OAIC Complaints: How to Report a Privacy Breach in Australia

If an Australian organisation has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). The OAIC is Australia's independent national regulator for privacy and freedom of information, and it investigates breaches of the Privacy Act 1988. This guide walks you through exactly how to report a privacy breach, what to expect from the process, and how to maximise your chances of a successful outcome.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner (OAIC) is the federal agency responsible for enforcing the Privacy Act and the 13 Australian Privacy Principles (APPs). You can lodge a complaint with the OAIC when you believe an entity covered by the Act has interfered with your privacy — for example, by collecting personal data without consent, failing to secure it, disclosing it without authority, or refusing to let you access or correct your own information.

The OAIC handles complaints against:

• Australian Government agencies
• Private sector organisations with an annual turnover of more than $3 million
• All health service providers (regardless of turnover)
• Credit reporting bodies and credit providers
• Tax File Number recipients
• Some small businesses that trade in personal information

State and territory government agencies are generally not covered — those complaints go to state-based privacy regulators such as the Information and Privacy Commission NSW or the Office of the Victorian Information Commissioner.

What Counts as a Privacy Breach?

A privacy breach, under Australian law, is any act or practice that interferes with the privacy of an individual. Common examples include:

• Unauthorised access to or disclosure of your personal information (data breaches)
• Collection of information you didn't consent to provide
• Using your data for a purpose other than the one it was collected for
• Sending marketing communications after you opted out
• Refusing to grant you access to records held about you
• Failing to correct inaccurate personal information
• Inadequate security safeguards leading to leaks

Step 1: Complain Directly to the Organisation First

Before the OAIC will accept your complaint, you must usually give the organisation a chance to resolve the issue. This is a mandatory first step in nearly all cases.

1. Identify the right contact. Most APP-covered entities must have a published privacy policy that lists a Privacy Officer or complaints contact.
2. Put your complaint in writing. Email is ideal because it creates a dated record. Clearly describe what happened, when, and how you believe your privacy was breached.
3. State what you want. Be specific: an apology, deletion of records, correction of data, compensation, or a change in policy.
4. Give them 30 days to respond. This is the standard timeframe the OAIC expects before escalating.
5. Keep every document. Save emails, screenshots, letters, and reference numbers — the OAIC will ask for them.

If the organisation ignores you, refuses to engage, or gives an unsatisfactory response, you can then escalate to the OAIC.

Step 2: Lodge Your Complaint With the OAIC

Once the 30-day window has passed (or the organisation has formally refused to help), you can file a formal complaint. The OAIC offers several lodgement channels, but the online form is the fastest.

How to Lodge Online

1. Visit oaic.gov.au and navigate to "Privacy complaints".
2. Select "Lodge a privacy complaint" and open the online form.
3. Provide your personal details and the name of the respondent organisation.
4. Describe the breach in chronological order with dates, names, and reference numbers.
5. Upload supporting evidence — emails, letters, screenshots, policies.
6. Explain what resolution you're seeking.
7. Submit and record your reference number.

Alternative Lodgement Methods

Method	Contact	Best For
Online form	oaic.gov.au	Most complainants — fastest
Email	enquiries@oaic.gov.au	Those who prefer attachments and written records
Phone	1300 363 992	Initial enquiries and accessibility needs
Post	GPO Box 5288, Sydney NSW 2001	Hard-copy evidence or where digital access is limited
Translator service	131 450 (TIS National)	Non-English speakers

Step 3: What Happens After You Lodge

The OAIC's handling of your complaint typically follows a structured, multi-stage process. Understanding the stages helps you set realistic expectations.

Stage 1 — Assessment

The OAIC first checks whether your complaint is within jurisdiction, whether you first tried to resolve it with the organisation, and whether there is sufficient information to proceed. This usually takes a few weeks.

Stage 2 — Early Resolution

For straightforward matters, the OAIC may contact the organisation to seek a quick resolution — such as deletion of records or a formal apology — without a full investigation. Many complaints end here.

Stage 3 — Conciliation

If early resolution fails, a conciliator will facilitate confidential discussions between you and the organisation to reach a negotiated outcome. Conciliation is informal, non-binding, and typically faster than investigation.

Stage 4 — Investigation

If conciliation fails or the matter is systemic or serious, the Commissioner may launch a formal investigation. The OAIC has powers to compel documents, interview witnesses, and issue binding determinations.

Stage 5 — Determination

For complaints that proceed all the way, the Commissioner can issue a determination that may include orders for the organisation to stop the conduct, change its practices, compensate you for financial loss or non-economic harm (including distress), and publish an apology.

Timeframes: How Long Will It Take?

Expect the full OAIC process to take anywhere from a few weeks to over a year. Early resolution and conciliation outcomes often conclude within 3–6 months, while formal investigations can run 12 months or more, especially for complex data breach matters involving large respondents.

You can speed things up by:

• Providing a clear, concise written chronology from the start
• Attaching all evidence upfront rather than drip-feeding
• Being realistic about the remedy you're seeking
• Responding promptly to OAIC requests for further information

Notifiable Data Breaches: A Special Category

Under the Notifiable Data Breaches (NDB) scheme, APP-covered entities must notify affected individuals and the OAIC when a data breach is likely to result in "serious harm". If you were notified of such a breach — or you discover one wasn't notified when it should have been — you have specific rights.

What to Do If You've Been Notified

1. Read the notification carefully and record the date you received it.
2. Change passwords on affected accounts and enable two-factor authentication.
3. Review your credit report through Equifax, Experian or illion — place a credit ban if identity data was exposed.
4. Report any suspected identity theft to IDCARE (1800 595 160).
5. If the organisation's response was inadequate, lodge an OAIC complaint.

Protecting Yourself Online After a Breach

Once your personal data is exposed, reducing your ongoing digital footprint becomes critical. Consider using encrypted DNS, privacy-focused browsers, and tools that don't harvest extra data. For instance, if you need to share links without exposing additional tracking information or metadata, a privacy-respecting shortener like Lunyb can help limit how much is leaked downstream. For a comparison of options, see our 2026 buyer's guide to URL shorteners.

What Compensation Can You Receive?

The OAIC can order organisations to compensate complainants for both economic and non-economic loss. Awards are modest by international standards but have been growing.

Type of Loss	Typical Award Range	Example
Economic loss	Full documented amount	Costs of replacing stolen ID, credit monitoring
Non-economic loss (low)	$1,000 – $5,000	Minor distress, inconvenience
Non-economic loss (mid)	$5,000 – $20,000	Significant anxiety, reputational concern
Non-economic loss (high)	$20,000 – $50,000+	Serious psychological harm, major breach
Aggravated damages	Variable	Where organisation's conduct worsened the harm

Representative Complaints and Class Actions

If a breach affects many people — such as a large data breach — you can lodge a representative complaint on behalf of a class of affected individuals. The OAIC has handled several large representative complaints following major Australian data breaches, resulting in collective determinations.

You don't need a lawyer to lodge a representative complaint, but legal advice is strongly recommended given the complexity. Community legal centres and privacy specialists can often assist at no cost.

Common Mistakes That Weaken a Complaint

1. Skipping the direct complaint step. The OAIC will usually bounce your complaint back if you haven't given the organisation 30 days.
2. Vague descriptions. "They misused my data" is not enough — be specific about dates, documents, and conduct.
3. No evidence. Verbal conversations are hard to prove; always follow up in writing.
4. Unreasonable remedies. Asking for $500,000 in damages for a mailing list error damages your credibility.
5. Delaying lodgement. There is a 12-month time limit from when you became aware of the breach, though extensions are possible.
6. Mixing jurisdictions. If the respondent is a state agency, the OAIC can't help — go to the state regulator.

When to Consider External Dispute Resolution Instead

Some industries have external dispute resolution (EDR) schemes that may be faster than the OAIC. The OAIC can — and often does — refer complaints to these specialised schemes.

Industry	EDR Scheme
Banking, insurance, super	Australian Financial Complaints Authority (AFCA)
Telecommunications	Telecommunications Industry Ombudsman (TIO)
Energy and water	State energy/water ombudsman schemes
Credit reporting	AFCA

Protecting Your Privacy Going Forward

Lodging a complaint is reactive; prevention is better. A few proactive steps dramatically reduce your exposure:

• Use unique passwords and a reputable password manager
• Enable multi-factor authentication on every important account
• Request access to and correction of your personal data under APP 12 and 13
• Use privacy-respecting services for everyday tasks like link sharing, email, and search
• Monitor your credit file at least annually
• Opt out of marketing lists and data brokers where possible

FAQ

How much does it cost to lodge an OAIC complaint?

Lodging a complaint with the OAIC is completely free. There are no fees at any stage of the process, including conciliation and investigation. You may choose to engage a lawyer, but it isn't required.

Can I complain anonymously?

No. The OAIC generally requires your identity to investigate because the respondent organisation needs to be able to respond to the specific allegations. However, your details are kept confidential and are not disclosed publicly. In rare cases involving systemic issues, the OAIC may act on an anonymous tip through its own-motion powers.

What if the organisation retaliates against me?

Retaliation for making a privacy complaint can itself be a breach of the Privacy Act and potentially other laws. Document any retaliatory behaviour and inform the OAIC immediately — it can be taken into account during the investigation and may increase any compensation awarded.

Can I take my complaint to court instead?

There is no direct right to sue under the Privacy Act in most cases — the OAIC is the primary pathway. However, if the Commissioner makes a determination that isn't complied with, you can enforce it in the Federal Court. Separate causes of action (such as breach of confidence, defamation or negligence) may be available in some circumstances.

What happens if I'm not satisfied with the OAIC's decision?

You can apply to the Administrative Review Tribunal (ART, formerly the AAT) for a review of certain OAIC decisions, including determinations. There are strict time limits — usually 28 days — so seek legal advice promptly if you're considering review.

Final Thoughts

Reporting a privacy breach to the OAIC isn't a quick fix, but it's one of the most powerful consumer-protection tools Australians have. The key to a successful complaint is preparation: raise it with the organisation first, document everything, articulate a reasonable remedy, and be patient through the process. Even complaints that don't result in large compensation often drive meaningful change in how organisations handle personal information — and that benefits every Australian.