OAIC Complaints: How to Report a Privacy Breach in Australia

If an Australian business, government agency, or health service provider has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). This guide walks you through the entire OAIC complaints process for a privacy breach — from the preliminary steps you must take, to lodging the formal complaint, and what to expect afterwards.

What Is the OAIC and When Can You Complain?

The Office of the Australian Information Commissioner (OAIC) is the independent federal regulator responsible for enforcing the Privacy Act 1988 and the Australian Privacy Principles (APPs). You can complain to the OAIC when an organisation covered by the Privacy Act has interfered with your privacy — for example, by mishandling, exposing, or misusing your personal information.

The OAIC can investigate complaints against:

• Australian Government agencies and most ministers
• Private sector organisations with an annual turnover of more than $3 million
• All health service providers (regardless of size)
• Credit providers and credit reporting bodies
• Tax File Number (TFN) recipients
• Some small businesses that trade in personal information or are contracted service providers to the Commonwealth

What Counts as a Privacy Breach?

A privacy breach — formally called an "interference with privacy" — includes conduct such as:

• Collecting personal information unlawfully or without consent
• Using or disclosing information for a purpose you did not agree to
• Failing to keep your information secure (e.g. a data breach)
• Refusing to give you access to your own personal information
• Refusing to correct inaccurate information
• Sending unsolicited direct marketing without an opt-out
• Mishandling your Tax File Number or credit information

Step 1: Complain to the Organisation First

Before the OAIC will accept your complaint, you generally must raise the issue directly with the organisation and give them a reasonable opportunity to respond — usually 30 days. This is a mandatory step, and skipping it is the most common reason complaints are declined early.

How to Lodge an Internal Complaint

1. Find the privacy officer: Most APP entities publish contact details for a privacy officer in their privacy policy, typically on their website footer.
2. Put it in writing: Email or post is best — this creates a dated record.
3. Describe the breach clearly: State what happened, when, what personal information was involved, and how you were affected.
4. Say what you want: An apology, deletion of your data, correction of records, compensation, or policy changes.
5. Set a deadline: Ask for a response within 30 days.
6. Keep copies of everything: You will need them for the OAIC.

If the organisation refuses to respond, provides an unsatisfactory response, or does not reply within 30 days, you can escalate the matter to the OAIC.

Step 2: Prepare Your OAIC Complaint

A well-prepared complaint is far more likely to be investigated. The OAIC assesses complaints on paper first, so clarity and evidence matter enormously.

Information You Will Need

• Your full name and contact details
• The name and contact details of the organisation complained about
• A chronological description of what happened
• Copies of your original complaint to the organisation and their response (if any)
• Any supporting evidence — emails, screenshots, letters, data breach notifications, call records
• An explanation of how the breach affected you (financial loss, emotional distress, reputational harm)
• What outcome you want the OAIC to consider

Timeframes You Should Know

Stage	Timeframe
Wait for organisation's response	Minimum 30 days from your complaint
Lodge with OAIC after their response	Within 12 months of becoming aware of the breach (recommended)
OAIC acknowledgement	Usually within 10 business days
Preliminary enquiries	Several weeks to months
Full investigation (if accepted)	6–12 months is common

Step 3: Lodge the Complaint With the OAIC

You can lodge an OAIC privacy complaint through four channels: an online form, a downloadable PDF form, post, or by phone (with support if you need accessibility assistance). The online form is the fastest option.

Lodging Online

1. Go to oaic.gov.au and navigate to "Privacy complaints".
2. Select "Make a privacy complaint" and open the online form.
3. Complete all mandatory fields — your details, the respondent, and a description of events.
4. Upload supporting documents (PDFs, images, emails).
5. Review your submission carefully — once lodged, changes require follow-up correspondence.
6. Submit and save the confirmation reference number.

Other Lodgement Methods

• Post: GPO Box 5288, Sydney NSW 2001
• Phone: 1300 363 992 (within Australia)
• Email: enquiries@oaic.gov.au (for general enquiries; formal complaints should use the form)
• Translating and Interpreter Service: 131 450 — ask them to contact the OAIC on your behalf
• National Relay Service: Available for people who are deaf, hard of hearing, or have a speech impairment

Step 4: What Happens After You Lodge

Once your complaint is received, the OAIC follows a structured process designed to encourage conciliation before formal investigation.

The OAIC Complaint Process

1. Acknowledgement: You receive confirmation and a reference number.
2. Preliminary enquiries: The OAIC checks it has jurisdiction and that you complained to the organisation first.
3. Early resolution: Many complaints are resolved informally at this stage through conciliation.
4. Investigation: If no resolution is reached, the Commissioner may open a formal investigation under section 40 of the Privacy Act.
5. Determination: The Commissioner can issue a legally binding determination requiring the respondent to take action or pay compensation.
6. Review: Either party may seek review by the Administrative Review Tribunal.

Possible Outcomes

Outcome	What It Means
Apology	Written acknowledgement and apology from the organisation
Correction or deletion	Your personal information is amended or destroyed
Compensation	Payment for economic loss, non-economic loss (distress), or aggravated damages
Policy or process change	The organisation changes its practices to prevent recurrence
Staff training	Mandatory privacy training for staff
Declined	No jurisdiction, out of time, or lacking in substance

When the OAIC May Decline Your Complaint

Under section 41 of the Privacy Act, the Commissioner has discretion to decline complaints in certain circumstances. Understanding these reasons up front can save you time.

• You did not complain to the organisation first
• More than 12 months have passed since you became aware of the breach without good reason
• The complaint is frivolous, vexatious, or lacking in substance
• The matter is being handled by another body (e.g. a court or industry ombudsman)
• The respondent is not covered by the Privacy Act
• An adequate remedy has already been provided

Notifiable Data Breaches: A Related but Separate Process

Since 2018, organisations covered by the Privacy Act must notify the OAIC and affected individuals about "eligible data breaches" under the Notifiable Data Breaches (NDB) scheme. If you received a data breach notification, that letter is strong evidence to attach to any complaint you later lodge.

What to Do If You Receive a Breach Notification

1. Read it carefully — note what information was exposed and when.
2. Change affected passwords and enable two-factor authentication wherever possible.
3. Monitor your credit file through Equifax, Experian, or illion — you can request a free ban.
4. Watch for scams that reference the breach (phishing emails, SMS, phone calls).
5. Consider a complaint if the organisation's response is inadequate.

Where exposed data includes login credentials or links tied to your identity, review how you share URLs and files online. Services such as Lunyb, a privacy-focused URL shortener, let you share links without exposing underlying parameters that may contain personal identifiers — a small but useful habit after a breach. You can read more in our honest review of Lunyb or compare options in our 2026 URL shortener buyer's guide.

Tips for a Stronger OAIC Complaint

Investigators review many complaints each week. These practical tips help your matter stand out and move faster.

• Be chronological: Lay out events by date, from first contact to the breach to the organisation's response.
• Stick to facts: Describe conduct rather than motivations.
• Quantify harm where you can: Receipts, bank statements, medical records, or counsellor letters strengthen claims of loss.
• Reference the APPs: If you can identify which Australian Privacy Principle was breached (e.g. APP 6 use and disclosure, APP 11 security), note it.
• Keep communications professional: Hostile language can undermine credibility.
• Respond promptly: If the OAIC asks for more information, reply within the deadline.

What If You're Not Satisfied With the OAIC's Decision?

If the Commissioner declines your complaint or you disagree with the outcome of an investigation, you have options.

• Review by the Administrative Review Tribunal (ART): You can seek merits review of a formal determination.
• Federal Court or Federal Circuit Court: In limited circumstances, you can enforce a determination through the courts.
• Internal reconsideration: You can ask the OAIC to reconsider a decision based on new information.
• Commonwealth Ombudsman: If you believe the OAIC itself has handled your matter unfairly, you can complain to the Ombudsman.

Other Avenues for Privacy Complaints

The OAIC is not always the right forum. Depending on who breached your privacy, these alternatives may be faster or more appropriate.

Issue	Where to Complain
Telco or ISP privacy	Telecommunications Industry Ombudsman (TIO)
State government agency	State privacy regulator (e.g. IPC NSW, OVIC Victoria)
Small business (under $3m, non-health)	Often not covered — try fair trading or consumer protection
Credit reporting	OAIC or Australian Financial Complaints Authority (AFCA)
Spam / unsolicited messages	ACMA (Australian Communications and Media Authority)
Scam or identity theft	IDCARE and ReportCyber (cyber.gov.au)

Frequently Asked Questions

How much does it cost to lodge an OAIC complaint?

Nothing. Lodging a privacy complaint with the OAIC is completely free, and you do not need a lawyer to represent you. Legal assistance can be helpful in complex matters but is not required.

How long does the OAIC take to investigate a privacy breach?

Simple matters resolved informally may close within a few months. Formal investigations commonly take 6 to 12 months, and complex cases involving multiple parties or large data breaches can take longer. The OAIC publishes service standards on its website.

Can I get compensation for a privacy breach?

Yes. The Commissioner can order compensation in a formal determination for economic loss, non-economic loss (such as distress, humiliation, or anxiety), and in some cases aggravated damages. Awards for non-economic loss typically range from several hundred to tens of thousands of dollars depending on severity.

Do I need to complain to the organisation first?

In almost all cases, yes. You must give the respondent a reasonable opportunity — usually 30 days — to resolve the issue before the OAIC will accept the complaint. The main exception is where it would be inappropriate to do so, such as a safety risk or where the organisation has already indicated it will not respond.

Is my identity kept confidential during an OAIC complaint?

No. The OAIC will share your complaint with the respondent so they can respond. However, your personal information is handled under the Privacy Act and is not made public. If a formal determination is published, your name may be de-identified in the public version.

Final Thoughts

Lodging an OAIC privacy complaint is a straightforward but structured process: raise the issue with the organisation first, gather your evidence, lodge within 12 months, and engage constructively with the OAIC's conciliation and investigation stages. While not every complaint results in compensation, the process holds organisations accountable, drives systemic improvements, and often secures meaningful outcomes for individuals. If your privacy has been interfered with, don't hesitate — the Privacy Act exists precisely to give Australians a voice when their personal information is mishandled.