OAIC Complaints: How to Report a Privacy Breach in Australia

If an Australian organisation has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). Lodging a formal complaint can lead to apologies, compensation, policy changes and, in serious cases, regulatory enforcement. This guide walks you through exactly how the OAIC complaints process works, what qualifies as a privacy breach, and how to give yourself the best chance of a positive outcome.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner (OAIC) is the independent federal regulator responsible for enforcing the Privacy Act 1988 and the 13 Australian Privacy Principles (APPs). You can complain to the OAIC when an agency or organisation covered by the Privacy Act interferes with your personal information in a way that breaches the law.

The OAIC can investigate complaints against:

• Australian Government agencies (including Services Australia, the ATO and Home Affairs)
• Private sector organisations with an annual turnover of more than $3 million
• Smaller businesses in specific categories, such as health service providers, credit reporting bodies, TFN recipients and businesses that trade in personal information
• All private health service providers, regardless of size
• Credit providers and credit reporting bodies for consumer credit information

State and territory government agencies are generally not covered by the federal Privacy Act. For those, you need to contact the relevant state regulator (for example, the Information and Privacy Commission NSW or the Office of the Victorian Information Commissioner).

What Counts as a Privacy Breach?

A privacy breach, in OAIC terms, is any "interference with privacy" under the Privacy Act. Common examples include:

• An organisation collecting personal information you didn't agree to provide
• Using or disclosing your information for a purpose you didn't consent to (such as marketing)
• Failing to keep your data secure, resulting in a data breach or unauthorised access
• Refusing to give you access to the personal information they hold about you
• Refusing to correct inaccurate information
• Sending your personal data overseas without appropriate safeguards
• Mishandling your Tax File Number, Medicare details or health records

Before You Complain: The Mandatory First Step

The OAIC will almost always ask whether you have complained directly to the organisation first. In most cases, you must give the organisation 30 days to respond before the OAIC will accept your complaint. This is not optional — skipping it is the most common reason complaints get bounced back.

How to Complain to the Organisation

1. Find their privacy officer. Every APP-covered entity must publish a privacy policy with contact details. Look for "Privacy Officer", "Data Protection Officer" or a dedicated privacy email.
2. Put it in writing. Email is ideal because it creates a timestamped record. Clearly state that you are making a formal privacy complaint under the Privacy Act 1988.
3. Describe what happened. Include dates, the information involved, who you dealt with, and which APP you believe was breached (if you know).
4. State what you want. An apology, deletion of your data, compensation, a policy change — be specific.
5. Give them a deadline. 30 days is the legal benchmark. Note it explicitly in your email.
6. Keep every reply. Save all correspondence in a dedicated folder.

If the organisation ignores you, refuses to engage, or gives a response you find inadequate, you can then escalate to the OAIC.

How to Lodge an OAIC Complaint: Step by Step

Lodging a complaint with the OAIC is free and relatively straightforward. Here is the full process.

Step 1: Check Eligibility

Before starting, confirm:

• The entity is covered by the Privacy Act
• Your complaint relates to your own personal information (you generally cannot complain on behalf of someone else without authority)
• You have complained to the organisation and either received an unsatisfactory response or waited 30 days
• The incident happened within the last 12 months, or you have a good reason for the delay

Step 2: Gather Your Evidence

Strong complaints are built on documentation. Collect:

• A clear timeline of events
• Copies of all correspondence with the organisation
• Screenshots of websites, forms, emails or messages involved
• Any data breach notifications you received
• Evidence of harm — financial loss, emotional distress, scam attempts, identity theft indicators

Step 3: Submit the Complaint Form

Go to oaic.gov.au and use the online privacy complaint form. You can also download a PDF form, email enquiries@oaic.gov.au, or post it to GPO Box 5218, Sydney NSW 2001.

The form asks for:

1. Your contact details
2. The name and details of the organisation
3. A description of what happened and when
4. What steps you have already taken
5. The resolution you are seeking
6. Supporting documents (attach as PDFs or images)

Step 4: Acknowledgement and Assessment

The OAIC will acknowledge your complaint, usually within a few business days, and assign a case officer. They will assess whether:

• The complaint falls within their jurisdiction
• It has merit
• Conciliation is likely to resolve it

Step 5: Conciliation

The OAIC's preferred approach is conciliation — a facilitated negotiation between you and the organisation. Most complaints are resolved at this stage without formal investigation. Outcomes commonly include:

• A written apology
• Correction or deletion of your personal information
• Staff retraining or policy changes
• Financial compensation (typically ranging from a few hundred to several thousand dollars for non-economic loss, more for proven financial harm)

Step 6: Formal Investigation (If Needed)

If conciliation fails or the matter is serious, the Information Commissioner can open a formal investigation under section 40 of the Privacy Act. The Commissioner has powers to compel evidence, make determinations, award compensation, and issue binding orders.

Timeframes: What to Expect

Privacy complaints can take time. Realistic expectations:

Stage	Typical Timeframe
Acknowledgement	1–10 business days
Initial assessment	4–8 weeks
Conciliation	3–9 months
Formal investigation	12–24 months
Commissioner determination	Up to 2+ years total

The OAIC is chronically under-resourced, and backlogs have grown since the Optus and Medibank breaches drove record complaint volumes. Patience and clear, concise communication help your case move faster.

Notifiable Data Breaches: A Separate but Related Scheme

Since 2018, Australia has operated a Notifiable Data Breaches (NDB) scheme. If an APP entity suffers a data breach likely to result in serious harm, they must notify both the OAIC and affected individuals.

If you receive a data breach notification:

1. Read it carefully — note what information was exposed
2. Change passwords on any affected accounts, and anywhere you reused them
3. Enable multi-factor authentication wherever possible
4. Place a credit ban with Equifax, Experian and illion if financial or ID data was exposed
5. Watch for phishing attempts referencing the breach
6. If the organisation's response was inadequate, lodge an OAIC complaint

You can also report concerns about an organisation's handling of a breach — not just about your personal data — using the OAIC's data breach reporting channel.

Strengthening Your Complaint: Practical Tips

Be Specific About the APP Breached

If you can point to a particular Australian Privacy Principle, your complaint carries more weight. Common ones include:

• APP 1 – Open and transparent management of personal information
• APP 3 – Collection of solicited personal information
• APP 6 – Use or disclosure of personal information
• APP 11 – Security of personal information
• APP 12 – Access to personal information
• APP 13 – Correction of personal information

Quantify the Harm

Compensation claims succeed when you can show real impact: stress, anxiety, lost time, financial loss, reputational damage, or increased risk of identity theft. Keep a journal, medical records, bank statements and scam call logs where relevant.

Stay Professional

Emotional language weakens complaints. Stick to facts, dates and documents. Avoid accusations of malice unless you can prove them.

Protecting Your Privacy Going Forward

Lodging a complaint addresses what has already happened. Preventing the next breach is equally important. A few baseline habits make an enormous difference:

• Minimise what you share. Only provide personal information when it's genuinely required. If a form asks for your date of birth or address and doesn't need it, leave it blank or query it.
• Use unique passwords and a password manager. This limits damage when one service is breached.
• Enable multi-factor authentication everywhere it's offered, ideally using an authenticator app rather than SMS.
• Be cautious with shortened links. Many scams and phishing campaigns hide behind generic shorteners. If you share links yourself — in marketing, QR codes or social posts — use a reputable, privacy-respecting shortener like Lunyb that doesn't exploit click data or sell user information. For a broader comparison, see our 2026 buyer's guide to URL shorteners.
• Review app permissions on your phone every few months and revoke anything unnecessary.
• Use encrypted DNS (such as DNS-over-HTTPS) to reduce how much your network provider can see about your browsing.
• Check what organisations hold about you. You have the right under APP 12 to request access to your personal information from any covered entity, usually free of charge.

When the OAIC Isn't the Right Path

Not every privacy problem belongs with the OAIC. Consider alternatives when:

• Spam or telemarketing: Report to the Australian Communications and Media Authority (ACMA)
• Scams or fraud: Report to Scamwatch and your bank; serious cases to ReportCyber
• Credit reporting disputes: Try the credit reporting body first, then the Australian Financial Complaints Authority (AFCA)
• State government agencies: Contact your state privacy regulator
• Workplace surveillance: Often governed by state workplace surveillance laws, not the federal Privacy Act
• Defamation or harassment: These are separate legal matters requiring different advice

What Outcomes Can You Realistically Expect?

The OAIC is a conciliator first and an enforcer second. Most complainants receive:

• An apology and acknowledgement of fault
• Deletion or correction of their information
• Modest compensation for non-economic loss (commonly $1,000–$10,000, occasionally higher)
• Changes to the organisation's internal processes

Larger compensation and civil penalties generally require formal determinations or Federal Court action, which the Commissioner reserves for serious or systemic breaches. The 2022 Privacy Act amendments raised maximum penalties for serious or repeated breaches to the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover — meaning the OAIC now has real teeth for major incidents.

Frequently Asked Questions

How much does it cost to lodge an OAIC complaint?

Lodging a privacy complaint with the OAIC is completely free. You do not need a lawyer, although legal advice can help in complex cases or where significant compensation is being sought. Community legal centres and some consumer advocacy groups offer free guidance.

Can I complain on behalf of my child or elderly parent?

Yes, but you'll need to show authority to act. For children, parental responsibility is usually sufficient. For adults, you may need a power of attorney, guardianship order, or written authorisation from the person. The OAIC will ask for proof during intake.

What if the organisation is based overseas?

The Privacy Act applies to foreign organisations that have an "Australian link" — for example, they carry on business in Australia or collect personal information from people in Australia. Many global platforms (social networks, cloud services, retailers) fall within this scope, so an OAIC complaint is often still possible even against international companies.

Will my complaint be made public?

Individual complaints are confidential during conciliation. However, if the Commissioner makes a formal determination or issues a public enforcement outcome, your case may be referenced — usually without identifying you personally. Determinations are published on the OAIC website and the Austlii legal database.

Can I claim compensation for stress and anxiety alone?

Yes. The OAIC and Federal Court have repeatedly awarded compensation for non-economic loss, including hurt feelings, humiliation, anxiety and loss of control over personal information. You don't need to show financial loss, but you should be able to describe the emotional impact in a credible, specific way — ideally supported by medical evidence for larger claims.

What happens if I'm not satisfied with the OAIC's decision?

If the Commissioner declines to investigate or you disagree with a determination, you can seek review by the Administrative Review Tribunal (ART, which replaced the AAT in 2024) or, in some cases, apply to the Federal Court. Judicial review is complex, so legal advice is recommended before taking this step.

Final Thoughts

The OAIC complaints process is one of the most important consumer rights Australians have in the digital era. It costs nothing, it works, and it holds organisations accountable in ways that market forces alone cannot. The key is preparation: complain to the organisation first, document everything, be specific about what went wrong, and be patient with the process.

And while you're thinking about privacy, take ten minutes to audit your own habits — your passwords, the apps you've authorised, the links you share, and the services you rely on. A complaint fixes the past. Better digital hygiene protects your future.