OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If an organisation has mishandled your personal information, you have real power under Australian privacy law. The Office of the Australian Information Commissioner (OAIC) is the national regulator that investigates privacy breaches, and lodging a complaint is free. But filing a strong complaint takes evidence — and knowing your data was exposed in the first place takes monitoring.

That is where Lunyb comes in. Our privacy and scam-protection app is built to help Australians spot data breaches early, document what was leaked, and reduce the damage before it spreads. In this guide, we will walk you through the full OAIC complaint process and show you how to pair it with Lunyb so you are not just reacting — you are protecting yourself from the next breach too.

What an OAIC Privacy Complaint Is

An OAIC complaint is a formal request for the Australian Information Commissioner to investigate an alleged interference with your privacy under the Privacy Act 1988. It applies to most Australian Government agencies and to private sector organisations with an annual turnover above $3 million, plus certain smaller operators like health service providers and credit reporting bodies.

The OAIC can investigate, conciliate between you and the organisation, and in some cases make determinations that include compensation. For large-scale incidents, the OAIC also receives mandatory data breach notifications under the Notifiable Data Breaches (NDB) scheme.

When You Can Complain

• An organisation collected your personal information without consent or a lawful basis.
• Your data was used or disclosed in a way you did not agree to.
• An entity failed to keep your data secure and it was leaked, hacked, or exposed.
• You were refused access to or correction of your own personal information.
• You were contacted by direct marketing after opting out.

Before You Lodge: Complain to the Organisation First

The OAIC almost always requires you to raise the issue directly with the organisation first and give them 30 days to respond. Skipping this step is the most common reason complaints get sent back.

1. Identify the right contact. Look for a Privacy Officer, Data Protection Officer, or the privacy policy page of the organisation's website.
2. Put it in writing. Email is ideal because it creates a timestamped record.
3. Be specific. State what happened, when you became aware, what information was involved, and what outcome you want (deletion, correction, apology, compensation).
4. Set a deadline. Reference the 30-day window and keep every reply.

If they ignore you, respond inadequately, or 30 days pass with no resolution, you can escalate to the OAIC.

How to File an OAIC Complaint Step by Step

The OAIC offers an online privacy complaint form, plus options to submit by email, post, or phone. The online form is the fastest.

1. Go to oaic.gov.au and open the "Make a privacy complaint" page.
2. Confirm eligibility. The form will ask whether the Privacy Act applies and whether you have complained to the organisation first.
3. Describe the breach. Include dates, the organisation's name, what personal information was involved, and how you were affected.
4. Attach evidence. Upload screenshots, breach notification emails, your original complaint to the organisation, and their response (or proof they ignored you).
5. State your preferred outcome. This can be an apology, process changes, deletion of your data, or compensation for financial loss and distress.
6. Submit and save your reference number. The OAIC will acknowledge receipt, usually within a few business days.

What Happens After You Lodge

The OAIC assesses the complaint, may ask for more information, and typically tries to resolve matters through conciliation. If conciliation fails and the complaint has merit, the Commissioner can make a determination that is enforceable in the Federal Court.

The Evidence That Makes a Complaint Strong

A vague complaint tends to go nowhere. A documented one gets results. The OAIC wants a clear timeline and proof of harm or risk.

• Breach notifications you received from the organisation under the NDB scheme.
• Screenshots of exposed data, suspicious logins, or scam messages that followed the breach.
• Copies of correspondence with the organisation.
• Financial records if you were defrauded or had to pay for identity restoration.
• A log of scam calls, phishing SMS, or spoofed emails you received after the breach — these show real-world harm.

That last point is where most Australians struggle. Scam attempts pile up after a breach, but they are easy to dismiss and forget. You need a tool that catches and records them as they arrive.

Why Lunyb Is the Smart Companion to an OAIC Complaint

Filing a complaint is the regulatory side. Protecting yourself is the practical side — and that is Lunyb's job. We built Lunyb for exactly this moment: when your personal data has been exposed and you need to see the damage, stop the bleeding, and build an evidence trail.

Data Breach Alerts for Your Email and Phone

Lunyb's Data Breach Alerts monitor your email addresses and phone numbers against known breach datasets. When your details appear in a new leak, we tell you — what site, what data type, and when. That alert is often the first proof you need to attach to an OAIC complaint, because many Australians only learn about breaches months after the fact.

Scam Checker and Scam Shield

After a breach, your inbox and phone become targets. Our Scam Checker lets you paste suspicious messages or links to get a risk assessment before you click. Scam Shield helps screen suspicious callers. Every flagged message becomes evidence of the real harm a breach caused you — and that strengthens any claim for compensation or distress.

Privacy Check and Security Score

Our Privacy Check reviews the permissions your apps are quietly holding — contacts, microphone, location — so you can shut off the ones you never agreed to. The Security Score gives you a running dashboard of where your exposure sits, so you can show measurable improvement after a breach.

Encrypted Password and Photo Vault

If your credentials were part of the leak, rotating passwords is urgent. Lunyb's encrypted Password Vault stores new, unique passwords, and the Photo Vault locks away sensitive images (ID scans, Medicare cards, bank screenshots) so a future breach does not catch them in your camera roll.

On-Device Threat Blocking and Browsing-History Eraser

Our on-device tracker and threat blocking uses an encrypted DNS shield to cut off known malicious domains at the network level — before trackers and scam sites load. Combined with the browsing-history eraser, it reduces the trail of data that any future breach could expose.

Photo Guard and Family Location Sharing

Photo Guard reverse-image checks let you see where a photo of you has been reposted online, which is useful when a breach includes images. Family location sharing keeps household members connected on a platform you control, rather than leaving it to apps with weaker privacy postures.

None of this replaces the OAIC. It makes your complaint sharper and your day-to-day life safer. You can start with the free privacy quiz on lunyb.com to see where you stand.

OAIC vs Doing It All Yourself: A Clear Comparison

Timelines, Costs, and Outcomes to Expect

Lodging with the OAIC is free. There are no filing fees and you do not need a lawyer. Timelines vary based on complexity — simple matters can resolve in a few months through conciliation, while contested or large-scale breaches can take longer.

Possible Outcomes

• Conciliated agreement — the organisation apologises, deletes data, changes a process, or pays compensation.
• Determination — the Commissioner formally decides the complaint, which can include orders for compensation.
• Dismissal — if the complaint falls outside the Privacy Act or is deemed trivial.

Compensation, when awarded, can cover both financial loss and non-financial harm like anxiety and inconvenience. Documented scam attempts and emotional impact matter here — another reason to keep a clean evidence trail with Lunyb.

Common Mistakes That Weaken OAIC Complaints

1. Skipping the organisation. The OAIC will usually redirect you back to complain to them first.
2. Being vague. "They leaked my data" is not enough. Name the information, the date, and the impact.
3. No evidence of harm. Even if the breach is proven, compensation is easier to justify with documented consequences.
4. Missing the window. Complaints should generally be lodged within 12 months of becoming aware of the issue.
5. Giving up at conciliation. If the organisation offers a weak resolution, you can ask the OAIC to continue.

Protecting Yourself While the Complaint Runs

An OAIC investigation does not stop criminals from exploiting the leaked data. While your complaint moves through conciliation, treat your exposure as active.

• Enable multi-factor authentication on every important account.
• Rotate passwords for any service tied to the breached email.
• Request a credit ban from Australian credit bureaus if financial data was exposed.
• Watch for impersonation scams that reference your real details — this is where Lunyb's Scam Checker earns its keep.
• Use Lunyb's Data Breach Alerts to catch secondary leaks on resale markets.

Start With Lunyb Today

You cannot stop every organisation from mishandling data, but you can stop being the last person to know when they do. Lunyb puts breach alerts, scam protection, encrypted vaults, and on-device threat blocking in one app — so your OAIC complaint is backed by evidence and your daily life is actually safer.

• Take the free privacy quiz on lunyb.com to see your current exposure.
• Download the Lunyb app from the App Store or Google Play and turn on Data Breach Alerts.
• Plans start from about $19.99/month, renew until cancelled, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan.

If you also run a small business or community group and share links with customers, our privacy-first URL shortener and secure QR tools let you keep sharing safe and trackable without leaking data. For a comparison with other shorteners, see our Rebrandly review.

Frequently Asked Questions

How much does it cost to lodge an OAIC complaint?

Nothing. The OAIC does not charge fees, and you do not need a lawyer. You can submit online, by email, post, or phone.

How long do OAIC privacy complaints take?

It varies. Simple matters resolved through conciliation can take a few months. Complex investigations or formal determinations can take longer, especially where multiple parties or large data sets are involved.

Can I get compensation from an OAIC complaint?

Yes, in some cases. The Commissioner can order compensation for financial loss and for non-financial harm like stress and inconvenience. Strong documentation of the breach and its consequences — including scam attempts you received afterwards — helps your case.

Does Lunyb replace the OAIC process?

No. The OAIC is the regulator and the only path to a legal determination against an organisation. Lunyb is the practical layer — we help you detect breaches early, document scam attempts, lock down your accounts, and reduce future exposure. The two work together.

What if my complaint is about a small business?

Most businesses with turnover under $3 million are exempt from the Privacy Act, but there are exceptions — including health service providers, credit reporting bodies, and businesses that trade in personal information. Check the OAIC site or lodge anyway; they will tell you if it falls outside their remit.