OAIC Complaints: How to Report a Privacy Breach in Australia (2026)

If your personal information has been mishandled, leaked, or misused by an Australian business or federal agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). This guide walks you through exactly how to lodge an OAIC privacy breach complaint, what to expect, and — just as importantly — how to stop the damage from spreading while you wait. That last part is where Lunyb does the heavy lifting: our app monitors your email and phone number for breach exposure, blocks tracker-heavy traffic on your device, and helps you lock down accounts before scammers get there first.

Why OAIC Complaints Matter (and Why Speed Is Everything)

An OAIC complaint is a formal way to hold an organisation accountable under the Privacy Act 1988 when it mishandles your personal information. The OAIC can investigate, require the entity to change its practices, and in some cases secure compensation for the people affected.

But here is the catch: the regulator process takes weeks or months. Scammers who buy breached data move in days. That is why the smartest approach is two-track — file your OAIC complaint for accountability, and simultaneously use a tool like Lunyb to detect where your data has already surfaced and shut down the risk at the account level.

What the OAIC Can and Cannot Do

• Can investigate most Australian Government agencies and private sector organisations with turnover above the small business threshold.
• Can handle complaints about credit reporting, tax file numbers, and health information.
• Can conciliate between you and the organisation to resolve the issue.
• Cannot usually deal with state or territory government bodies — those go to state privacy regulators.
• Cannot act as a criminal enforcement body — scams and fraud still need to go to Scamwatch or police.

What Counts as a Privacy Breach Under Australian Law

A privacy breach happens when personal information is accessed, used, or disclosed in a way that breaches the Australian Privacy Principles (APPs). This includes data breaches (a hacker gets in), but also everyday mishandling (a staff member emails your file to the wrong person, a company keeps data longer than needed, or marketing uses your details without consent).

Common Examples That Lead to OAIC Complaints

• A company suffered a cyber incident and your name, email, address, or ID documents were exposed.
• An organisation refuses to give you access to the personal information it holds on you.
• A business uses your data for marketing you never agreed to.
• A health provider shared your record with someone you did not authorise.
• A credit reporter has incorrect information on your file and will not fix it.
• Your tax file number was handled improperly.

Step 1: Complain to the Organisation First

The OAIC almost always requires you to raise the issue directly with the organisation before escalating. This is non-negotiable in most cases, so do not skip it.

1. Find their privacy officer. Every covered entity must publish a privacy policy with contact details.
2. Put it in writing. Email is best — it creates a timestamped record.
3. Be specific. Describe the breach, the date you noticed it, the information involved, and the outcome you want (deletion, correction, apology, compensation, process change).
4. Give them 30 days. This is the standard window the OAIC expects before they will accept a complaint.
5. Keep every reply. Save emails, letters, and notes from any phone calls (time, date, name of staff member).

Step 2: Lodge Your OAIC Complaint

If 30 days pass with no response, or the response is inadequate, you can escalate to the OAIC. You have options for how to lodge.

How to Submit

• Online form: the Privacy Complaint Form on oaic.gov.au is the fastest route.
• Email: send a written complaint to enquiries@oaic.gov.au.
• Post: mail to GPO Box 5288, Sydney NSW 2001.
• Phone: 1300 363 992 if you need help getting started or have accessibility requirements.

What to Include in Your Complaint

1. Your full name and contact details.
2. The name of the organisation or agency involved.
3. A clear timeline: when the breach happened, when you found out, when you contacted the organisation.
4. A description of what personal information was affected.
5. Copies of all correspondence with the organisation.
6. The outcome you are seeking.
7. Any evidence of harm — financial loss, scam messages received, emotional distress, time spent fixing accounts.

Step 3: What Happens After You Lodge

The OAIC follows a structured process. Knowing the stages helps you set expectations and keep records at each step.

Stage	What Happens	Typical Timeframe
Acknowledgement	OAIC confirms receipt and assigns a case number.	Within a few weeks
Preliminary assessment	They check jurisdiction and whether you tried the organisation first.	Weeks
Conciliation	OAIC facilitates a resolution between you and the entity.	Several months
Investigation	If conciliation fails, formal investigation may begin.	Months to over a year
Determination	Commissioner may issue binding orders, including compensation.	Case by case

Protect Yourself Right Now With Lunyb

Here is the reality the OAIC process does not fix: once your data is out, it is out. Criminals do not wait for a regulator's determination — they are already running credential-stuffing attacks, phishing your email, and spoofing your phone number. This is exactly the gap Lunyb was built to close for Australian users.

Lunyb is a phone privacy and scam-protection app that gives you an always-on defensive layer while the slow regulatory wheels turn. Instead of manually checking haveibeenpwned every week, trawling through app permissions, and guessing whether a text is a scam, you get everything in one place.

How Lunyb Helps After a Breach

• Data Breach Alerts monitor your email and phone number continuously, so you find out the moment your details appear in a new leak — often before the breached company tells you.
• Scam Checker lets you paste any suspicious text, link, or email and get a verdict in seconds. Post-breach, scammers aggressively target leaked contacts; this is your filter.
• Scam Shield helps block known scam callers before your phone even rings.
• Privacy Check audits the apps on your phone and flags ones quietly harvesting your location, contacts, or microphone.
• On-device tracker and threat blocking uses a local DNS shield to cut off ad networks and trackers at the network layer, so less of your behaviour leaks out in the first place.
• Encrypted Password & Photo Vault keeps the credentials you rotate after a breach (and sensitive ID photos you had to re-upload) locked down on-device.
• Photo Guard reverse-image check helps you see where your pictures may have been reposted — useful when image data is part of the breach.
• Security Score gives you a single number that rises as you fix issues, so you actually know whether you are safer this week than last.

Why This Beats the DIY Approach

You could do most of this manually — check leak databases, read every app permission screen, Google every unknown number, set up a separate password manager, install multiple blockers. Most people start, then stop. Lunyb consolidates the whole workflow so the protection actually stays on. Plans start from about $19.99/month, renew until you cancel, and you can cancel anytime online. Optional Leak Protection is billed separately and can be paused without cancelling your main plan — no lock-in games.

Other Australian Bodies You May Also Need

The OAIC is the right regulator for most privacy breaches, but some situations need parallel action. File with more than one body if the situation calls for it — they cover different ground.

Body	When to Contact Them
Scamwatch (ACCC)	You received scam messages or lost money after a breach.
ReportCyber	Suspected cybercrime, identity theft, or online fraud.
IDCARE	Free national identity and cyber support service for victims.
Your bank	Any financial information was exposed — ask for account monitoring.
State privacy regulator	Breach involved a state or territory government agency.
AFCA	Financial services complaint that is not resolved by the provider.

Practical Checklist: The First 72 Hours After a Breach

1. Change the password on the affected account and anywhere you reused it.
2. Turn on two-factor authentication — ideally with an authenticator app, not SMS.
3. Run a Lunyb Data Breach Alert scan on your email and phone number to see every exposure.
4. Alert your bank if any financial details were involved.
5. Place a credit ban with Equifax, Experian, and illion if ID documents leaked.
6. Document everything — screenshots, timestamps, emails. You will need these for the OAIC.
7. Write to the organisation formally within the first week.
8. Watch for scams — breached contacts get targeted fast. Run suspicious messages through Lunyb's Scam Checker before clicking anything.

Common Mistakes That Weaken an OAIC Complaint

• Skipping the organisation. The OAIC will send you back to square one.
• Vague complaints. "They did something wrong" is not enough — name the APP you believe was breached if you can.
• No evidence of harm. Even time and stress count, but you need to describe it.
• Missing paperwork. Keep every email, letter, and call note from day one.
• Waiting too long. The OAIC can decline complaints lodged more than 12 months after you became aware of the issue.

Start Protecting Yourself Today

An OAIC complaint is a powerful tool for accountability, but it is a slow one. The fast, personal protection — knowing what leaked, locking down your accounts, filtering out the scam wave that always follows a breach — is on you. Lunyb makes that part simple.

Head to lunyb.com and take the free privacy quiz to see where you stand. Then download the Lunyb app from the App Store or Google Play to turn on Data Breach Alerts, Scam Checker, and on-device threat blocking in minutes. File your OAIC complaint for justice — use Lunyb to stay safe while you wait.

FAQ

How long do I have to lodge an OAIC privacy complaint?

Generally within 12 months of becoming aware of the breach. The OAIC can decline complaints lodged later, so act promptly once you have given the organisation its 30-day window.

Does lodging an OAIC complaint cost anything?

No. Making a privacy complaint to the OAIC is free. You do not need a lawyer, though you can bring one if you choose.

Can I get compensation through an OAIC complaint?

Yes, in some cases. The Information Commissioner can make a determination that an entity pay compensation for financial loss or non-economic loss such as stress and humiliation. Outcomes depend on the evidence you provide.

What if the breach involved a small business?

Many small businesses with annual turnover under the threshold are exempt from the Privacy Act, which limits what the OAIC can do. You may still have options through state fair trading, Scamwatch, or civil action. Regardless, use Lunyb to lock down your accounts straight away.

How does Lunyb help after an Australian data breach specifically?

Lunyb monitors your email and phone for exposure in known breaches, flags scam calls and texts (which spike after Australian incidents), audits your app permissions, and blocks trackers at the device level. It will not remove data from criminal forums, but it helps you catch new risks fast and stop scammers from turning leaked data into losses.