OAIC Complaints: How to Report a Privacy Breach in Australia

If an organisation has mishandled your personal information, you have the right to make a complaint to the Office of the Australian Information Commissioner (OAIC). The OAIC is Australia's national privacy regulator, and lodging a complaint is one of the most effective ways to seek a remedy, hold entities accountable and improve privacy practices across the country.

This guide walks you through everything you need to know about OAIC complaints and reporting a privacy breach — from determining whether your issue qualifies, to preparing evidence, to what happens after you submit your complaint.

What Is the OAIC and What Does It Do?

The Office of the Australian Information Commissioner (OAIC) is the independent Commonwealth agency responsible for regulating privacy, freedom of information and government data use in Australia. It administers the Privacy Act 1988 and enforces the Australian Privacy Principles (APPs) that govern how most organisations handle personal information.

Core functions of the OAIC include:

• Investigating privacy complaints from individuals
• Receiving mandatory data breach notifications under the Notifiable Data Breaches (NDB) scheme
• Issuing determinations, enforceable undertakings and civil penalties
• Providing guidance to agencies, businesses and the public
• Reviewing freedom of information decisions

What Counts as a Privacy Breach Under Australian Law?

A privacy breach occurs when an entity bound by the Privacy Act mishandles your personal information in a way that contravenes the Australian Privacy Principles. This can involve unauthorised collection, use, disclosure, loss or access of your data.

Common Examples of Privacy Breaches

• A company suffers a cyberattack and your personal details are exposed
• An organisation shares your information with a third party without consent
• A business refuses to give you access to the personal information it holds about you
• Your information is used for direct marketing without a lawful basis
• A staff member accesses your records without a legitimate reason
• An entity fails to correct inaccurate information after you request it
• Your tax file number (TFN) is handled improperly
• A credit provider misreports information to a credit reporting body

Who the Privacy Act Applies To

Not every organisation is covered. The Privacy Act generally applies to:

• Australian Government agencies
• Private sector organisations with an annual turnover above AUD $3 million
• All health service providers (regardless of turnover)
• Credit providers and credit reporting bodies
• Businesses that trade in personal information
• TFN recipients

Small businesses under the $3 million threshold are often exempt — though reforms announced by the Attorney-General signal this exemption will be narrowed in coming years.

Before You Complain: Contact the Organisation First

The OAIC generally requires you to raise the issue directly with the organisation before it will investigate. This is called the "complaint to respondent" step, and it is mandatory in most cases under section 40(1A) of the Privacy Act.

How to Lodge an Internal Complaint

1. Find the privacy officer: Check the entity's privacy policy — it is required to list a contact point for privacy issues.
2. Write to them in a durable form: Email is ideal because it creates a timestamped record.
3. Describe the breach clearly: State what happened, when, which information was affected and how you discovered it.
4. Specify the outcome you want: An apology, correction, deletion, compensation, or changes to practices.
5. Give them a reasonable time to respond: Typically 30 days.

If the entity does not respond within 30 days, responds inadequately, or refuses to address the issue, you can then escalate to the OAIC.

How to Lodge an OAIC Complaint: Step-by-Step

Lodging a complaint with the OAIC is free and does not require a lawyer. The process is designed to be accessible to any individual, regardless of technical knowledge.

Step 1: Confirm Your Complaint Is Eligible

Your complaint must relate to an act or practice that:

• Was carried out by an entity covered by the Privacy Act
• Interfered with your own personal information (or you are authorised to act on behalf of the affected individual)
• Occurred recently — the OAIC may decline matters older than 12 months without good reason

Step 2: Gather Supporting Evidence

Before completing the form, assemble:

• Copies of your initial complaint to the organisation and their response
• Screenshots, emails or letters showing the breach
• Dates and timelines of relevant events
• Any notification letters you received about a data breach
• Evidence of harm — financial loss, emotional distress, time spent remediating

Step 3: Complete the Online Privacy Complaint Form

Go to oaic.gov.au and select "Make a privacy complaint". The online form asks for:

1. Your contact details
2. The name of the organisation or agency
3. A description of what happened
4. Evidence that you tried to resolve it directly
5. The outcome you are seeking

You can also lodge by post, email (enquiries@oaic.gov.au) or by phone on 1300 363 992 if you need accessibility assistance.

Step 4: Wait for Acknowledgement

The OAIC usually acknowledges receipt within a few business days and assigns a case officer who will contact you if more information is needed.

What Happens After You Lodge the Complaint

The OAIC follows a tiered process, starting with early resolution and only escalating to formal investigation where necessary. Most complaints are resolved through conciliation rather than binding determinations.

Stage 1: Preliminary Assessment

The OAIC first checks whether it has jurisdiction, whether you have given the respondent a chance to resolve the matter, and whether the complaint falls within scope. If it does not, you will receive a decision under section 41 declining to investigate — often with reasons and suggestions.

Stage 2: Conciliation

If accepted, the matter typically moves to conciliation. The OAIC acts as a neutral facilitator between you and the respondent to negotiate a resolution. Possible outcomes include:

• A written apology
• Correction or deletion of information
• Changes to the entity's practices or staff training
• Monetary compensation for financial or non-economic loss

Historically, conciliated compensation awards range from a few hundred dollars for minor distress up to tens of thousands for serious cases involving sensitive health or financial data.

Stage 3: Formal Investigation and Determination

If conciliation fails, the Commissioner may make a formal determination under section 52. A determination can:

• Declare that the respondent interfered with your privacy
• Order the respondent to redress loss or damage
• Require the entity to take or stop certain actions

Determinations are enforceable in the Federal Court or Federal Circuit and Family Court if ignored.

Timeline: How Long Does an OAIC Complaint Take?

Timelines vary significantly based on complexity and the responsiveness of the respondent. The table below gives a realistic snapshot.

Stage	Typical Duration	What Happens
Acknowledgement	1–2 weeks	OAIC confirms receipt and assigns case officer
Preliminary assessment	1–3 months	Jurisdiction and scope reviewed
Conciliation	3–9 months	Negotiation between parties
Formal investigation	6–18 months	Evidence gathered and analysed
Determination	12–24+ months	Commissioner issues binding decision

The Notifiable Data Breaches (NDB) Scheme

Separate from individual complaints, the NDB scheme obliges covered entities to notify the OAIC and affected individuals when an "eligible data breach" occurs — one likely to result in serious harm. If you receive such a notification, you may still lodge a personal complaint if you believe the entity failed to protect your data adequately.

Signs You May Be Affected by a Notifiable Breach

• You receive a formal notification letter or email from an organisation
• Media reports identify a company that holds your information
• Unusual activity appears on your bank, email or Mygov accounts
• Credit monitoring flags new enquiries you did not make

Protecting Yourself After a Privacy Breach

Reporting the breach is only one half of the equation. The other is minimising ongoing exposure of your personal information.

Immediate Protective Steps

1. Change passwords on affected accounts and any that share credentials. Use a password manager to generate unique passwords.
2. Enable multi-factor authentication everywhere it is offered, preferably using an authenticator app rather than SMS.
3. Request a credit ban through Equifax, Illion and Experian — free in Australia and renewable.
4. Replace compromised identity documents such as your driver licence or passport if number exposure justifies it.
5. Monitor accounts closely for 12 months, since stolen data is often sold months after a breach.
6. Report scams or fraud to ReportCyber and Scamwatch.

Reducing Your Future Data Footprint

Every service you sign up for is a potential future breach. Minimise the attack surface by giving out less information in the first place. Use secondary email aliases for sign-ups, consider privacy-respecting browsers, enable encrypted DNS at the device or router level, and avoid oversharing on social platforms. When sharing links publicly, tools like Lunyb let you shorten and manage URLs without exposing underlying tracking parameters to every recipient. For a broader look at trustworthy link tools, see our 2026 URL shortener buyer's guide.

When the OAIC Is Not the Right Forum

Some privacy-adjacent complaints belong elsewhere:

• Telecommunications issues: Telecommunications Industry Ombudsman (TIO)
• Health records in Victoria, NSW or ACT: State health privacy commissioners
• Consumer and misleading conduct: ACCC or state fair trading
• Workplace surveillance (NSW, ACT): State legislation and tribunals
• Spam and unsolicited marketing: ACMA
• Scams and cybercrime: ReportCyber (police) and Scamwatch (ACCC)

Tips for a Strong OAIC Complaint

Case officers deal with hundreds of complaints each month. A well-prepared submission is far more likely to be accepted and resolved favourably.

• Be factual, not emotional. Stick to dates, names and actions.
• Reference the specific APP you believe was breached — e.g. APP 6 (use and disclosure) or APP 11 (security).
• Quantify the harm where possible: hours lost, dollars spent, documented anxiety.
• Keep communications professional with both the OAIC and respondent.
• Keep a complete file of correspondence throughout.
• Respond promptly to case officer requests — delays on your side can see files closed.

Reforms on the Horizon

The Privacy Act is undergoing its most significant overhaul in decades. Expected changes include a direct right of action in the Federal Court, a statutory tort for serious invasions of privacy, broader coverage of small businesses, higher civil penalties and enhanced rights for individuals to request erasure. These reforms will expand both the obligations on entities and the remedies available to Australians when their data is mishandled.

Frequently Asked Questions

How much does it cost to make an OAIC complaint?

Nothing. Lodging and investigating a privacy complaint with the OAIC is free. You do not need a lawyer, though you may choose to be represented. The only costs you might incur are optional ones — for example, obtaining medical evidence of distress or hiring legal advice for complex matters.

Can I claim compensation through the OAIC?

Yes. Compensation is one of the most common outcomes of successful complaints, awarded either through conciliation or formal determination. Amounts depend on the sensitivity of information involved, the severity of the breach, and the extent of financial loss or non-economic harm (such as distress, embarrassment or anxiety). Awards typically range from a few hundred to tens of thousands of dollars.

What is the time limit for lodging a complaint?

There is no strict statutory limit, but the OAIC may decline to investigate complaints lodged more than 12 months after you became aware of the issue, unless you can show good reason for the delay. Act as quickly as possible once internal resolution has failed.

Can I complain anonymously?

You can raise concerns anonymously, but the OAIC generally cannot investigate a formal complaint without knowing who you are, because it needs to verify your identity and the facts, and communicate outcomes to you. Your details are kept confidential from the public, though they will usually be shared with the respondent so they can respond.

What if the organisation that breached my privacy is overseas?

The Privacy Act has extraterritorial reach — it applies to foreign entities that carry on business in Australia and collect or hold personal information of Australians. The OAIC can investigate overseas respondents, though enforcement is more complex. If the entity has no Australian nexus, you may need to rely on the regulator in the entity's home country.

Will making a complaint affect my relationship with the organisation?

It should not. The Privacy Act prohibits victimisation of complainants, and respondents who retaliate risk further regulatory action. If you experience adverse treatment because you complained, raise it with the OAIC immediately.