposed by a third party they never did business with directly. That is the gap Lunyb is built to close.

How Lunyb Helps You Catch Breaches and Build a Stronger Complaint

Lodging an OAIC complaint is far easier when you can show exactly what happened, when you learned about it, and what you did to limit the damage. Lunyb gives you the monitoring, evidence trail, and account protection you need — in one app, without the manual spreadsheet work.

Data Breach Alerts for Your Email and Phone

Our Data Breach Alerts continuously monitor your email addresses and phone number against known breach datasets. When your details show up in a new exposure, you get a clear alert with the source, the date, and what categories of data were involved. That timestamped alert is exactly the kind of evidence the OAIC wants when you say "I only learned about this on X date."

Scam Checker and Scam Shield

After a breach, the follow-on attacks come fast: phishing SMS, fake bank calls, fake Australia Post or ATO messages. Lunyb's Scam Checker lets you paste a suspicious message or link and get an instant assessment, and Scam Shield helps screen unwanted calls. Catching these early stops a privacy breach from turning into financial loss — and strengthens your case that the original breach caused real harm.

Privacy Check and Security Score

Lunyb's Privacy Check walks through your app permissions and surfaces the ones that are oversharing your location, contacts, microphone, or photos. The Security Score gives you one number to track as you tighten things up, which is useful if you ever need to show you took your own privacy seriously.

Password and Photo Vault

If your credentials were in the breach, you need to rotate them fast and store the new ones safely. Our encrypted Password Vault and Photo Vault keep sensitive logins and ID documents (driver licence scans, Medicare cards, passport photos) locked away rather than sitting in your camera roll or notes app.

On-Device Tracker and Threat Blocking

Lunyb runs a local DNS shield on your device that blocks known trackers and malicious domains at the network level, without routing your traffic through a third party. That means fewer third parties quietly collecting your data in the first place.

Photo Guard and Browsing History Eraser

Photo Guard performs reverse-image checks so you can see where your photos may have been reused online, and the browsing history eraser clears local traces across your devices in one sweep.

Family Location Sharing and Data-Broker Exposure Help

Share location safely within your household with controls you actually own, and get structured help reducing your exposure on data-broker style sites that aggregate Australian consumer details.

Lunyb vs. Handling a Breach Manually

Task	Manual approach	With Lunyb
Know when your data leaks	Hope the organisation notifies you	Continuous breach alerts for email and phone
Check suspicious messages	Guess, or Google the sender	Paste into Scam Checker for instant assessment
Review app permissions	Settings menus on every device	Privacy Check in one view, with recommendations
Store new passwords after a breach	Notes app, browser autofill, reused passwords	Encrypted Password Vault
Block trackers and malicious sites	Multiple extensions, inconsistent on mobile	On-device DNS shield across apps
Evidence for your OAIC complaint	Scattered emails and screenshots	Timestamped alerts and a clear security record

Practical Checklist: From Breach Discovery to OAIC Resolution

1. Confirm the breach. Keep the notification email or Lunyb alert.
2. Change exposed passwords and enable two-factor authentication on affected accounts. Store new credentials in your Lunyb Password Vault.
3. Watch for scams. Run suspicious SMS and emails through Lunyb's Scam Checker before clicking anything.
4. Request a credit ban with the Australian credit bureaus if financial or identity data was exposed.
5. Write to the organisation. Clear complaint, 30-day deadline, in writing.
6. Collect evidence. Breach notice, your complaint, their reply, any losses or scam attempts.
7. Lodge with the OAIC. Submit the form at oaic.gov.au with attachments and the outcome you want.
8. Harden your setup. Use Lunyb's Privacy Check and Security Score so the next breach does less damage.

Common Mistakes That Weaken an OAIC Complaint

• Skipping the direct complaint step. The OAIC will usually send you back to try the organisation first.
• Vague timelines. "Sometime last year" is weaker than "on 14 March 2026 I received this breach notification."
• No requested outcome. Tell the OAIC what resolution would make this right.
• Missing proof of harm. If you faced phishing, identity attempts, or financial loss, document it. Lunyb's scam and breach history helps here.
• Letting the problem recur. If you do not tighten your own setup, you will be filing another complaint next year.

Who Else Can Help Alongside the OAIC

Depending on the breach, you may also want to contact:

• IDCARE — Australia's national identity and cyber support service for individuals
• ReportCyber (cyber.gov.au) — for cybercrime reporting
• Scamwatch — for scams linked to the breach
• Your bank — immediately, if financial information was exposed
• State privacy regulators — for state agency matters

These complement the OAIC process rather than replace it.

Start Protecting Yourself Today with Lunyb

An OAIC complaint can hold an organisation accountable, but it does not undo a breach. Early warning, scam defence, and tight account hygiene do. Lunyb gives you all three in one app.

Here is the easiest way to get started:

1. Visit lunyb.com and take the free privacy quiz to see where you stand right now.
2. Download the Lunyb app from the App Store or Google Play.
3. Turn on Data Breach Alerts for your email and phone.
4. Run Privacy Check and watch your Security Score climb.

Plans start from about $19.99 per month, renew until cancelled, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan — transparent pricing, no surprises.

If you also manage links or QR codes for a small business, side project, or community group, our privacy-first URL shortener and secure QR platform is included in the Lunyb ecosystem. See how it stacks up in our Rebrandly comparison.

FAQ

How long do I have to lodge an OAIC privacy complaint?

There is no strict statutory deadline, but the OAIC may decline to investigate if you complain more than 12 months after you became aware of the issue. Lodge as soon as practical after giving the organisation 30 days to respond.

Can I get compensation through the OAIC?

Yes. If the Commissioner makes a determination in your favour, it can include compensation for financial loss and for non-economic loss such as stress, humiliation, or anxiety caused by the breach. Many cases resolve through conciliation with outcomes like refunds, apologies, or corrections instead.

Does Lunyb replace the OAIC process?

No. The OAIC is the regulator; Lunyb is your personal privacy toolkit. Lunyb helps you detect breaches early, defend against follow-on scams, and keep an evidence trail — which makes any OAIC complaint you do lodge faster and stronger.

What if the organisation is based overseas?

The Privacy Act can still apply to overseas entities that carry on business in Australia and collect or hold personal information here. The OAIC can consider complaints in those circumstances. Lunyb's breach alerts cover exposures regardless of where the company is based.

Is Lunyb safe to use with my sensitive information?

Yes. Lunyb's Password Vault and Photo Vault are encrypted, our tracker blocking runs on-device at the DNS level without routing your traffic through a third party, and our pricing and cancellation terms are stated plainly. You can read more in our honest review of Lunyb.

Ready to take back control? Head to lunyb.com, take the free privacy quiz, and set up Data Breach Alerts today. The next breach will not wait — and neither should you.