OAIC Complaints: How to Report a Privacy Breach in Australia

If your personal information has been mishandled by an Australian government agency or business, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). This guide walks you through exactly how to report a privacy breach, what evidence you need, how long the process takes, and what outcomes you can realistically expect.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner (OAIC) is the independent national regulator responsible for enforcing the Privacy Act 1988 and the Australian Privacy Principles (APPs). It handles complaints about how organisations collect, store, use, and disclose personal information.

You can lodge an OAIC complaint if you believe an organisation has:

• Collected personal information unlawfully or without consent
• Used or disclosed your data for a purpose you did not agree to
• Failed to protect your information from unauthorised access or a data breach
• Refused to give you access to your own personal information
• Refused to correct inaccurate information
• Sent you direct marketing you cannot opt out of
• Mishandled your credit information, tax file number, or health records

Who the OAIC Can Investigate

The OAIC has jurisdiction over Australian Government agencies and most private sector organisations with an annual turnover of more than $3 million. It also covers smaller businesses in specific categories, including health service providers, credit reporting bodies, and businesses that trade in personal information.

The OAIC generally cannot investigate state or territory government agencies (those are handled by state privacy commissioners), small businesses outside the listed categories, or registered political parties.

Step 1: Complain Directly to the Organisation First

Before the OAIC will accept your complaint, you must give the organisation a chance to fix the problem. This is a mandatory step under section 40(1A) of the Privacy Act.

1. Identify the right contact. Most organisations have a Privacy Officer or Data Protection Officer listed in their privacy policy.
2. Put your complaint in writing. Email is best because it creates a timestamped record.
3. Describe the breach clearly. Include dates, what information was involved, and how you became aware of the issue.
4. State what you want. This might be an apology, deletion of your data, correction, compensation, or a change to their practices.
5. Give them 30 days to respond. This is the standard timeframe the OAIC expects before escalation.

If the organisation does not respond, refuses to engage, or gives you an unsatisfactory response, you can then take the matter to the OAIC.

Step 2: Gather Your Evidence

A well-documented complaint is far more likely to succeed. Before lodging with the OAIC, collect the following:

• Copies of all correspondence between you and the organisation
• Screenshots of relevant web pages, account settings, or marketing emails
• A timeline of events, from the initial incident to your most recent contact
• Any breach notification emails you received under the Notifiable Data Breaches scheme
• Evidence of harm such as fraudulent transactions, identity theft reports, or emotional distress
• Your original complaint to the organisation and their response (or proof they did not respond)

Protecting Yourself While You Investigate

While you gather evidence, take practical steps to limit further exposure. Change passwords on any affected accounts, enable two-factor authentication, and consider placing a ban on your credit file through Equifax, Experian, or illion. For links you share while discussing the breach publicly (for example on social media or forums), use a privacy-respecting URL shortener such as Lunyb so you do not expose personal referral data in the URLs you circulate.

Step 3: Lodge Your Complaint with the OAIC

The OAIC accepts complaints through several channels, but the online form is the fastest and most reliable.

Online

Visit oaic.gov.au and use the Privacy complaint form. You will need to create a brief account or lodge as a guest. The form takes most people 20 to 40 minutes to complete.

By Post or Email

You can also download a PDF complaint form and send it to:

Director of Dispute Resolution
Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Or email: enquiries@oaic.gov.au

By Phone

If you need help lodging a complaint or have accessibility needs, call the OAIC Enquiries Line on 1300 363 992. Interpreter services are available through TIS National on 131 450.

What to Include in Your OAIC Complaint

Your complaint should be clear, factual, and chronological. The OAIC assesses complaints partly on how well the issue is articulated.

Section	What to Include
Your details	Full name, contact details, preferred communication method
Organisation details	Legal name, ABN if known, Privacy Officer contact
Nature of complaint	Which Australian Privacy Principle you believe was breached
Timeline	Dates of the incident, your complaint, and their response
Impact	Financial loss, emotional distress, reputational harm
Desired outcome	Apology, compensation, policy change, data deletion
Evidence	Attach all supporting documents as PDFs or images

Step 4: What Happens After You Lodge

Once the OAIC receives your complaint, it moves through a structured assessment and resolution process.

1. Acknowledgement (within 7 days): You will receive confirmation that your complaint has been received, along with a reference number.
2. Preliminary assessment (2 to 8 weeks): An officer reviews whether the complaint falls within OAIC jurisdiction and whether you have given the organisation a reasonable chance to respond.
3. Conciliation (1 to 6 months): The OAIC acts as a neutral intermediary to help you and the organisation reach a resolution. Most complaints are resolved at this stage.
4. Investigation (6 to 18 months): If conciliation fails and the matter is serious, the Commissioner may launch a formal investigation under section 40 of the Privacy Act.
5. Determination: The Commissioner can make a legally binding determination, order compensation, require an apology, or direct the organisation to change its practices.

Realistic Timeframes

The OAIC publishes service standards showing that about 75% of complaints are closed within 12 months. Simple matters resolved through early conciliation can finish in 3 to 4 months. Complex investigations involving large breaches can take 2 years or longer.

Possible Outcomes of an OAIC Complaint

The OAIC has broad powers but tends to favour conciliated outcomes over formal determinations. Common results include:

• Written apology from the organisation
• Correction or deletion of your personal information
• Monetary compensation for financial loss or non-economic loss (hurt, humiliation, distress) — typically ranging from a few hundred dollars to tens of thousands, with the highest reported determinations exceeding $20,000 per individual
• Staff training or policy changes within the organisation
• Public determination naming the organisation (for serious or systemic breaches)
• Civil penalties against the organisation of up to $50 million per serious or repeated breach under the strengthened penalty regime

The Notifiable Data Breaches Scheme

Since February 2018, organisations covered by the Privacy Act must notify both the OAIC and affected individuals when an eligible data breach occurs. An eligible data breach is unauthorised access, disclosure, or loss of personal information that is likely to result in serious harm.

If you receive a data breach notification, keep it as evidence. You still have the right to complain if you believe the organisation failed to protect your information adequately, delayed notification, or did not take reasonable remediation steps.

What Counts as 'Serious Harm'

Serious harm includes identity theft, financial fraud, physical safety risk (such as from a stalker), significant emotional or psychological harm, reputational damage, and loss of employment or business opportunities.

Common Mistakes to Avoid

• Skipping the direct complaint step. The OAIC will send you back to the organisation if you have not given them a chance.
• Waiting too long. The OAIC generally expects complaints within 12 months of you becoming aware of the issue.
• Being emotional rather than factual. Stick to dates, facts, and documents. Keep the tone professional.
• Asking for unrealistic compensation. Six-figure demands without evidence of equivalent loss tend to stall conciliation.
• Forgetting to specify an outcome. The OAIC cannot help you if you have not thought about what resolution would satisfy you.

Alternatives and Complementary Actions

An OAIC complaint is not your only option. Depending on the breach, you might also consider:

• State privacy commissioners for complaints about state agencies (for example, the Information and Privacy Commission NSW or OVIC in Victoria)
• Industry ombudsmen such as the Telecommunications Industry Ombudsman or Australian Financial Complaints Authority
• ReportCyber (cyber.gov.au) for criminal cyber incidents
• IDCARE (idcare.org) for free identity and cyber support if your identity has been compromised
• Civil action in court for serious breaches, though this is expensive and rare

Protecting Your Privacy Going Forward

Lodging a complaint addresses past harm, but preventing the next breach matters just as much. Review the privacy policies of services you sign up to, minimise the personal information you share, use strong unique passwords with a password manager, enable multi-factor authentication, and prefer tools that collect as little data as possible. If link sharing is part of your workflow, choose a shortener that respects privacy and does not sell click data — our overview of the best URL shorteners for 2026 compares the privacy practices of the major providers.

Frequently Asked Questions

How much does it cost to lodge an OAIC complaint?

Nothing. The OAIC complaint process is free, and you do not need a lawyer. The regulator is designed to be accessible to any member of the public.

Can I complain anonymously?

You can raise concerns anonymously, but the OAIC generally cannot investigate a formal complaint without knowing who you are, because they need to verify the breach relates to your personal information and communicate the outcome to you. Your details are kept confidential from the public but will usually be shared with the respondent organisation.

What if the organisation is overseas?

The Privacy Act applies to overseas organisations that carry on business in Australia and collect or hold personal information in Australia. The OAIC can investigate international companies, though enforcement can be more complex. Recent amendments have strengthened extraterritorial reach, including for major global platforms.

Can I get compensation for stress and anxiety?

Yes. The Commissioner can award compensation for non-economic loss, including hurt feelings, humiliation, embarrassment, and psychological distress, even where there is no direct financial loss. Awards typically range from $500 to $10,000 for non-economic loss, with higher amounts in serious cases.

What if I'm not happy with the OAIC's decision?

If the Commissioner makes a formal determination, either party can apply to the Administrative Review Tribunal (ART, which replaced the AAT in 2024) for a merits review. If your complaint is closed without a determination and you disagree with the handling, you can request an internal review or complain to the Commonwealth Ombudsman about the OAIC's processes.

Final Thoughts

Reporting a privacy breach to the OAIC is one of the strongest consumer protections available to Australians, but it works best when you approach it methodically. Complain to the organisation first, document everything, lodge a clear and factual complaint, and be patient through the conciliation process. Even when individual outcomes are modest, every complaint contributes to the regulatory pressure that pushes Australian organisations to treat personal information with the care it deserves.