OAIC Complaints: How to Report a Privacy Breach in Australia

If an Australian business, government agency or organisation has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). This guide explains exactly how the OAIC complaints process works, when you can report a privacy breach, and what you can expect at each stage — so you can act quickly and confidently.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner (OAIC) is the independent national regulator responsible for enforcing the Privacy Act 1988 and the Australian Privacy Principles (APPs). You can lodge an OAIC complaint when an entity covered by the Privacy Act has interfered with your privacy — for example, by collecting, storing, using, disclosing, or securing your personal information incorrectly.

Common reasons Australians lodge privacy complaints include:

A data breach exposing your personal information (name, address, Medicare number, driver licence, bank details).
An organisation refusing to give you access to your own personal information.
Incorrect personal information not being corrected after a reasonable request.
Unwanted direct marketing after you asked to opt out.
Unauthorised disclosure of health, financial or employment records.
Credit reporting errors or misuse of consumer credit information.
Misuse of tax file numbers (TFNs).

Who Can the OAIC Investigate?

The OAIC can investigate most Australian Government agencies, private sector organisations with an annual turnover of more than $3 million, all private health service providers, credit providers, credit reporting bodies, and some small businesses that trade in personal information. State and territory government agencies are generally handled by state-based privacy regulators instead.

Step 1: Complain Directly to the Organisation First

Before the OAIC will accept your complaint, you must usually give the organisation a chance to fix the problem. This is a mandatory first step under the Privacy Act — the regulator wants to see that you tried to resolve it internally.

Identify the right contact. Most organisations list a Privacy Officer or privacy contact in their privacy policy. Check the footer of their website.
Put your complaint in writing. Email is ideal because it creates a timestamped record. Clearly state what happened, what information was involved, and what outcome you want (apology, correction, deletion, compensation).
Give them 30 days to respond. The OAIC generally expects you to wait at least 30 days before escalating, unless the organisation refuses to engage or the breach is serious and ongoing.
Keep every record. Save emails, letters, screenshots, chat transcripts, and any reference numbers they provide.

What If the Organisation Ignores You?

If you receive no response after 30 days, or you get a response but are not satisfied with the outcome, you can escalate the matter to the OAIC. Non-response is actually a strong element of a complaint — it shows the organisation failed to take reasonable steps.

Step 2: Prepare Your OAIC Complaint

A well-prepared complaint moves faster. The OAIC receives thousands of complaints each year, and clear, chronological submissions are prioritised because investigators can act on them immediately.

Gather the following before you lodge:

Your full name, contact details, and preferred method of contact.
The name and contact details of the organisation involved.
A chronological summary of events, including dates.
A description of the personal information affected.
Copies of your original complaint to the organisation and their response (or proof they didn't respond).
Evidence of any harm — financial loss, identity theft attempts, stress, reputational damage.
The outcome you are seeking.

Tips for Writing a Strong Complaint

Keep it factual and specific. Investigators are trained to look for which Australian Privacy Principle (APP) has been breached, so if you can reference the relevant APP, do so. For example:

APP 1 – Open and transparent management of personal information.
APP 6 – Use or disclosure of personal information.
APP 11 – Security of personal information (the most common breach).
APP 12 – Access to personal information.
APP 13 – Correction of personal information.

Step 3: Lodge the Complaint with the OAIC

You can lodge an OAIC complaint through several channels. The online form is the fastest and most trackable option.

Channel	Best For	Typical Acknowledgement Time
Online complaint form (oaic.gov.au)	Most complainants, fastest processing	Within 10 business days
Email (enquiries@oaic.gov.au)	When you need to attach many documents	Within 10 business days
Post (GPO Box 5288, Sydney NSW 2001)	Those without digital access	2–4 weeks
Phone (1300 363 992)	General enquiries and guidance only	Immediate (but not a formal lodgement)
National Relay Service / Translating Service	Accessibility needs	Varies

There is no fee to lodge an OAIC complaint. You do not need a lawyer, although you may use one if you wish.

Step 4: What Happens After You Lodge

Once lodged, the OAIC follows a structured process. Understanding the stages helps you set realistic expectations — most matters take several months, and complex investigations can take over a year.

Acknowledgement. You'll receive confirmation and a reference number, usually within 10 business days.
Preliminary assessment. The OAIC checks jurisdiction, whether you complained to the organisation first, and whether the complaint falls within time limits (generally within 12 months of becoming aware of the breach).
Early resolution. Many complaints are resolved at this stage through informal conciliation — the OAIC contacts the organisation and brokers an outcome.
Formal investigation. If early resolution fails, the Commissioner may open a formal investigation under section 40 of the Privacy Act.
Determination. The Commissioner can make a formal, binding determination, including ordering compensation or requiring the organisation to change its practices.

Possible Outcomes

An apology from the organisation.
Correction or deletion of your personal information.
Changes to the organisation's privacy practices or staff training.
Compensation for financial loss and, in some cases, non-economic loss (stress and humiliation) — awards historically range from a few hundred dollars to tens of thousands.
Civil penalties against the organisation for serious or repeated breaches (up to $50 million or more for corporations under the 2022 amendments).

Notifiable Data Breaches: A Special Case

Under the Notifiable Data Breaches (NDB) scheme, organisations must report eligible data breaches to the OAIC and to affected individuals when there is a likelihood of serious harm. If you've received a data breach notification letter or email, you already have strong evidence to support a complaint.

Receiving an NDB notification doesn't automatically entitle you to compensation, but it confirms the organisation acknowledges the breach — making your OAIC complaint much easier to progress. Keep the notification, note the date you received it, and include it in your submission.

Protecting Yourself After a Breach

While the OAIC investigates, take practical steps to reduce further harm:

Place a ban or freeze on your credit report with Equifax, Experian, and illion.
Change passwords and enable two-factor authentication on affected accounts.
Consider replacing compromised ID documents (driver licence, passport, Medicare card).
Use encrypted DNS and a privacy-focused browser to limit future tracking.
When sharing links or contact forms publicly, use a trusted link management tool like Lunyb so you can monitor, disable, or rotate links if your details appear in another leak. For a deeper look, see our honest review of Lunyb.
Register with IDCARE (1800 595 160), Australia's free identity and cyber support service.

Time Limits and Common Pitfalls

The OAIC can decline to investigate a complaint lodged more than 12 months after you became aware of the privacy breach, unless there are good reasons for the delay. Other common reasons complaints are rejected or closed early include:

Not complaining to the organisation first.
The matter is being handled by another regulator (e.g., AHPRA, ASIC, state ombudsman).
The complaint is about an entity not covered by the Privacy Act (e.g., a small business, a state agency, or a political party acting in its political capacity).
The complaint is considered vexatious, lacking in substance, or already resolved.

If the OAIC Declines Your Complaint

You can request an internal review, or in some cases seek review by the Administrative Review Tribunal (ART). If the matter involves significant financial loss, you may also pursue a private action in the Federal Court once the Privacy Act's statutory tort for serious invasions of privacy is in force.

Comparison: OAIC vs Other Australian Complaint Pathways

Regulator	Handles	Typical Timeframe
OAIC	Privacy Act breaches, APP breaches, NDB	3–12 months
AFCA	Financial services privacy issues	60–90 days
TIO	Telco and internet provider privacy issues	30–45 days
State Privacy Commissioner (e.g., IPC NSW)	State agencies	2–6 months
eSafety Commissioner	Image-based abuse, cyberbullying	48 hours – 2 weeks
ACCC	Misleading privacy claims under Australian Consumer Law	Varies

Sometimes the best pathway is not the OAIC. For example, if your bank mishandled your data, AFCA often resolves matters faster and can award compensation directly.

Practical Example: Lodging a Complaint After a Data Leak

Imagine you receive a notification that a retailer suffered a data breach exposing your email, address, and date of birth. Here's how a textbook complaint would unfold:

Day 1: You email the retailer's Privacy Officer requesting details of the breach, what information was exposed, and what remediation is offered.
Day 14: They respond with a generic apology but no concrete action.
Day 21: You reply asking for specific remediation: free credit monitoring, written confirmation of the APPs breached, and a commitment to delete your data.
Day 35: No meaningful reply. You lodge an OAIC complaint online, attaching all correspondence.
Day 45: OAIC acknowledges and assigns a case officer.
Months 2–5: Conciliation. The retailer offers free monitoring and a small compensation payment.
Resolution: You accept, and the OAIC closes the matter.

Reducing Your Future Privacy Risk

Lodging a complaint is reactive. The best outcome is not needing to lodge one in the first place. A few habits significantly reduce your exposure:

Use a password manager and unique passwords for every account.
Minimise the personal data you hand over — ask whether a field is really required.
Use secondary email aliases for sign-ups.
When publishing links on social media or in marketing, use trackable short links so you can revoke or replace them if a platform is breached — compare options in our 2026 URL shorteners buyer's guide or read our Rebrandly review.
Regularly review which apps and services have access to your Google, Apple, and Microsoft accounts.

FAQ: OAIC Complaints and Privacy Breaches

How long does an OAIC complaint take to resolve?

Most complaints resolve within 3 to 12 months. Simple matters handled through early conciliation can close in 6–8 weeks, while formal investigations and determinations can take 12–24 months, especially where multiple complainants are involved.

Can I get compensation through an OAIC complaint?

Yes. The Commissioner can order compensation for financial loss and for non-economic loss such as stress, humiliation, or injury to feelings. Historical awards range from a few hundred dollars to over $20,000 per person, with class-action-style determinations potentially much higher.

Do I need a lawyer to lodge an OAIC complaint?

No. The OAIC complaints process is designed to be accessible without legal representation, and there is no filing fee. However, for complex breaches involving significant financial loss, identity theft, or potential litigation, getting legal advice can strengthen your case.

What if the organisation is a small business not covered by the Privacy Act?

Small businesses with turnover under $3 million are generally exempt, with important exceptions (health service providers, businesses that trade in personal information, credit reporting bodies, contractors to Commonwealth agencies). If the business isn't covered, you may still pursue remedies through the Australian Consumer Law via the ACCC, or in some cases through a civil claim.

Can I complain anonymously?

The OAIC accepts anonymous tips and can use them to identify systemic issues, but it cannot investigate or resolve an anonymous complaint on your behalf because it won't be able to contact you about the outcome. If privacy is a concern, you can request that your identity not be disclosed to the respondent during conciliation where possible.

Is there a time limit for lodging a complaint?

The OAIC can decline to investigate complaints lodged more than 12 months after you became aware of the breach. Lodge as soon as practicable, and if there's been a delay, explain the reason clearly in your submission.