OAIC Complaints: How to Report a Privacy Breach in Australia (2026)

If an Australian business or government agency has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). But before you lodge that complaint, you need evidence, timelines, and a clear picture of what was exposed — and that is exactly where Lunyb gives you an edge. Our privacy app surfaces data breach alerts tied to your email and phone, keeps a secure record of the scam messages and suspicious links you receive, and helps you lock down accounts fast so the damage stops while the regulator does its work.

This guide walks you through the full OAIC complaints process for a privacy breach, what the Privacy Act 1988 actually covers, how long it takes, and the practical steps we recommend taking on day one — including the Lunyb tools that make the whole thing easier.

What is an OAIC privacy complaint?

An OAIC privacy complaint is a formal request for the Australian Information Commissioner to investigate an alleged breach of the Privacy Act 1988 by an organisation covered by the Act. This includes most Australian Government agencies, private-sector organisations with an annual turnover above $3 million, health service providers of any size, credit providers, and some small businesses that trade in personal information.

You can complain if you believe an entity has mishandled your personal information — for example, by losing it in a data breach, disclosing it without consent, refusing to give you access to your own records, or failing to correct inaccurate information.

What the OAIC can and cannot do

• Can: Investigate, conciliate between you and the organisation, make determinations, order compensation, and require changes to privacy practices.
• Can: Accept Notifiable Data Breach (NDB) reports from organisations and track systemic issues.
• Cannot: Act as your personal lawyer, prosecute criminal scams (that is the police or the ACCC), or usually investigate matters older than 12 months without good reason.

When you should lodge an OAIC complaint

You should consider an OAIC complaint when an APP entity has handled your personal information in a way that breaches one of the 13 Australian Privacy Principles (APPs). Common triggers include:

1. You receive a data breach notification from a company (bank, telco, retailer, health provider) and you are not satisfied with their response.
2. Your personal information appears for sale on the dark web or in a known leak.
3. An organisation refuses to give you access to, or correct, your personal data.
4. A business uses your information for marketing after you opted out.
5. An agency discloses your details to a third party without a lawful basis.
6. You suspect an organisation collected more data than it reasonably needed.

Complain to the organisation first

The OAIC almost always requires you to raise the issue with the organisation directly before escalating. Give them 30 days to respond. If they ignore you, refuse to act, or give an unsatisfactory answer, you can then take it to the Commissioner.

How to lodge an OAIC complaint: step-by-step

Lodging a privacy complaint in Australia is free and can be done online. Here is the process we recommend walking through in order.

Step 1: Gather your evidence

Before you write anything, collect everything you have. The stronger your evidence pack, the faster the OAIC can assess your case.

• The breach notification email or letter from the organisation.
• Screenshots of suspicious messages, phishing texts, or scam calls you received after the breach.
• Bank or account alerts showing unauthorised activity.
• Copies of your correspondence with the organisation and their response (or a timeline showing they did not respond).
• A written summary of what personal information was involved — name, address, date of birth, Medicare, driver licence, passport, financial details, health info, etc.

Step 2: Complain to the organisation

Send a written complaint (email is fine) to the organisation's privacy officer. State clearly:

1. What happened and when.
2. Which of your personal information was affected.
3. What harm or risk you have experienced.
4. What you want them to do (delete data, compensate, apologise, improve security).
5. A deadline — 30 days is standard.

Step 3: Lodge with the OAIC

If you are not satisfied, go to the OAIC website and use the online privacy complaint form. You will need to provide your contact details, the organisation's details, a description of the issue, copies of your evidence, and the outcome you are seeking. You can also submit by email, post, or fax, and translation and accessibility support are available.

Step 4: Assessment and conciliation

The OAIC will acknowledge your complaint, check it falls within jurisdiction, and usually attempt conciliation — a structured negotiation between you and the organisation. Many complaints resolve at this stage with an apology, improved practices, or compensation.

Step 5: Investigation and determination

If conciliation fails, the Commissioner may formally investigate. Outcomes can include a determination that the APPs were breached, an order to pay compensation, and public reporting. Determinations are enforceable in the Federal Court.

How long does an OAIC complaint take?

Timelines vary significantly. Simple matters resolved through conciliation can take a few months. Complex investigations, especially those linked to large notifiable data breaches, can take a year or more. The OAIC publishes service standards but does not guarantee a fixed timeframe.

While you wait, your exposed data does not sit still. Scammers test credentials within hours, phishing campaigns start within days, and identity fraud attempts can surface months later. That is why we strongly recommend running Lunyb in parallel with any OAIC complaint — so you are monitoring and defending yourself while the regulatory process plays out.

How Lunyb helps you handle a privacy breach in Australia

Lunyb is an Australian-friendly privacy and scam-protection app built for exactly this situation: you have been caught up in a breach, you are lodging an OAIC complaint, and you need to stop the bleeding now. Here is what you get in one subscription.

Data Breach Alerts for your email and phone

Add your email addresses and mobile numbers to Lunyb and we continuously check them against known breach datasets. When your details show up in a new leak, we tell you which breach, what data classes were exposed, and what to do next. That notification is powerful evidence to attach to your OAIC complaint — a clear timeline of when your data appeared in the wild.

Scam Checker for suspicious messages and links

After a breach, you will almost certainly get targeted phishing SMS and emails pretending to be your bank, Australia Post, myGov, or the ATO. Paste anything suspicious into Lunyb's Scam Checker and we assess the link, the sender pattern, and the message for scam signals before you click. Every flagged message is one less way the breach can hurt you — and a screenshot for your evidence pack.

Scam Shield and caller protection

Leaked phone numbers get hammered with scam calls. Lunyb's Scam Shield helps identify and screen suspicious callers so you are not fielding fake “bank fraud team” calls at dinner time.

Privacy Check for your phone's apps

Many Australians are shocked when they see how much data their everyday apps collect. Privacy Check reviews the permissions on your device, flags the apps asking for more than they need, and walks you through tightening them up. Fewer permissions means less future breach exposure.

Encrypted Password and Photo Vault

After a breach, you need to rotate passwords fast and store sensitive documents (new ID photos, breach letters, correspondence with the OAIC) somewhere safer than your camera roll. Lunyb's encrypted vault handles both.

On-device tracker and threat blocking

Our local DNS shield blocks known tracker and malicious domains at the network level on your device, without routing your traffic through a third-party tunnel. That means fewer trackers profiling you and fewer chances for a malicious link to load its payload.

Browsing-history eraser and Security Score

Clean up what you have already left behind and get a single score that tells you how exposed you are right now — then follow the prompts to improve it week by week.

Family location sharing and Photo Guard

If the breach has you worried about family safety (address leaks are common), Lunyb's family location sharing keeps loved ones in the loop on your terms. Photo Guard's reverse-image check helps you see where your photos might already be circulating online.

Lunyb vs doing it all manually

You can respond to a breach by hand. We just do not recommend it — you will miss things, and the follow-up scam wave will reach you before you finish.

Task after a breach	Doing it manually	With Lunyb
Know when your email/phone appears in a new leak	Check multiple sites manually, hope you remember	Automatic Data Breach Alerts
Check if a text or link is a scam	Guess, Google the URL, risk clicking	Paste into Scam Checker for an instant read
Block scam callers	Block numbers one by one	Scam Shield screens known patterns
Audit app permissions	Dig through phone settings app by app	Privacy Check gives a guided review
Store breach evidence securely	Email folders and camera roll	Encrypted Password & Photo Vault
Reduce ongoing tracker exposure	Install multiple browser extensions	On-device DNS shield built in

What to include in your OAIC complaint letter

A strong complaint is concise, chronological, and specific. We recommend structuring it like this:

1. Your details — name and preferred contact method.
2. The organisation — legal name, division, privacy officer contact if known.
3. Timeline — a dated list of what happened, from the breach or incident to your attempts to resolve it.
4. The personal information involved — be specific (e.g. “full name, date of birth, Medicare number, driver licence number”).
5. The APP(s) you believe were breached — the OAIC form helps with this, but even a plain-English description works.
6. Harm suffered — financial loss, scam attempts, identity fraud, stress, time spent remediating.
7. What you are asking for — compensation amount, deletion of data, apology, changes to practices.
8. Evidence — attach everything from Step 1.

Other Australian channels you may need

The OAIC is the right place for a privacy complaint, but a breach often triggers issues that belong elsewhere too.

• Scamwatch (ACCC) — report scam contact and losses.
• IDCARE — free identity and cyber support service for Australians and New Zealanders.
• Australian Cyber Security Centre (ACSC / ReportCyber) — report cybercrime.
• Your bank — immediately, if any financial data was exposed.
• Credit reporting bodies — place a free credit ban with Equifax, Experian, and illion.
• State police — if you are a victim of identity theft or fraud.

Protect yourself today — start with Lunyb

Lodging an OAIC complaint is the right move when an organisation has let you down, but it is a slow process. The fastest thing you can do right now is cut off the scammers who already have your details. Head to lunyb.com and take the free privacy quiz to see where you stand, then download the Lunyb app from the App Store or Google Play to turn on Data Breach Alerts, Scam Checker, and Scam Shield in minutes.

Plans start from about $19.99/month and renew until cancelled — and you can cancel anytime online, no phone calls, no hoops. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. That is the kind of control we think every Australian deserves after a breach.

If you are also sharing links to evidence with lawyers, insurers, or the OAIC itself, our secure URL shortener and QR platform keeps those links tidy and trackable. Curious how it stacks up against other tools? See our honest review of the Lunyb URL shortener and our Rebrandly comparison.

Frequently asked questions

Is it free to lodge an OAIC privacy complaint?

Yes. Making a privacy complaint to the OAIC is free. You do not need a lawyer, though you can get legal advice if you want to. Translation, interpreter, and accessibility services are available at no cost.

How long do I have to lodge a complaint?

The OAIC generally expects complaints to be made within 12 months of you becoming aware of the issue. Older matters can still be accepted in some circumstances, but you should act as soon as possible.

Can I get compensation through the OAIC?

Yes. The Commissioner can order organisations to pay compensation for economic and non-economic loss, including distress, caused by a breach of the Privacy Act. Amounts depend on the facts of your case.

Does Lunyb replace an OAIC complaint?

No — and it is not meant to. Lunyb is your personal defence layer: breach monitoring, scam checking, caller protection, and a secure vault for your evidence. The OAIC is the regulator that can force an organisation to change its behaviour. Use both together.

What if the company that leaked my data is overseas?

The Privacy Act can apply to overseas organisations that carry on business in Australia and collect or hold Australian personal information. The OAIC can assess whether they fall within jurisdiction. Regardless, turning on Lunyb's Data Breach Alerts and Scam Checker helps you defend yourself while jurisdiction is sorted out.

Ready to take back control? Start with the free privacy quiz at lunyb.com or download Lunyb from the App Store or Google Play today.