OAIC Complaints: How to Report a Privacy Breach in Australia

If your personal information has been mishandled by an Australian business or government agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). Lodging a complaint is free, can be done online, and may result in an apology, a change in practice, or compensation. This guide explains exactly how to report a privacy breach to the OAIC, what evidence to gather, how long the process takes, and what outcomes you can realistically expect.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner is the independent federal regulator responsible for enforcing the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs). It handles complaints about how organisations collect, store, use, disclose, or secure personal information.

You can complain to the OAIC if an entity covered by the Privacy Act has interfered with your privacy. Covered entities include:

• Australian Government agencies
• Private sector organisations with annual turnover over $3 million
• Health service providers of any size
• Credit reporting bodies and credit providers
• Tax File Number recipients
• Some small businesses that trade in personal information or are contracted service providers

The OAIC generally does not handle complaints about state or territory agencies (those go to the state privacy commissioner), most small businesses under $3 million turnover, or employee records held by current or former employers.

Examples of Reportable Privacy Breaches

• A company sent your medical records to the wrong recipient
• A retailer refused to let you access or correct your personal data
• Your bank disclosed your details to a third party without consent
• A website collected sensitive information without a clear privacy notice
• An organisation suffered a data breach exposing your name, address, or ID documents
• A business used your contact details for direct marketing after you opted out

Step 1: Complain Directly to the Organisation First

Before the OAIC will accept your complaint, you must usually raise the issue with the organisation involved and give them a reasonable chance to respond — typically 30 days. This requirement is set out in section 40(1A) of the Privacy Act.

1. Find the privacy officer: Check the organisation's privacy policy (usually linked in the website footer) for the designated contact.
2. Put it in writing: Email or post a formal complaint. Keep a copy with timestamps.
3. Be specific: Describe what happened, when, which personal information was involved, and the outcome you want (apology, deletion, correction, compensation).
4. Set a deadline: State that you expect a substantive response within 30 days.
5. Keep records: Save all correspondence, reference numbers, and dates.

If the organisation refuses to respond, gives an inadequate answer, or ignores you past 30 days, you can escalate to the OAIC.

Step 2: How to Lodge an OAIC Complaint

The OAIC accepts complaints through three channels. Online is the fastest and most tracked option.

Lodging Options

Method	Details	Best For
Online form	Available at oaic.gov.au via the Privacy Complaint Form	Most complaints — fastest acknowledgement
Email / post	enquiries@oaic.gov.au or GPO Box 5288, Sydney NSW 2001	If you need to attach bulky evidence
Phone	1300 363 992 (translator service available)	Initial enquiries or accessibility needs

Information You Must Provide

1. Your full name and contact details
2. The name of the organisation or agency complained about
3. A clear description of what happened and when
4. Which personal information was involved
5. Evidence that you complained to the organisation first and their response (or lack of one)
6. Copies of relevant correspondence, screenshots, policies, or breach notifications
7. The outcome you are seeking

There is no fee to lodge a complaint, and you do not need a lawyer.

Step 3: What Happens After You Lodge

Once the OAIC receives your complaint, it moves through several stages. Timing varies based on complexity and the regulator's current workload, but the typical path looks like this:

The OAIC Complaint Process

1. Acknowledgement (within 10 days): You receive confirmation and a reference number.
2. Preliminary assessment: The OAIC decides whether the complaint falls within its jurisdiction and whether it should be investigated. Some matters are declined under section 41 (e.g. if the organisation has already dealt with the complaint adequately or more than 12 months have passed).
3. Early resolution / conciliation: Most complaints are resolved informally. The OAIC may contact the organisation, exchange information, and try to broker a mutually acceptable outcome.
4. Formal investigation: If conciliation fails and the matter is significant, the Commissioner may launch a formal investigation under section 40(2) with powers to compel documents and witnesses.
5. Determination: The Commissioner can issue a binding determination requiring the organisation to apologise, change practices, or pay compensation.

Most matters are closed within 12 months, but complex cases involving large data breaches can take considerably longer.

Possible Outcomes and Remedies

The OAIC has broad remedial powers under section 52 of the Privacy Act. Outcomes vary by case severity:

• Apology: A written apology from the organisation, acknowledging the interference with privacy.
• Corrective action: Deletion, correction, or secure destruction of your personal information.
• Practice changes: The organisation updates its policies, staff training, or technical controls.
• Compensation: Payment for financial loss, out-of-pocket expenses, or non-economic loss (hurt feelings, embarrassment, anxiety). Awards historically range from a few hundred dollars to tens of thousands in serious cases.
• Public determination: In significant matters, the Commissioner publishes a reasoned decision naming the organisation.

For systemic failures, the Commissioner can also seek civil penalties through the Federal Court. Following 2022 amendments, maximum penalties for serious or repeated interferences with privacy increased to the greater of A$50 million, three times the benefit obtained, or 30% of adjusted turnover.

Notifiable Data Breaches: A Related but Separate Scheme

Since February 2018, the Notifiable Data Breaches (NDB) scheme requires covered entities to notify the OAIC and affected individuals when a data breach is likely to result in serious harm. If you have received a data breach notification, you still have the right to lodge your own complaint about how the breach was handled or whether it should have occurred in the first place.

Signs You May Want to Complain About a Breach Response

• The notification was delayed well beyond the 30-day assessment window
• The organisation downplayed the type of data involved
• You were not offered credit monitoring or identity protection where appropriate
• Follow-up questions were ignored
• You suffered identity theft or financial loss as a result

Protecting Your Privacy Going Forward

Lodging a complaint helps hold organisations accountable, but proactive habits reduce your exposure in the first place. Consider the following:

1. Minimise what you share: Only provide the personal information strictly necessary for a transaction.
2. Use strong, unique passwords managed through a reputable password manager, and enable multi-factor authentication wherever available.
3. Review privacy settings on social media, mobile apps, and connected devices every few months.
4. Use privacy-respecting tools for links you share. If you post or send URLs publicly, a privacy-focused shortener like Lunyb helps you avoid leaking tracking parameters or exposing destination details. For a comparison of options, see our 2026 URL shortener buyer's guide.
5. Monitor your credit file through Equifax, Experian, and illion — Australians are entitled to one free report per year from each.
6. Request your data under APP 12 to see what organisations hold about you, and request corrections under APP 13.

Common Mistakes That Weaken a Complaint

Mistake	Why It Hurts	Fix
Skipping the direct complaint	OAIC usually refers you back to the organisation	Always complain to the entity first and wait 30 days
Waiting too long	Complaints over 12 months old may be declined	Lodge as soon as the organisation's response is inadequate
Vague descriptions	Investigators cannot assess what happened	Give dates, data types, and specific actions
No evidence	Harder to establish an interference with privacy	Attach emails, screenshots, letters, and breach notices
Unrealistic remedies	Delays conciliation	Request outcomes the OAIC can actually order

When to Seek Legal Advice

You do not need a lawyer to lodge a complaint, but legal advice can be valuable when:

• Significant financial loss or identity theft has occurred
• The breach involves sensitive health, financial, or biometric data
• You intend to seek representative (class) action for a large-scale breach
• The organisation threatens defamation action over your complaint
• The matter crosses into other areas such as discrimination, consumer law, or employment

Community legal centres, Legal Aid in your state, and privacy-focused law firms often offer initial consultations at low or no cost.

Frequently Asked Questions

How much does it cost to lodge an OAIC complaint?

Nothing. Lodging a privacy complaint with the OAIC is completely free, and you do not need legal representation to use the online form or any other channel.

How long does the OAIC take to resolve a complaint?

Simple matters that resolve through early conciliation can be closed within a few months. More complex investigations, especially those involving large data breaches or formal determinations, may take 12 months or longer. You will receive a reference number and periodic updates throughout the process.

Can I get compensation for a privacy breach?

Yes. The Commissioner can order compensation for financial loss, out-of-pocket expenses, and non-economic loss such as distress or embarrassment. Historical awards range from a few hundred dollars for minor matters to tens of thousands for serious, documented harm. You must provide evidence of the loss or harm suffered.

What if the organisation is a small business or state agency?

Most small businesses with turnover under A$3 million are exempt from the Privacy Act, so the OAIC generally cannot act. State and territory government agencies are covered by state privacy laws — contact the privacy commissioner in your jurisdiction (for example, the NSW IPC or OVIC in Victoria). Health service providers of any size, however, are always covered federally.

Can I complain anonymously?

You can raise concerns anonymously, but the OAIC cannot formally investigate an anonymous complaint because it needs to communicate with you and verify the facts. You can request that your identity be kept confidential from the organisation in some circumstances — ask about this when you lodge.

Final Thoughts

The OAIC complaints process is designed to be accessible to ordinary Australians, not just lawyers and large corporations. If you believe an organisation has mishandled your personal information, document everything, complain to the entity first, and then escalate to the OAIC if the response is inadequate. Taking action not only protects your own interests — it strengthens privacy standards across the Australian economy by holding entities accountable to the Privacy Act and the Australian Privacy Principles.