OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If an Australian organisation or government agency has mishandled your personal information, you have the right to complain. The Office of the Australian Information Commissioner (OAIC) is the national regulator responsible for investigating privacy breaches under the Privacy Act 1988. This guide walks you through exactly how to lodge an OAIC complaint, what evidence you need, how long it takes and what outcomes you can realistically expect.

What Is the OAIC and When Can You Complain?

The OAIC is Australia's independent privacy and freedom of information regulator. It handles complaints about how Australian Government agencies and private sector organisations with an annual turnover of more than $3 million (plus some smaller businesses such as health service providers) manage personal information.

You can lodge a privacy complaint with the OAIC when you believe an entity covered by the Privacy Act has breached the Australian Privacy Principles (APPs), a registered APP code, or the credit reporting rules. Common examples include:

• Unauthorised disclosure of your personal information to a third party.
• A data breach that exposed your name, address, Medicare number or financial details.
• Refusal to give you access to your own personal information or correct inaccuracies.
• Collecting sensitive data (health, biometric, political views) without consent.
• Direct marketing after you have opted out.
• Credit reporting errors that damage your credit file.

Before You Complain: Contact the Organisation First

The OAIC generally will not accept a complaint until you have given the organisation a chance to fix the problem. This is called the "first contact" requirement and it resolves most disputes quickly without regulator involvement.

Step-by-Step: Raising a Complaint Directly

1. Find the privacy officer. Every APP entity must publish a privacy policy with contact details. Look for "Privacy Officer", "Data Protection Officer" or a dedicated privacy email such as privacy@company.com.au.
2. Put it in writing. Email is best because it creates a timestamped record. Explain what happened, when, what information was involved and what you want them to do.
3. Set a response deadline. The OAIC expects organisations to respond within 30 days. State this clearly in your complaint.
4. Keep every reply. Save emails, letters and file notes of phone calls (date, time, who you spoke to, what was said).
5. Escalate if needed. If you receive no response after 30 days, or the response is inadequate, you can take the matter to the OAIC.

How to Lodge an OAIC Complaint: The Full Process

Lodging a complaint with the OAIC is free. You can do it online, by post, by email or over the phone with the National Information Communications Centre.

1. Gather Your Evidence

Strong complaints are built on documentation. Collect the following before you start the form:

• Your correspondence with the organisation (emails, letters, chat logs).
• The organisation's privacy policy and any collection notice you received.
• Copies of the personal information that was mishandled, where possible.
• Dates, times and names of staff you dealt with.
• Evidence of any harm – financial loss, identity theft notifications, medical records showing stress, or screenshots of leaked data.

2. Complete the Online Complaint Form

The OAIC's preferred channel is the online Privacy Complaint Form at oaic.gov.au. You will be asked to provide:

• Your name and contact details (anonymous complaints are generally not investigated, but confidentiality can be requested).
• The name of the organisation or agency involved.
• A detailed description of what happened.
• What steps you have already taken.
• The outcome you are seeking (apology, correction, compensation, policy change).

3. Alternative Lodgement Methods

• Email: enquiries@oaic.gov.au with "Privacy Complaint" in the subject line.
• Post: GPO Box 5288, Sydney NSW 2001.
• Phone: 1300 363 992 (interpreter and National Relay Service available).

What Happens After You Lodge a Complaint?

The OAIC follows a staged process. Understanding each stage helps you set realistic expectations about timing and outcomes.

Stage	Typical Timeframe	What Happens
Acknowledgement	Within 10 business days	OAIC confirms receipt and assigns a reference number.
Preliminary assessment	1–3 months	Case officer checks jurisdiction and whether you contacted the organisation first.
Conciliation	3–9 months	OAIC facilitates a resolution between you and the respondent.
Formal investigation	9–18 months	Used for serious or systemic breaches. Can result in a determination.
Determination	12–24 months total	Legally enforceable decision by the Information Commissioner.

Possible Outcomes

Under section 52 of the Privacy Act, the Commissioner can order a range of remedies, including:

• A written apology from the organisation.
• Correction or deletion of inaccurate records.
• Changes to the respondent's privacy practices and staff training.
• Compensation for financial loss and "injury to feelings" (typically $3,000–$20,000, with some determinations exceeding $50,000 for serious cases).
• Public declarations that the conduct was in breach of the Act.

Notifiable Data Breaches: A Separate but Related Scheme

If you have been notified by an organisation that your data was involved in a breach, that notice was likely issued under the Notifiable Data Breaches (NDB) scheme. Under the NDB scheme, entities must notify both the OAIC and affected individuals when a breach is likely to result in serious harm.

Receiving an NDB notice does not automatically mean the organisation acted improperly – breaches can happen despite reasonable security. However, you can still lodge an OAIC complaint if you believe the entity:

• Failed to take reasonable steps to protect your data (APP 11).
• Notified you too late or with insufficient detail.
• Has not offered appropriate remediation such as credit monitoring.

Protecting Yourself While the Complaint Is Underway

OAIC investigations can take many months. In the meantime, take practical steps to limit further harm:

1. Change compromised passwords and enable multi-factor authentication on email, banking and social accounts.
2. Place a credit ban with Equifax, illion and Experian – free for 21 days and extendable if you have evidence of fraud.
3. Request a new Medicare, driver licence or passport number through the relevant agency if those identifiers were exposed. Most states now reimburse replacement fees for data breach victims.
4. Register with IDCARE (1800 595 160), Australia's free national identity and cyber support service.
5. Review what you share online. When you post links on social media, use a privacy-respecting link shortener such as Lunyb that does not sell click data or build advertising profiles on the people who follow your links.
6. Harden your browsing. Use encrypted DNS (such as 1.1.1.1 or Quad9), a tracker-blocking browser like Firefox or Brave, and review app permissions on your phone.

When the OAIC Can't Help: Alternative Avenues

The OAIC has discretion to decline complaints in certain situations. If your matter falls outside its jurisdiction, consider these alternatives:

Situation	Where to Go
Small business (under $3m turnover, not health)	State fair trading office or ACCC
State government agency (NSW, VIC, QLD etc.)	State Privacy Commissioner (e.g. IPC NSW, OVIC)
Telecommunications privacy	Telecommunications Industry Ombudsman (TIO)
Banking or insurance privacy	Australian Financial Complaints Authority (AFCA)
Workplace surveillance	Fair Work Ombudsman or state workplace surveillance laws
Image-based abuse / doxxing	eSafety Commissioner
Scams and identity theft	Scamwatch and IDCARE

Tips for a Successful OAIC Complaint

Case officers process thousands of complaints each year. These tips help yours stand out as credible and well-prepared:

• Be specific. Write a clear timeline: "On 3 March I submitted X. On 10 March they replied Y." Avoid emotional language where possible – facts carry more weight.
• Reference the APPs. If you can say "this appears to breach APP 6 (use and disclosure)", you demonstrate seriousness.
• Quantify harm. Keep receipts for replacement documents, time taken off work and any professional advice.
• Be reasonable about remedy. Asking for a written apology and $5,000 is far more likely to settle at conciliation than demanding $100,000.
• Respond promptly. If the OAIC requests more information, provide it within the deadline or your complaint may be closed.

Recent Trends in Australian Privacy Enforcement

Following reforms to the Privacy Act, maximum civil penalties for serious or repeated breaches have increased dramatically – up to $50 million, three times the benefit obtained, or 30% of adjusted turnover for companies. The OAIC has been more active in commencing Federal Court proceedings, particularly against entities involved in large data breaches.

For individuals, this means two things. First, your complaint contributes to a broader regulatory picture that can trigger investigations even if your personal matter settles. Second, you may increasingly see class action law firms contacting data breach victims to run representative complaints – you should get independent advice before signing up, as participating in a class action can affect your ability to pursue an individual OAIC complaint.

Frequently Asked Questions

How long do I have to lodge an OAIC complaint?

You should lodge a complaint within 12 months of becoming aware of the privacy breach. The OAIC has discretion to accept older complaints where there is a good reason for the delay, such as ongoing negotiations with the organisation, but timely complaints are more likely to proceed.

Does it cost anything to complain to the OAIC?

No. Lodging a privacy complaint is completely free. You do not need a lawyer, and the OAIC's role is impartial – it does not advocate for either side but facilitates resolution and, where necessary, makes binding determinations.

Can I get compensation for a privacy breach?

Yes. The Commissioner can order compensation for economic loss (money you actually lost) and non-economic loss (distress, humiliation, injury to feelings). Awards for individuals typically range from $3,000 to $20,000, though serious cases involving health information, identity theft or systemic breaches have attracted higher amounts.

Will the organisation know I complained?

Yes. The OAIC must share your complaint with the respondent so they can respond. You can request that certain sensitive details be withheld, but your identity will generally be disclosed. Retaliation for making a privacy complaint can itself be a breach of the Act.

What if the breach involved data shared through a link I posted?

If personal information was leaked through a link you created or shared – for example, a shortened URL exposed in a group chat that revealed a document – you may have obligations if you run a business, and rights as an individual. Going forward, use tools designed with privacy in mind. For example, Lunyb is a privacy-first URL shortener that avoids building click-tracking profiles, which is useful if you handle links containing sensitive context. For a broader look at link management options, see our Rebrandly review.

What if the OAIC decides not to investigate my complaint?

The Commissioner can decline a complaint under section 41 for reasons including: the respondent has adequately dealt with it, more than 12 months have passed, or the complaint is frivolous. You can ask for an internal review of the decision, and in some cases apply to the Administrative Review Tribunal (ART) for external review.

Final Thoughts

Reporting a privacy breach to the OAIC is one of the most effective ways Australians can hold organisations accountable for mishandling personal information. The process is free, reasonably accessible and can lead to real remedies – from corrections and apologies to meaningful compensation. The key is preparation: contact the organisation first, document everything, cite the relevant Australian Privacy Principles and set a realistic outcome. Combined with sensible personal security steps, an OAIC complaint can both resolve your individual grievance and push Australian privacy standards forward.