OAIC Complaints: How to Report a Privacy Breach in Australia

If an Australian organisation has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). The OAIC is the national regulator responsible for enforcing the Privacy Act 1988 and the Australian Privacy Principles (APPs). This guide walks you through the full complaint process — from your first contact with the offending organisation to the OAIC's investigation and possible remedies.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner (OAIC) is the independent federal agency that oversees privacy and freedom of information in Australia. It investigates complaints about how Australian Government agencies and most private sector organisations with an annual turnover above AUD 3 million handle personal information.

You can lodge an OAIC complaint when you believe an organisation covered by the Privacy Act has breached your privacy rights. Common examples include:

• An organisation collecting personal information without a clear purpose or consent.
• Using or disclosing your data for purposes you did not agree to (such as unexpected direct marketing).
• Failing to keep your personal information secure, leading to a data breach.
• Refusing to give you access to, or correct, your personal information.
• Transferring your data overseas without appropriate safeguards.

Not every privacy annoyance is a breach of law. The OAIC generally cannot investigate complaints about small businesses under the AUD 3 million threshold (with some exceptions, like health service providers), state or territory government agencies, or individuals acting in a personal capacity. For those, state-based privacy regulators or the relevant ombudsman may be the right avenue.

Step 1: Complain Directly to the Organisation First

Before the OAIC will accept your complaint, you must first give the organisation a reasonable opportunity to respond. This is a mandatory step under section 40(1A) of the Privacy Act, and skipping it almost always results in your complaint being bounced back.

How to Submit an Internal Privacy Complaint

1. Locate the privacy officer. Most organisations publish a privacy policy that includes contact details for a Privacy Officer or Data Protection Officer. Check the footer of their website or the "Contact Us" page.
2. Put it in writing. Email is ideal because it creates a timestamped record. Clearly state that this is a formal privacy complaint under the Privacy Act 1988.
3. Describe the incident. Include dates, the personal information involved, how you believe it was mishandled, and which APPs you think have been breached (if you know).
4. Specify what you want. Options include an apology, deletion of your data, correction, compensation, or a change in the organisation's practices.
5. Set a deadline. The OAIC expects organisations to respond within 30 days. State this expectation in your letter.

What If They Ignore You or Reject Your Complaint?

If 30 days pass without a substantive response, or you receive a reply that doesn't resolve the issue, you can escalate to the OAIC. Keep every email, letter, and screenshot — the OAIC will ask for proof that you tried to resolve the matter directly.

Step 2: Prepare Your Evidence Before Lodging

A well-documented complaint moves through the OAIC pipeline much faster than a vague one. Before you hit submit, gather the following.

Documents to Collect

• A full copy of your original complaint to the organisation and all correspondence received back.
• Screenshots of the problematic conduct — for example, a marketing email you never signed up for, a data breach notification, or a webpage exposing your information.
• Copies of the organisation's privacy policy at the time the breach occurred (use the Wayback Machine if it has since changed).
• Any receipts, account statements, or logs that show your relationship with the organisation.
• Evidence of harm or loss — bank statements showing fraudulent charges, medical records for stress-related treatment, or quotes for identity-restoration services.

Writing a Clear Timeline

Create a chronological summary on a single page. For each entry, note the date, what happened, and the source document. This becomes the backbone of your complaint and is often the first thing an OAIC investigator reads.

Step 3: Lodge Your Complaint With the OAIC

The OAIC accepts privacy complaints through several channels. The online form is the fastest and most trackable option.

Ways to Lodge

1. Online form: Available at oaic.gov.au. You'll need an email address and should allow around 30 minutes to complete.
2. Email: enquiries@oaic.gov.au with a completed Privacy Complaint Form attached.
3. Post: GPO Box 5288, Sydney NSW 2001.
4. Phone: 1300 363 992 for assistance with lodging, including interpreter services and support for people with disability.

Information the Form Asks For

• Your contact details (complaints must usually be in your own name — anonymous complaints are rarely investigated, though you can request confidentiality from the respondent).
• The organisation's name and contact details.
• A description of what happened and why you believe it is a privacy breach.
• Details of your prior complaint to the organisation and their response.
• The outcome you are seeking.

There is no fee to lodge a privacy complaint with the OAIC.

Step 4: What Happens After You Lodge

The OAIC follows a structured process for every eligible complaint. Understanding the stages helps you set realistic expectations about timing.

The OAIC Complaint Process

Stage	What Happens	Typical Timeframe
Acknowledgement	OAIC confirms receipt and assigns a case number.	Within 10 business days
Early resolution	Case officer contacts both parties to see if a quick resolution is possible.	1–3 months
Preliminary inquiries	OAIC gathers more information to decide whether to formally investigate.	3–6 months
Formal investigation	Commissioner uses legal powers to compel documents and interview witnesses.	6–18 months
Determination	Commissioner issues a binding decision, including any remedies.	Varies

Possible Outcomes

The OAIC can direct the organisation to:

• Apologise to you in writing.
• Change its practices, policies, or staff training.
• Correct or delete the personal information in question.
• Pay compensation for financial loss, humiliation, or injury to feelings. Compensation awards in determinations typically range from a few thousand dollars to tens of thousands for serious cases.

In serious or repeated cases, the Commissioner can also seek civil penalties through the Federal Court — up to AUD 50 million per contravention for corporations following the 2022 reforms.

Notifiable Data Breach Scheme: A Parallel Pathway

If your complaint relates to a data breach, there's an additional layer to be aware of. Under the Notifiable Data Breaches (NDB) scheme, organisations covered by the Privacy Act must notify both the OAIC and affected individuals when an "eligible data breach" is likely to result in serious harm.

What You Should Receive After a Breach

1. A notification describing the kinds of information involved.
2. A plain-English explanation of what happened and when.
3. Recommended steps you can take — such as changing passwords, enabling multi-factor authentication, or placing a credit ban with Equifax, Experian, or illion.

If an organisation experiences a notifiable breach but fails to tell you, that failure is itself a breach you can complain about. The OAIC publishes quarterly statistics on notified breaches, which can corroborate your complaint if your data was caught up in a known incident.

Protecting Yourself While the Complaint Is Pending

Investigations take months. In the meantime, take practical steps to limit any further damage from the breach.

Immediate Security Actions

• Change passwords for the affected account and anywhere else you reused the same password. A reputable password manager makes this painless.
• Enable multi-factor authentication (preferably via an authenticator app rather than SMS) on email, banking, and government accounts like myGov.
• Request a free credit report from all three Australian credit bureaus and place a credit ban if identity documents were exposed.
• Replace compromised identity documents. Services Australia and state transport authorities will reissue Medicare cards and driver licences at no cost when a breach is confirmed.
• Watch for phishing. Breach victims are frequently targeted with convincing follow-up scams referencing the real incident.

Reducing the Data You Hand Over in Future

The best privacy complaint is the one you never have to file. Be deliberate about which organisations receive your personal information. When you share links to sign-up forms, surveys, or support channels, consider using a privacy-respecting link management tool like Lunyb so that you can monitor, revoke, and audit who's clicking what — without handing third parties a pile of tracking data. If you're comparing options for shortening and managing URLs, our 2026 buyer's guide to URL shorteners walks through the privacy and security differences between the major players.

Common Reasons Complaints Fail (and How to Avoid Them)

The OAIC declines or discontinues a significant portion of complaints. Most rejections fall into a few predictable buckets.

• You didn't complain to the organisation first. Always complete step 1, with documented proof.
• The organisation isn't covered. Small businesses under AUD 3 million turnover (that aren't health providers, credit providers, or TFN handlers) fall outside the Privacy Act.
• You waited too long. Complaints must generally be lodged within 12 months of becoming aware of the alleged breach.
• No actual breach of an APP. Behaviour you find annoying — like targeted advertising based on legitimately collected data — may not break the law.
• Lack of evidence. "They must have leaked my data because I got spam" is not enough. You need to show a probable link to the respondent.

Appealing or Escalating a Decision

If you disagree with the Commissioner's determination, you have options.

1. Administrative Appeals Tribunal (AAT): You can apply for merits review of certain OAIC decisions within 28 days.
2. Federal Court or Federal Circuit Court: Determinations are enforceable through the courts if the respondent refuses to comply.
3. Representative complaints: If many people are affected by the same conduct — such as a large-scale data breach — a representative complaint or class action in the Federal Court may be more effective than individual complaints.

Legal aid commissions in each state, community legal centres, and private privacy lawyers can advise if your case warrants formal legal action.

Frequently Asked Questions

How long do I have to lodge an OAIC complaint?

The OAIC generally expects complaints to be lodged within 12 months of you becoming aware of the alleged privacy breach. Complaints filed later may still be accepted if you can show a good reason for the delay, but it becomes significantly harder as evidence fades and witnesses move on.

Does it cost anything to complain to the OAIC?

No. Lodging a privacy complaint with the OAIC is completely free, and you don't need a lawyer. The regulator is designed to be accessible to ordinary members of the public, with interpreter services, accessibility support, and phone assistance available.

Can I complain anonymously?

Anonymous complaints are rarely investigated because the OAIC usually needs to disclose your identity to the respondent so they can respond to the allegations. You can, however, ask the OAIC to keep your details confidential where possible, or raise a general concern (rather than a formal complaint) through the enquiries line.

What compensation can I expect if my complaint succeeds?

Compensation varies widely. Minor cases may result in only an apology or corrective action. More serious determinations have awarded individuals anywhere from AUD 3,000 to over AUD 20,000 for financial loss, humiliation, and injury to feelings. Class action settlements for major data breaches can be substantially higher per person.

What's the difference between the OAIC and state privacy regulators?

The OAIC handles complaints about Australian Government agencies and private sector organisations covered by the federal Privacy Act. State and territory government agencies — such as public hospitals, schools, and transport departments — are generally covered by state privacy laws and overseen by regulators like the Information and Privacy Commission NSW, the Office of the Victorian Information Commissioner, or the Queensland Office of the Information Commissioner.