OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If your personal information has been mishandled by an Australian business or government agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). But a successful complaint needs more than frustration — it needs evidence, dates, and a clear paper trail. That is where most people get stuck, and that is exactly where Lunyb gives you an advantage: our app surfaces breaches early, keeps a record of what was exposed, and helps you act before the damage spreads.

This guide walks you through the full OAIC complaints process for a privacy breach, what the regulator expects from you, and how to build a case that actually moves. We will also show you how to use Lunyb to monitor your exposure continuously so you never have to scramble again.

What an OAIC Privacy Complaint Actually Is

An OAIC complaint is a formal request for the Australian Information Commissioner to investigate an organisation that may have breached the Privacy Act 1988 or the Australian Privacy Principles (APPs). You can lodge one if a business, Australian Government agency, health provider, credit reporting body, or tax file number recipient has mishandled your personal information.

Typical examples that qualify include:

• A company suffered a data breach that exposed your details and did not tell you.
• An organisation collected more personal information than it needed.
• Your data was used for marketing you never agreed to.
• You asked to access or correct your information and were refused or ignored.
• Your information was shared with a third party or sent overseas without a lawful basis.

The OAIC can investigate, make a determination, and in some cases order compensation or require the organisation to change its practices. But before they get involved, you are expected to complain directly to the organisation first.

Step 1: Complain to the Organisation First

The OAIC will almost always ask whether you gave the organisation a chance to fix the problem. Skipping this step is the fastest way to have your complaint bounced back.

1. Find their privacy contact. Every APP-covered entity must publish a privacy policy with a complaint contact — usually a Privacy Officer email.
2. Put it in writing. Email is best. Clearly state what happened, when, what personal information is involved, and what outcome you want (an apology, deletion, correction, compensation, a security fix).
3. Give them 30 days. The OAIC generally expects organisations to have at least 30 days to respond before you escalate.
4. Keep every reply. Save emails, reference numbers, and screenshots. You will need these for the OAIC form.

If they ignore you, refuse to act, or give an unsatisfactory response, you can escalate.

Step 2: Lodge the Complaint with the OAIC

You can lodge an OAIC privacy complaint online at oaic.gov.au, by post, by email, or by phone on 1300 363 992. The online form is the fastest route.

You will need to provide:

• Your contact details.
• The name of the organisation you are complaining about.
• A clear description of what happened and when.
• Copies of your complaint to the organisation and their response (or proof you tried).
• The outcome you are seeking.

The OAIC will acknowledge receipt, assess whether they have jurisdiction, and may try conciliation between you and the organisation. If that fails, the Commissioner can make a formal determination.

What the OAIC Can and Cannot Do

The OAIC can require an organisation to apologise, change its practices, correct or delete data, and in some cases pay compensation for financial loss or non-economic loss such as distress. They cannot prosecute criminal offences (that is for police) and they generally do not act as a first line of complaint — hence the "complain to the business first" rule.

Step 3: Know the Notifiable Data Breaches Scheme

Under the Notifiable Data Breaches (NDB) scheme, organisations covered by the Privacy Act must tell you — and the OAIC — if a data breach is likely to cause you serious harm. If you received one of those notices, you already have strong evidence for a complaint if the organisation was negligent or slow to act.

Keep every breach notification email. Note the date you received it, the date of the actual breach, and what data was involved. This is gold-standard evidence.

How Lunyb Helps You Catch a Breach Before the Notice Arrives

Here is the uncomfortable truth: organisations often take weeks or months to detect a breach, and sometimes longer to notify you. By then, your email, phone number, passwords, or ID details may already be circulating. Lunyb was built to close that gap.

With a single Lunyb subscription, you get a connected set of tools that work together to shorten the window between "something went wrong" and "you know about it and can act":

Data Breach Alerts for Your Email and Phone

Lunyb monitors known breach datasets for your email address and phone number. When your details appear in a new leak, you get alerted — often well before a company sends its official letter. That timestamp alone can be powerful when you tell the OAIC when you first knew.

Scam Checker and Scam Shield

After a breach, the next wave is almost always scam calls and phishing texts pretending to be your bank, Australia Post, the ATO, or myGov. Our Scam Checker lets you paste a suspicious message or link and get a verdict. Scam Shield helps screen suspicious callers so you are not pressured into clicking or paying.

Privacy Check for Your Apps

Many "breaches" start as over-permissioned apps quietly siphoning contacts, location, or photos. Lunyb's Privacy Check audits what your installed apps can access and flags the ones that are asking for more than they should.

Encrypted Password and Photo Vault

Reused passwords are what turn one company's breach into a dozen of your accounts falling over. Our encrypted Password Vault lets you store strong, unique credentials, and the Photo Vault keeps sensitive images (passports, Medicare cards, driver licences) out of your general camera roll.

On-Device Tracker and Threat Blocking

Lunyb includes a local DNS shield that blocks known trackers and malicious domains at the network level on your device — no browser extension juggling required. This reduces how much data leaks in the first place.

Photo Guard and Browsing History Eraser

If you suspect an image of yours has been reused, Photo Guard runs a reverse-image check. And the browsing-history eraser helps you clean up local traces after you have done sensitive research — like, say, preparing an OAIC complaint on a shared computer.

Lunyb plans start from around $19.99/month, renew until cancelled, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. No hidden locks, no fine-print traps — which is exactly the kind of transparent handling of your data the Privacy Act is meant to encourage.

Building a Strong OAIC Complaint: A Checklist

Whether you use Lunyb or not, these are the elements that make an OAIC complaint land well.

1. Dates. When did the breach happen, when did you learn about it, when did you complain to the organisation, when did they respond.
2. Data categories. Exactly what personal information was involved — name, email, phone, address, DOB, ID numbers, health info, financial info.
3. Impact. Scam attempts received, fraud losses, time spent fixing accounts, emotional distress, identity theft risk.
4. Evidence. Breach notification emails, screenshots, your complaint and their reply, Lunyb breach alerts, scam messages you received afterwards.
5. Desired outcome. Apology, deletion, security changes, compensation — be specific.

Comparison: Handling a Breach Manually vs. with Lunyb

After You Lodge: What to Expect

The OAIC will acknowledge your complaint, usually within a few weeks. They may:

• Decline to investigate (for example, if you did not complain to the organisation first, or the matter is outside their remit).
• Refer you back to the organisation for one more attempt.
• Begin conciliation, where they try to broker a resolution between you and the organisation.
• Open a formal investigation and, eventually, make a determination.

Conciliation is the most common path and often results in an apology, a fix, and sometimes compensation. Determinations are rarer but are enforceable.

While You Wait: Reduce Your Ongoing Risk

OAIC complaints can take months. In the meantime, the data is still out there and criminals move fast. A few practical steps:

1. Rotate passwords on any account that shared credentials with the breached service. Store the new ones in Lunyb's encrypted Password Vault.
2. Turn on multi-factor authentication everywhere it is offered.
3. Place a credit ban with Equifax, Experian, and illion if ID data was exposed. This is free in Australia.
4. Replace compromised documents — driver licence, Medicare card, passport — where the issuing agency recommends it.
5. Screen unknown callers with Scam Shield and never give out codes or payments under pressure.
6. Keep monitoring with Lunyb's Data Breach Alerts so you catch the next wave quickly.

Other Avenues Beyond the OAIC

Depending on what happened, you may also want to contact:

• Scamwatch (scamwatch.gov.au) — if you have been targeted by a scam.
• IDCARE (idcare.org) — Australia and New Zealand's free identity and cyber support service.
• Your state police or ReportCyber (cyber.gov.au) — if a crime has been committed.
• Australian Financial Complaints Authority (AFCA) — for complaints about banks, insurers, and other financial firms.
• State privacy regulators — if the issue involves a state or territory government agency.

Take Back Control With Lunyb

Lodging an OAIC complaint is your right, and you should use it when an organisation has mishandled your information. But the real win is making sure you are the first to know, with evidence in hand, so you can act decisively. That is exactly what Lunyb is built for.

Head to lunyb.com and take our free privacy quiz to see where you are exposed right now. Then install the Lunyb app from the App Store or Google Play to turn on Data Breach Alerts, Scam Shield, Privacy Check, and the encrypted vaults. Plans start from about $19.99/month, cancel anytime — no hostage pricing, no surprises.

If you found this useful, you may also like our honest look at whether Lunyb is legit and our deep dive on Rebrandly vs Lunyb for secure link shortening and QR codes.

Frequently Asked Questions

How long do I have to lodge an OAIC privacy complaint?

The OAIC generally expects complaints within 12 months of you becoming aware of the issue. Later complaints can still be accepted if there is a good reason for the delay, but acting promptly strengthens your case.

Does it cost anything to complain to the OAIC?

No. Lodging a privacy complaint with the OAIC is free. You do not need a lawyer, although you can engage one if the matter is complex or involves significant compensation.

Can I get compensation through an OAIC complaint?

Yes, in some cases. The Commissioner can order compensation for financial loss and non-economic loss such as distress, humiliation, or injury to feelings. Amounts vary widely based on severity and evidence.

What if the organisation is based overseas?

The Privacy Act can apply to overseas organisations that collect personal information from people in Australia. The OAIC can still accept a complaint, but enforcement may be harder. Lunyb's breach alerts help you document the exposure regardless of where the company sits.

Will Lunyb stop every breach from affecting me?

No tool can promise that — anyone who claims otherwise is not being honest. What Lunyb does is help you catch more risks earlier, protect what you still control (passwords, photos, app permissions, calls), and recover faster when something does go wrong. That is the difference between being a victim and being prepared.