OAIC Complaints: How to Report a Privacy Breach in Australia (2026)

If your personal information has been mishandled by an Australian business or government agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). But most people only find out they have been breached weeks or months after the fact — and by then, the damage is already spreading. That is where Lunyb comes in: we help you spot exposures early, document what happened, and move quickly through the complaint process with evidence in hand.

This guide walks you through exactly how to file an OAIC complaint, what the regulator can and cannot do, and how to protect yourself while your case is being assessed. Start with a free privacy check at lunyb.com to see what is already exposed about you, then follow the steps below.

What the OAIC Does and When to Complain

The OAIC is Australia's national privacy regulator. It enforces the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs), and it accepts complaints from individuals who believe an organisation has mishandled their personal information.

When an OAIC complaint is appropriate

You can complain to the OAIC if a covered entity — most federal agencies, private sector organisations with turnover above $3 million, health service providers, credit providers, and some small businesses — has done something like:

• Collected your personal information without consent or a lawful basis.
• Used or disclosed your data for a purpose you did not agree to.
• Failed to keep your information secure, leading to a data breach.
• Refused to give you access to, or correct, your personal information.
• Sent unsolicited marketing after you asked them to stop.
• Mishandled your Tax File Number, health records, or credit information.

When to go elsewhere

Not every privacy problem is an OAIC matter. State government agencies in NSW, VIC, QLD, WA, NT and the ACT are generally covered by state privacy regulators. Scam losses go to Scamwatch and your bank. Telco complaints often go to the TIO first. If you are unsure, the OAIC's online enquiry form will redirect you.

Step 1: Complain to the Organisation First

The OAIC will almost always ask whether you have raised the issue directly with the organisation and given it 30 days to respond. Skipping this step is the number one reason complaints get bounced back.

1. Find the privacy officer. Every APP-covered entity must publish a privacy policy with contact details. Look for "Privacy Officer" or "Data Protection Officer".
2. Put it in writing. Email is best. State clearly what happened, when, what personal information was involved, and what you want them to do — delete the data, correct a record, apologise, pay compensation, or improve security.
3. Keep every reply. Save emails, letters, and reference numbers in one folder.
4. Give them 30 days. If they refuse, ignore you, or respond inadequately, you can escalate to the OAIC.

Step 2: Gather Your Evidence

A strong OAIC complaint reads like a short, factual case file. The regulator handles thousands of enquiries a year and gives priority to complaints that are clear, dated, and supported by documents.

What to collect

• A timeline of events with specific dates.
• The organisation's privacy policy at the time of the incident (take a screenshot).
• Copies of any emails, SMS, or letters between you and the organisation.
• Breach notifications you received (under the Notifiable Data Breaches scheme, organisations must tell you when serious breaches occur).
• Evidence of harm — bank statements showing fraud, phishing texts you received after the breach, stress or medical impact, time off work.
• Screenshots of your data appearing on other sites, forums, or data broker pages.

This is often the hardest part. Most people have no idea what has leaked, where it ended up, or which breach it came from. Lunyb's Data Breach Alerts and Scam Checker are built exactly for this — more on that below.

Step 3: Lodge the Complaint with the OAIC

Once you have waited 30 days (or the organisation has clearly refused to engage), you can lodge your complaint with the OAIC.

1. Go to the OAIC website (oaic.gov.au) and open the privacy complaint form.
2. Fill in your details and the respondent organisation.
3. Describe the complaint in plain language — what happened, which APP you believe was breached, what harm it caused.
4. Attach your evidence — correspondence, screenshots, breach notices, timeline.
5. State the outcome you want — an apology, correction, deletion, systemic change, or compensation.
6. Submit and save your reference number.

What happens next

The OAIC first assesses whether your complaint falls within its jurisdiction. It may try conciliation between you and the organisation. If conciliation fails and the matter is serious, the Commissioner can make a determination, order compensation, or direct the organisation to change its practices. Most matters are resolved informally; a smaller number go to formal determination.

How Lunyb Helps You Build a Stronger Complaint

Here is the practical problem with privacy complaints in Australia: the regulator can only act on what you can prove. If you do not know your email is in the Medibank, Optus, Latitude, or MyDeal breach set, you cannot cite it. If you do not know scam SMS traffic to your number spiked right after a breach, you cannot show harm. Lunyb closes that gap.

Data Breach Alerts — know what leaked and when

Add your email addresses and phone number to Lunyb and we continuously check them against known breach corpora. When your details appear in a new leak, you get an alert with the source and the type of data exposed. That becomes a dated piece of evidence you can attach to an OAIC complaint.

Scam Checker and Scam Shield — document the downstream harm

Breaches rarely stay quiet. Leaked phone numbers get hammered with impersonation calls and phishing SMS within weeks. Lunyb's Scam Checker lets you paste suspicious messages and links to see whether they are known scams, and Scam Shield helps filter unwanted calls. Every flagged message is evidence of the real-world impact the regulator will want to see.

Privacy Check and Security Score — show you took reasonable steps

When you ask for compensation or remediation, the OAIC looks at both the organisation's conduct and whether you mitigated harm. Lunyb's Privacy Check reviews app permissions on your phone, the encrypted Password and Photo Vault secures reused credentials, and the Security Score tracks your overall posture. That is a clear record that you acted responsibly after being breached.

Photo Guard, Browsing-History Eraser and on-device DNS shield

Photo Guard runs reverse-image checks so you can see where your pictures have been reposted. The browsing-history eraser clears local traces, and our on-device DNS shield blocks known tracker and scam domains at the network level before they load. None of this replaces the OAIC — it makes sure the next breach has less to grab.

Family location sharing and Leak Protection

If the breach affects your household (common with telco and health insurer incidents), family location sharing keeps everyone connected without broadcasting location data to third parties. Optional Leak Protection is billed separately and can be paused without cancelling your main plan.

Lunyb plans start from about $19.99/month and renew until cancelled. You can cancel anytime online — no phone call, no retention gauntlet. Start with the free privacy quiz at lunyb.com to see your exposure in a few minutes.

OAIC vs Other Avenues: Quick Comparison

Avenue	Best For	Possible Outcome
OAIC complaint	APP breaches by federal agencies, large businesses, health and credit providers	Conciliation, apology, correction, compensation, systemic change
State privacy regulator	State government agencies (NSW IPC, OVIC, OIC QLD, etc.)	Investigation under state privacy law
Scamwatch / ReportCyber	Scams, fraud, cybercrime	Intelligence sharing, referral to police
Australian Financial Complaints Authority	Bank and insurer disputes including fraud	Binding determination, refund
Telecommunications Industry Ombudsman	Telco privacy and billing issues	Resolution, credits, carrier obligations
Lunyb	Detecting breaches early, documenting harm, hardening your accounts and phone	Evidence, alerts, ongoing protection

How to Write the Complaint Itself

Keep the complaint short, structured, and specific. OAIC case officers read a lot of them. A good complaint has five parts.

1. Who you are complaining about — legal name of the organisation, ABN if known.
2. What happened — a dated timeline, two or three paragraphs maximum.
3. Which Australian Privacy Principles you believe were breached — APP 6 (use and disclosure), APP 11 (security), APP 12 (access), APP 13 (correction) are the most common.
4. What harm you suffered — financial loss, scam targeting, emotional distress, time spent remediating. Cite your Lunyb breach alerts and flagged scam messages here.
5. What outcome you want — apology, correction, deletion, a specific compensation amount, or a commitment to change practice.

Tip: do not threaten, exaggerate, or include everyone who has ever annoyed you. One organisation, one clear story, one clear ask. You can lodge separate complaints if more than one entity is involved.

After You Lodge: What to Expect

The OAIC will acknowledge your complaint, usually within a few weeks. A case officer may contact you for more detail, then contact the organisation. Many complaints resolve through conciliation — a structured negotiation where the organisation might offer an apology, a deletion, a process change, or compensation. If conciliation fails, the Commissioner can decline, investigate further, or in serious cases make a formal determination.

Timeframes

Straightforward matters can resolve in a few months. Complex ones, especially those tied to large breaches, can take much longer. Keep collecting evidence while you wait — new scam SMS, new breach alerts, new fraud attempts all strengthen your file.

While you wait, lock things down

• Change passwords on any account tied to the breached email, and store the new ones in Lunyb's encrypted vault.
• Turn on multi-factor authentication everywhere it is offered.
• Place a credit ban with Equifax, Experian, and illion if financial data was involved.
• Run Lunyb's Privacy Check on your phone to revoke risky app permissions.
• Use the Scam Checker before clicking any link or attachment that claims to be from the breached organisation — attackers often impersonate them for months afterwards.

Common Mistakes That Weaken an OAIC Complaint

• Skipping the organisation. You must usually give them 30 days first.
• No evidence. "I think they leaked my data" is not enough — show the breach notice or a Lunyb alert.
• Wrong regulator. State agency = state regulator. Scam = Scamwatch. Telco billing = TIO.
• Vague harm. "I feel violated" is real but weaker than "I received 47 scam texts in the three weeks after the breach, logged in my Lunyb Scam Checker history".
• Too many issues in one complaint. Split them.

Take the Next Step

Reporting a privacy breach to the OAIC is a powerful right, but it works best when you walk in prepared. Lunyb gives you the detection, documentation, and ongoing protection the process demands — without replacing the regulator or overpromising. We cannot guarantee we catch every breach the moment it happens, but we help you catch more of them earlier and recover faster.

Here is what to do right now:

1. Take the free privacy quiz at lunyb.com to see your current exposure.
2. Download the Lunyb app from the App Store or Google Play and run a Privacy Check on your phone.
3. Add your email and phone to Data Breach Alerts so new leaks are flagged automatically.
4. If you have a live privacy issue, follow the steps above and lodge your OAIC complaint with the evidence Lunyb helps you collect.

If you also run a small business or community group that shares links with customers, consider Lunyb's secure link shortener and QR tools — see our honest review of the privacy-first URL shortener and our Rebrandly comparison for how we stack up.

Frequently Asked Questions

How much does it cost to make an OAIC complaint?

Nothing. Lodging a privacy complaint with the OAIC is free. You do not need a lawyer, although you can use one for complex matters or if you are seeking significant compensation.

Can I get compensation through the OAIC?

Yes, in some cases. The Commissioner can order compensation for economic loss and for non-economic loss such as humiliation or distress. Amounts vary widely and most matters settle through conciliation rather than a formal determination.

What is the Notifiable Data Breaches scheme?

Under the NDB scheme, APP-covered organisations must notify affected individuals and the OAIC when a data breach is likely to result in serious harm. If you receive one of these notices, keep it — it is prime evidence for a complaint and for your Lunyb records.

How long do I have to lodge a complaint?

The OAIC can decline to investigate matters more than 12 months old, so do not sit on it. Start the 30-day process with the organisation as soon as you become aware, and lodge with the OAIC promptly if they do not resolve it.

Does Lunyb replace the OAIC or a lawyer?

No. Lunyb is a privacy and scam-protection app — we help you detect breaches, block scam messages, secure your phone and accounts, and document what happened. The OAIC is the regulator; a lawyer handles legal representation. We make both of them more effective by giving you better evidence and better defences.