OAIC Complaints: How to Report a Privacy Breach in Australia (2026)

If an Australian business, government agency, or health provider mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). The process is free, done mostly online, and backed by the Privacy Act 1988. But before you lodge anything, you need to know what qualifies as a breach, the steps the OAIC expects you to take first, and how to document your case so the complaint is actually accepted.

This is a practical guide from the Lunyb editors. We will walk you through the entire OAIC complaints process, show you what to prepare, and explain how our privacy and scam-protection tools help you detect a breach in the first place and recover faster once you have reported it.

What is an OAIC privacy complaint?

An OAIC privacy complaint is a formal report you lodge with the Office of the Australian Information Commissioner when you believe an entity covered by the Privacy Act has mishandled your personal information. The OAIC investigates, mediates, and can make determinations that require the entity to apologise, change its practices, or pay compensation.

Covered entities generally include most Australian Government agencies, private-sector organisations with an annual turnover of more than $3 million, all private health service providers, credit reporting bodies, and some small businesses that trade in personal information. State and territory government agencies are usually handled by local privacy regulators instead.

What counts as a privacy breach under the Privacy Act

Under the 13 Australian Privacy Principles (APPs), a breach can include:

• Collecting personal information you did not consent to share
• Using or disclosing your data for a purpose you were not told about
• Failing to keep your information secure, leading to a leak or hack
• Refusing you reasonable access to your own data, or refusing to correct it
• Direct marketing without a clear opt-out
• Sending your data overseas without proper safeguards

Serious data breaches that are likely to cause harm must be reported by the entity itself under the Notifiable Data Breaches (NDB) scheme. If you received a breach notification letter from a company, that is often your first signal to consider a complaint.

Before you complain: the mandatory first step

The OAIC will almost always ask you to complain to the organisation first and give them 30 days to respond. Skipping this step is the most common reason complaints get sent back. Here is how to do it properly.

1. Find the right contact. Look for the entity's privacy officer or privacy policy page. The contact details are legally required to be published.
2. Put it in writing. Email is best. Keep a copy of everything you send and receive.
3. Describe the issue clearly. State what information was involved, what happened, when you found out, and what outcome you want (an apology, deletion, correction, compensation).
4. Give them a deadline. Tell them you expect a response within 30 days, as required by the OAIC process.
5. Keep evidence. Save breach notification emails, screenshots, account statements, and any suspicious messages you have received since the breach.

If the entity does not respond in 30 days, responds inadequately, or refuses to act, you can escalate to the OAIC.

How to lodge a complaint with the OAIC

You can lodge an OAIC complaint online, by post, by email, or by phone. The online form at oaic.gov.au is the fastest route and the one the OAIC prefers.

Step-by-step: lodging online

1. Go to the OAIC website and open the privacy complaint form.
2. Confirm the entity is covered by the Privacy Act. The form includes a checker.
3. Upload your evidence: the complaint you sent the organisation, their response (or proof you waited 30 days), breach notifications, and any other documents.
4. Describe the impact: financial loss, identity theft risk, stress, reputation damage, scam calls or texts you have received since.
5. State the resolution you want.
6. Submit and save the reference number.

What happens next

The OAIC will acknowledge your complaint and may try conciliation first, which is a structured mediation between you and the entity. If conciliation fails or the matter is serious, the Commissioner can formally investigate and issue a determination. Determinations are enforceable in the Federal Court.

Timelines vary. Simple matters can resolve in a few weeks through conciliation. Complex investigations can take 12 months or more. The OAIC will keep you updated throughout.

What makes a strong OAIC complaint

The complaints that move fastest are the ones that arrive organised. Here is what we recommend putting together before you hit submit.

How Lunyb helps you catch and prove a privacy breach

Most Australians never realise their data has been leaked until scam calls, phishing texts, or strange account activity start arriving. By then the trail is cold and the complaint is harder to make stick. Lunyb is built to flip that timeline, so you find out early, document the damage, and lock down the exposure before it gets worse.

Data Breach Alerts for your email and phone

Lunyb's Data Breach Alerts continuously check whether your email address or phone number has appeared in known breaches. When something new surfaces, we tell you which service was affected and what data was exposed. That notification becomes real evidence you can attach to an OAIC complaint and quote in your 30-day letter to the company.

Scam Checker and Scam Shield

A tell-tale sign of a breach is the flood of scam calls and texts that follow. Our Scam Checker lets you paste suspicious messages or links and get a verdict, while Scam Shield helps screen unwanted calls. Every message Lunyb flags is documented in your account, giving you a running log of harm that strengthens an OAIC claim about the real-world impact of a leak.

Privacy Check and Security Score

The Privacy Check reviews which apps on your phone have access to your contacts, location, microphone, camera, and storage, and the Security Score gives you a running measure of your overall exposure. If a company's app was over-collecting, that is often itself a breach of APP 3 (collecting only what is reasonably necessary), and Lunyb helps you spot it.

Encrypted Password and Photo Vault

After a breach, you need to rotate passwords quickly and store sensitive identity documents somewhere safer than your camera roll. Lunyb's encrypted Password Vault and Photo Vault keep credentials and ID scans locked down so a second incident does not chain off the first.

On-device tracker and threat blocking

Lunyb includes a local DNS shield that blocks trackers and known malicious domains at the network level on your device. It is not a cure-all, but it meaningfully reduces how much your data gets passed around to ad networks and data brokers, which lowers the odds of being caught in the next breach.

Photo Guard and browsing-history eraser

If your face or old photos are being misused, Photo Guard runs a reverse-image check so you can find where an image appears online. The browsing-history eraser clears local traces after you have been researching sensitive topics. Together, these tools give you tangible control over what the internet still knows about you.

Clear pricing, cancel anytime

Lunyb plans start from about $19.99/month and renew until you cancel, and you can cancel online any time. Optional Leak Protection is billed separately and can be paused without cancelling your main plan. No lock-in contracts, no mystery fees — just the tools you need, when you need them.

After the OAIC: lock down your identity

Lodging a complaint is only half the recovery. Whether or not the OAIC awards compensation, your data is already out there. These are the steps we recommend to every Australian who has been through a breach.

1. Change every password that reused the leaked one. Use Lunyb's Password Vault to generate and store unique ones.
2. Turn on two-factor authentication on email, banking, MyGov, and social accounts.
3. Place a ban on your credit file through Equifax, Experian, and illion. It is free and stops new accounts being opened in your name.
4. Watch for scam follow-ups. Breach victims are heavily targeted. Run anything suspicious through Lunyb's Scam Checker first.
5. Request deletion from the breached company under APP 11 once the investigation allows it.
6. Set up ongoing monitoring so you catch the next incident in days, not months. Lunyb's Data Breach Alerts do this automatically.

Common mistakes that get OAIC complaints rejected

We see the same errors repeatedly. Avoid these and your complaint will move faster.

• Skipping the 30-day step. The OAIC will send you back to the entity.
• Complaining about a state government agency. These are usually handled by state regulators like the NSW IPC or OVIC in Victoria.
• No evidence. A vague complaint without documents stalls immediately.
• Waiting too long. Complaints should generally be lodged within 12 months of becoming aware of the issue.
• Expecting large compensation automatically. Compensation is possible but usually modest; apologies and process changes are more common.

Start protecting yourself today

Reporting a breach to the OAIC matters. It holds organisations accountable and shapes how Australian privacy law evolves. But the real win is making sure the next breach does not blindside you.

Head to lunyb.com and take the free privacy quiz to see where your current exposure sits. From there you can download the Lunyb app on the App Store or Google Play and turn on Data Breach Alerts, Scam Shield, and the Privacy Check in minutes. If you want to see how we think about our own product transparency, our honest review of Lunyb walks through exactly what you get.

FAQ

Is lodging an OAIC privacy complaint free?

Yes. The OAIC does not charge to lodge or investigate a privacy complaint. You can submit online, by post, email, or phone without any fee.

How long do I have to lodge an OAIC complaint?

The OAIC generally expects complaints within 12 months of you becoming aware of the breach. Older matters can still be considered but you will need to explain the delay.

Can I get compensation through the OAIC?

Sometimes. The Commissioner can order financial compensation for loss or damage, including for stress and inconvenience, but amounts are usually modest. Apologies, data deletion, and process changes are more common outcomes.

What if the breach was by a state government agency?

State and territory agencies are usually not covered by the federal Privacy Act. Contact your state regulator instead — for example, the IPC in New South Wales, OVIC in Victoria, or OIC in Queensland.

How does Lunyb help after a data breach?

Lunyb monitors your email and phone against known breaches, flags scam calls and texts that follow a leak, stores new passwords in an encrypted vault, and blocks trackers at the device level. Together these tools help you detect breaches early, document the harm for your complaint, and reduce future exposure. Start at lunyb.com.