OAIC Complaints: How to Report a Privacy Breach in Australia

If an Australian organisation has mishandled your personal information, you have a clear path to hold them accountable. The Office of the Australian Information Commissioner (OAIC) is the national regulator responsible for investigating privacy breaches under the Privacy Act 1988, and lodging a complaint is free, straightforward, and available to anyone whose data has been compromised.

This guide explains how to prepare and submit an OAIC complaint, what the regulator can (and can't) do, how long the process takes, and what remedies you may receive. Whether you've experienced a data breach, identity theft, or an unauthorised disclosure, understanding the OAIC process is the first step toward protecting your rights.

What Is the OAIC and When Can You Complain?

The OAIC is Australia's independent privacy regulator, empowered to investigate breaches of the Australian Privacy Principles (APPs) by government agencies and most private sector businesses with annual turnover above $3 million (plus some smaller businesses handling sensitive data).

You can lodge an OAIC complaint if you believe an entity covered by the Privacy Act has:

• Collected your personal information unlawfully or without proper notice
• Used or disclosed your data for a purpose you didn't consent to
• Failed to keep your information secure, resulting in a data breach
• Refused your request to access or correct your personal information
• Shared your data overseas without appropriate safeguards
• Sent unsolicited direct marketing without a clear opt-out

Who the OAIC Can Investigate

The OAIC's jurisdiction covers Commonwealth government agencies, private sector organisations with turnover above $3 million, health service providers of any size, credit reporting bodies, tax file number recipients, and businesses that trade in personal information. State government agencies are generally covered by state-based privacy commissioners instead.

Step 1: Complain Directly to the Organisation First

Before the OAIC will accept your complaint, you must usually give the organisation a chance to resolve the issue. This is a mandatory precondition under section 40(1A) of the Privacy Act, except in limited circumstances where direct contact would be unreasonable.

1. Identify the privacy officer. Most organisations list a privacy contact in their privacy policy. Look for a dedicated email like privacy@company.com.au.
2. Write a clear, dated complaint. Describe what happened, what personal information was involved, how you were affected, and what you want (an apology, correction, deletion, or compensation).
3. Set a deadline. Ask for a response within 30 days, which is the standard timeframe the OAIC expects.
4. Keep copies. Save your email, any postal receipts, and all replies. This paper trail becomes evidence if you escalate.

If the organisation doesn't respond within 30 days, provides an inadequate response, or refuses to acknowledge the problem, you can proceed to the OAIC.

Step 2: Gather Evidence Before Lodging Your Complaint

The strength of an OAIC complaint depends heavily on documentation. Regulators cannot investigate vague allegations, so take time to assemble a complete file before you submit.

Essential Evidence to Collect

• Notification of the breach — any email, letter, or news report that alerted you to the incident
• Your correspondence with the organisation — the original complaint, their reply, and any follow-ups
• Proof of the personal information involved — account screenshots, invoices, or membership records
• Evidence of harm — bank statements showing fraud, credit report alerts, medical records, or a log of scam calls received after the breach
• Timeline — a written chronology with dates of collection, breach, discovery, and complaint

Documenting Online Breaches

For digital incidents — leaked credentials, exposed databases, or malicious links — capture full-page screenshots with visible URLs and timestamps. If suspicious short links were used to phish you, record the original link before clicking any further. Tools that generate privacy-respecting short links, such as Lunyb, log click metadata that can help establish timelines if a legitimate link you created was later abused.

Step 3: Lodge the Complaint With the OAIC

Once you've exhausted the direct-complaint path and gathered evidence, you can submit your complaint to the OAIC through several channels.

How to Submit

1. Online form: The fastest method is the OAIC's secure online complaint form at oaic.gov.au. It guides you through each required field.
2. Post: Mail a completed privacy complaint form to GPO Box 5288, Sydney NSW 2001.
3. Email: Send a PDF of the form and attachments to enquiries@oaic.gov.au.
4. Phone: Call 1300 363 992 if you need help completing the form or require accessibility support.

What to Include

• Your full name and contact details
• The name of the organisation complained about
• A chronological summary of events
• Copies (not originals) of supporting documents
• The outcome you're seeking
• Consent for the OAIC to share your identity with the respondent (usually required for investigation)

Step 4: What Happens After You Lodge

The OAIC follows a structured process, though timelines vary based on complexity and caseload. Here's the typical pathway from lodgement to outcome.

Stage	Typical Timeframe	What Happens
Acknowledgement	1–2 weeks	OAIC confirms receipt and assigns a case reference.
Preliminary assessment	4–8 weeks	Case officer reviews whether the complaint falls within jurisdiction and has sufficient merit.
Conciliation	2–6 months	OAIC attempts to mediate between you and the respondent to reach a mutually acceptable outcome.
Formal investigation	6–18 months	If conciliation fails, the Commissioner may open a full investigation with compulsory information-gathering powers.
Determination	12–24 months total	The Commissioner issues a binding determination, including any compensation ordered.

Possible Outcomes

The OAIC can order a wide range of remedies, including:

• A written apology from the organisation
• Correction or deletion of your personal information
• Changes to the organisation's privacy practices
• Financial compensation for economic loss and non-economic loss (hurt feelings, anxiety)
• Civil penalties against the organisation in serious or repeated cases (up to $50 million for companies under current law)

Notifiable Data Breaches: A Separate but Related Scheme

Since February 2018, Australia has operated the Notifiable Data Breaches (NDB) scheme, which requires covered entities to report eligible data breaches to both affected individuals and the OAIC within 30 days of becoming aware of them.

An "eligible data breach" is one that's likely to result in serious harm to affected individuals and cannot be remediated in time. If you receive a data breach notification, you don't need to "complain" to trigger an investigation — the OAIC already knows. However, you can still lodge an individual complaint to pursue personal remedies like compensation.

Pros and Cons of Lodging an OAIC Complaint

Pros:

• Completely free — no filing fees or legal costs required
• Binding determinations can include financial compensation
• Conciliation process is informal and non-adversarial
• OAIC has strong investigation powers, including the ability to compel documents
• Creates public accountability through published decisions

Cons:

• Process can take 12–24 months or longer for complex matters
• Compensation amounts are typically modest (often $1,000–$20,000 for individuals)
• The OAIC may decline to investigate minor or out-of-scope complaints
• You must usually complain to the organisation first
• Appeals go to the Administrative Review Tribunal, adding further delay

Protecting Yourself While the Complaint Is Underway

Lodging a complaint doesn't restore stolen data or prevent further misuse. Take immediate protective steps alongside your complaint.

Practical Steps to Reduce Ongoing Risk

1. Change passwords for any affected accounts and enable two-factor authentication everywhere.
2. Place a credit ban with Equifax, Experian, and illion to prevent fraudulent credit applications (free for 21 days, renewable).
3. Monitor your myGov and ATO accounts weekly for unexpected activity.
4. Report identity theft to IDCARE (1800 595 160) for a personalised recovery plan.
5. Use encrypted DNS and a private browser to reduce the amount of behavioural data third parties can collect going forward.
6. Audit the links you share — if you run a business, use a reputable short-link service with analytics and malware screening rather than an unknown redirector. For a comparison of trustworthy options, see our 2026 URL shortener buyer's guide.

When to Escalate Beyond the OAIC

The OAIC is not the only avenue for redress. Depending on your circumstances, you may also:

• File a representative complaint if many people were affected by the same breach — this can lead to class-action style outcomes.
• Appeal to the Administrative Review Tribunal if you disagree with a Commissioner determination.
• Commence civil proceedings under the statutory tort of serious invasions of privacy (introduced in 2024) for egregious breaches.
• Report to the Australian Cyber Security Centre (cyber.gov.au) if the breach involved criminal hacking.
• Contact the Australian Competition and Consumer Commission if the breach involved misleading representations about privacy practices.

State and Territory Privacy Commissioners

If your complaint is about a state government agency, local council, or state-run health service, the OAIC may refer you to the relevant state regulator — such as the NSW Information and Privacy Commission, the Office of the Victorian Information Commissioner, or the Queensland Office of the Information Commissioner.

Common Mistakes That Weaken Privacy Complaints

Many complaints are dismissed or delayed because of avoidable errors. Watch out for these pitfalls:

• Skipping the direct complaint step — the OAIC will usually send you back to the organisation first.
• Missing the 12-month window — complaints should generally be lodged within 12 months of becoming aware of the breach.
• Providing originals instead of copies — never send original documents through the post.
• Emotional rather than factual framing — stick to what happened, when, and how you were harmed.
• Omitting the remedy you want — the OAIC needs to know what outcome you're seeking.

Frequently Asked Questions

How much compensation can I receive from an OAIC privacy complaint?

Compensation varies significantly. Determinations typically award between $1,000 and $20,000 for individual complaints, covering both economic loss (such as fraud losses or credit monitoring costs) and non-economic loss (distress, embarrassment, anxiety). High-profile matters involving sensitive health or financial data have occasionally resulted in larger awards. The OAIC assesses each case on its facts.

Is there a time limit for lodging an OAIC complaint?

The OAIC generally expects complaints to be lodged within 12 months of you becoming aware of the breach. Complaints lodged later may still be accepted if you can explain the delay, but the Commissioner has discretion to decline old complaints where evidence has degraded or the respondent's ability to respond has been prejudiced.

Do I need a lawyer to lodge an OAIC complaint?

No. The process is designed to be accessible without legal representation, and the OAIC's conciliation team will guide you through each stage. That said, if your complaint involves complex commercial losses, potential class-action elements, or a possible appeal to the Administrative Review Tribunal, obtaining advice from a privacy lawyer or community legal centre can be valuable.

Will my identity be disclosed to the organisation I'm complaining about?

Yes, in almost all cases. The OAIC needs to share your identity with the respondent so they can investigate and respond. If you have genuine safety concerns (for example, in domestic violence or stalking situations), tell the case officer — the OAIC can sometimes manage disclosure carefully or refer you to alternative pathways.

What's the difference between an OAIC complaint and reporting a data breach?

A data breach report under the Notifiable Data Breaches scheme is made by the organisation to the OAIC when they suffer an eligible breach — it's a regulatory notification, not a complaint. An OAIC complaint is made by you, the affected individual, seeking a personal remedy. Both can relate to the same incident, and lodging a complaint is often the only way to pursue compensation after you've been notified of a breach.

Final Thoughts

Lodging an OAIC complaint is one of the most powerful tools Australians have to enforce their privacy rights. The process is free, structured, and capable of producing real outcomes — from apologies and corrections to financial compensation and systemic changes in how organisations handle personal data. The key is preparation: complain to the organisation first, gather thorough evidence, document your harm clearly, and be specific about the remedy you want.

Privacy regulation in Australia continues to strengthen, with higher penalties, a statutory tort of serious invasions of privacy, and ongoing reforms to the Privacy Act. Knowing how to use the OAIC complaints process effectively puts you in a strong position whenever an organisation falls short of its obligations.