OAIC Complaints: How to Report a Privacy Breach in Australia

If your personal information has been mishandled by an Australian business or government agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). This guide explains exactly how to report a privacy breach, what the OAIC can and can't do, and how to maximise your chances of a successful outcome.

What Is the OAIC?

The Office of the Australian Information Commissioner (OAIC) is the independent federal regulator responsible for enforcing the Privacy Act 1988 and the Australian Privacy Principles (APPs). It investigates complaints about privacy breaches, handles data breach notifications, and promotes compliance across the private and public sectors.

The OAIC has powers to investigate, make determinations, issue enforceable undertakings, and in serious cases, seek civil penalties through the Federal Court. For individuals, it is the main avenue of recourse when a company or agency mishandles your personal data.

What the OAIC Can Investigate

Businesses with annual turnover above AUD $3 million
All Australian Government agencies
Health service providers of any size
Credit reporting bodies and credit providers
Tax File Number recipients
Businesses that trade in personal information

What the OAIC Cannot Help With

Most small businesses under the $3 million threshold (with exceptions)
State and territory government agencies (contact your state privacy regulator)
Media organisations acting in the course of journalism
Employee records held by current or former employers

What Counts as a Privacy Breach?

A privacy breach occurs when personal information is accessed, disclosed, lost, or handled in a way that contravenes the Australian Privacy Principles. This covers a wide range of scenarios, from accidental email mistakes to major cyberattacks.

Common Examples of Reportable Breaches

Unauthorised disclosure: An organisation emails your personal details to the wrong recipient.
Data loss or theft: A hacker steals customer records from a company's database.
Collection without consent: A company gathers sensitive information you never agreed to share.
Refusal to provide access: You request a copy of your data under APP 12 and the organisation refuses or ignores you.
Failure to correct inaccurate data: You ask for incorrect information to be fixed but the organisation won't act.
Direct marketing without consent: You receive marketing messages after opting out.
Overseas transfer without protection: Your data is sent overseas without reasonable steps to protect it.

Before You Lodge: Complain to the Organisation First

The OAIC requires you to complain directly to the organisation before escalating. This is a mandatory first step in most cases, and it gives the business or agency a chance to resolve the issue.

Steps to Complain Directly

Identify the privacy officer. Most organisations list a privacy contact in their privacy policy, usually at the bottom of their website.
Put your complaint in writing. Email creates a timestamped record. Explain what happened, when, and how it breached your privacy.
State what you want. Common remedies include an apology, data deletion, correction, a change in practice, or compensation.
Give them 30 days to respond. This is the standard period the OAIC expects before accepting a complaint.
Keep every communication. Save emails, letters, screenshots and reference numbers.

If the organisation doesn't respond within 30 days, provides an unsatisfactory response, or refuses to engage, you can escalate to the OAIC.

How to Lodge an OAIC Complaint: Step by Step

Lodging a complaint with the OAIC is free and can be done entirely online. The regulator aims to make the process accessible without requiring a lawyer.

Step 1: Gather Your Evidence

Before you begin, collect:

The name and contact details of the organisation
A clear timeline of what happened
Copies of your correspondence with the organisation
Screenshots, emails, letters or any supporting documents
Details of any harm you have suffered (financial loss, distress, identity theft risk)

Step 2: Complete the Online Form

Visit the OAIC website and open the privacy complaint form. You'll be asked to:

Confirm you have complained to the organisation first
Describe the breach in your own words
Identify which Australian Privacy Principle you believe was breached (optional but helpful)
Upload supporting documents
Explain what outcome you are seeking

Step 3: Submit and Wait for Acknowledgement

The OAIC usually acknowledges your complaint within a few business days. You'll receive a reference number — keep this safe for all future communication.

Step 4: Preliminary Assessment

An OAIC officer will review your complaint to decide whether it falls within jurisdiction and has sufficient grounds. They may contact you for more information or clarification.

Step 5: Conciliation

If accepted, the OAIC often attempts conciliation — essentially facilitated negotiation between you and the organisation. Many complaints resolve at this stage with an apology, remediation, or modest compensation.

Step 6: Formal Investigation or Determination

If conciliation fails and the matter is serious, the Commissioner may conduct a formal investigation and issue a determination. Determinations are legally enforceable and can require the organisation to pay compensation, change practices, or issue public apologies.

Timelines: How Long Does an OAIC Complaint Take?

The OAIC publishes service standards, but real-world timelines vary significantly based on complexity and workload. Here is a realistic expectation:

Stage	Typical Timeframe
Acknowledgement of complaint	3–10 business days
Initial assessment	4–8 weeks
Conciliation	3–6 months
Formal investigation	6–18 months
Determination	12–24 months (complex cases)

High-profile cases involving large data breaches can take much longer, particularly if they involve coordination with other regulators or law enforcement.

The Notifiable Data Breaches Scheme

Separate from individual complaints, Australia operates a Notifiable Data Breaches (NDB) scheme. Under the scheme, organisations must notify both the OAIC and affected individuals when a data breach is likely to result in serious harm.

What Triggers Mandatory Notification

There is unauthorised access, disclosure, or loss of personal information
The breach is likely to result in serious harm (financial, physical, psychological, reputational)
The organisation has been unable to prevent the likely risk of harm through remedial action

If you receive a data breach notification letter or email, read it carefully. It should explain what was exposed, the risks you face, and what the organisation is doing. You can still lodge an OAIC complaint if you believe the response was inadequate or the breach was mishandled.

What Outcomes Can You Expect?

OAIC complaints rarely result in massive payouts, but they can secure meaningful remedies.

Possible Remedies

Remedy	How Common	Typical Value
Written apology	Very common	Non-monetary
Data correction or deletion	Common	Non-monetary
Staff training commitments	Common	Non-monetary
Compensation for non-economic loss	Occasional	$1,000–$20,000
Compensation for economic loss	Rare	Variable, requires evidence
Aggravated damages	Rare	$5,000+ in serious cases
Enforceable undertakings	Large cases	Policy changes, audits
Civil penalties (via Federal Court)	Major breaches	Up to $50M+ per breach

Tips to Strengthen Your Complaint

Well-prepared complaints are more likely to succeed. Here's how to improve yours:

Be Specific and Factual

Stick to dates, documents and events. Avoid emotive language or speculation. Reference the specific Australian Privacy Principle you believe was breached if you can.

Document the Harm

Harm doesn't have to be financial. Document anxiety, time spent remediating, impact on your reputation, or the realistic risk of identity theft. Keep a diary of impacts.

Propose a Proportionate Remedy

Asking for $100,000 for a single misdirected email will undermine your credibility. Ask for something reasonable: a written apology, deletion, and perhaps modest compensation for distress.

Protect Yourself Going Forward

While your complaint progresses, take steps to limit further exposure. Use strong unique passwords, enable multi-factor authentication, monitor your credit file, and be cautious about which services you give personal data to. When sharing links or content online, consider privacy-respecting tools — for instance, a shortener like Lunyb lets you share URLs without exposing your platform choices or tracking parameters. For a wider look at options, see our 2026 buyer's guide to URL shorteners.

When to Get Legal Help

Most privacy complaints don't need a lawyer. However, consider legal advice if:

You've suffered significant financial loss
The breach involves sensitive information (health, sexuality, criminal history)
You are considering joining a class action after a major breach
The organisation is threatening defamation or counter-action
A Federal Court matter is being contemplated

Community legal centres and consumer advocacy organisations often provide free initial advice on privacy matters.

State-Based Alternatives

If your complaint involves a state or territory agency, the OAIC isn't the right body. Each jurisdiction has its own regulator:

Jurisdiction	Regulator
NSW	Information and Privacy Commission NSW
Victoria	Office of the Victorian Information Commissioner
Queensland	Office of the Information Commissioner QLD
Western Australia	No dedicated privacy regulator — contact the Ombudsman
South Australia	SA Privacy Committee
Tasmania	Ombudsman Tasmania
ACT	OAIC (by arrangement)
Northern Territory	NT Information Commissioner

Frequently Asked Questions

Does it cost anything to lodge an OAIC complaint?

No. Lodging a privacy complaint with the OAIC is completely free. You do not need a lawyer, although you may choose to engage one in complex cases. The OAIC provides forms, guidance and support in multiple languages.

Can I remain anonymous when I complain?

The OAIC generally needs your identity to investigate meaningfully, but you can request your details not be shared with the respondent in limited circumstances. You can also report concerns anonymously through the OAIC's enquiry line without lodging a formal complaint.

How much compensation can I get for a privacy breach?

There is no fixed scale, but Commissioner determinations have historically awarded between $1,000 and $20,000 for non-economic loss (distress, humiliation) in individual cases. Larger amounts are possible for serious cases involving sensitive information, identity theft, or aggravated conduct. In class actions following major breaches, settlements can be much higher.

What if the organisation is overseas?

The Privacy Act has extraterritorial reach. If an overseas organisation carries on business in Australia and collects personal information from Australians, the OAIC can usually investigate. Enforcement can be more challenging, but recent high-profile cases involving multinational platforms show it is possible.

Can I complain and sue at the same time?

Australia doesn't currently have a direct tort of serious invasion of privacy, although law reform is active in this area. You generally pursue remedies through the OAIC process, which can result in enforceable determinations. For economic losses tied to negligence or breach of contract, separate civil proceedings may be an option — seek legal advice.

Final Thoughts

Reporting a privacy breach to the OAIC is a powerful consumer right, but it works best when you prepare properly. Complain to the organisation first, gather clear evidence, be specific about harm, and ask for proportionate remedies. Even if your individual complaint results only in an apology and a policy change, every complaint helps strengthen the broader privacy landscape in Australia.

For related reading on digital privacy and tools that respect your data, see our review of Lunyb's URL shortener and our comparison of the leading link management platforms.