OAIC Complaints: How to Report a Privacy Breach in Australia

If an Australian organisation has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). This guide explains exactly how OAIC complaints work, what qualifies as a privacy breach under the Privacy Act 1988, and the step-by-step process for lodging a complaint that gets taken seriously.

What Is the OAIC?

The Office of the Australian Information Commissioner (OAIC) is the independent federal regulator responsible for enforcing the Privacy Act 1988 and the Australian Privacy Principles (APPs). It handles complaints from individuals who believe their personal information has been mishandled by an APP entity — generally federal government agencies and private sector organisations with an annual turnover above $3 million (plus some smaller entities such as health service providers).

The OAIC also oversees the Notifiable Data Breaches (NDB) scheme, Consumer Data Right privacy, and freedom of information at the Commonwealth level. If you believe your privacy rights have been violated, the OAIC is usually the correct avenue — but only after you've attempted to resolve the issue directly with the organisation first.

What Counts as a Privacy Breach Under Australian Law?

A privacy breach occurs when an APP entity handles your personal information in a way that contravenes one or more of the 13 Australian Privacy Principles. Personal information includes anything that identifies you — your name, address, phone number, email, financial details, health records, IP address in some contexts, and even opinions about you.

Common Examples of Privacy Breaches

• Unauthorised disclosure: A company shares your contact details with a third party without consent.
• Data breaches: Your information is exposed in a cyber incident the organisation failed to adequately prevent.
• Collection without consent: An entity collects sensitive information (health, biometric, political views) without a lawful basis.
• Refusal to provide access: You request a copy of your personal data and the organisation refuses or delays unreasonably.
• Refusal to correct inaccurate data: You identify incorrect information but the entity won't update it.
• Unsolicited marketing: You receive direct marketing after opting out, or the organisation won't tell you where it got your details.
• Overseas transfer without safeguards: Your data is sent offshore to jurisdictions with weaker protections and without reasonable steps to protect it.

What the OAIC Generally Cannot Investigate

• Complaints against small businesses with turnover under $3 million (unless an exception applies)
• State or territory government agencies — these go to state privacy commissioners
• Employee records held by your current or former employer in the private sector
• Media organisations acting in the course of journalism
• Political parties and some political acts

Step 1: Contact the Organisation First

The OAIC will almost always decline to investigate a complaint if you haven't first raised it directly with the organisation involved. This is a mandatory step under section 40 of the Privacy Act. Here's how to do it properly.

1. Find the privacy officer. Every APP entity must have a contact point for privacy complaints. Check their privacy policy — usually linked in the website footer — for an email address or postal address.
2. Put your complaint in writing. Email is ideal because it creates a timestamped record. Clearly state what happened, which privacy principle you believe was breached, and what outcome you want (apology, deletion, correction, compensation).
3. Attach evidence. Screenshots, correspondence, dates, and reference numbers all strengthen your case.
4. Give them 30 days to respond. This is the standard timeframe the OAIC expects before escalation.
5. Keep every reply. If their response is inadequate, dismissive, or doesn't arrive, you can now escalate.

Step 2: Gather Your Evidence Before Lodging

A well-documented complaint is dramatically more likely to be accepted and acted upon. Before you file with the OAIC, assemble the following in a single folder or PDF.

• Your original complaint email to the organisation and all their replies
• The specific personal information involved and how you know it was mishandled
• Dates, times, and names of anyone you spoke to
• Copies of the organisation's privacy policy at the relevant time (use the Wayback Machine if they've changed it)
• Any notification letters you received if this relates to a data breach
• Evidence of harm — financial loss, emotional distress, identity theft attempts, time spent remediating

Step 3: Lodge Your Complaint With the OAIC

Once you've waited 30 days and received an unsatisfactory response (or none at all), you can lodge a formal complaint. The OAIC offers three channels.

Online Form

Visit oaic.gov.au and use the Privacy complaint form. This is the fastest method and walks you through each required field. You can upload supporting documents directly.

Email or Post

You can download a PDF complaint form and submit it to enquiries@oaic.gov.au, or post it to GPO Box 5218, Sydney NSW 2001. Email is faster.

Phone Assistance

Call 1300 363 992 if you need help lodging the complaint, require an interpreter, or have accessibility needs. OAIC staff will assist but ultimately a written complaint is required.

What Information the OAIC Needs

Your complaint should include the following information to be processed without back-and-forth delays:

Field	What to Include
Your details	Full name, postal address, phone, email
Organisation complained about	Legal name, ABN if known, contact details
Summary of the breach	Clear chronological description in plain English
Privacy Principle(s) breached	Reference the APPs (e.g. APP 6 — use and disclosure)
Previous contact with the organisation	Dates, copies of correspondence
Desired outcome	Apology, data deletion, compensation amount, policy change
Supporting documents	Screenshots, emails, notifications

What Happens After You Lodge

The OAIC process typically unfolds in several stages, though timelines vary significantly depending on complexity and current caseload.

Stage 1: Acknowledgement and Preliminary Assessment

You'll receive an acknowledgement within a few business days. An officer then reviews whether the complaint falls within OAIC jurisdiction and whether you've met the preconditions (such as contacting the organisation first). This can take several weeks.

Stage 2: Conciliation

The OAIC strongly favours conciliation — a facilitated negotiation between you and the organisation to reach a mutually acceptable outcome. Most complaints are resolved at this stage. Outcomes commonly include a written apology, deletion of the data, staff training, policy changes, or a modest financial payment.

Stage 3: Formal Investigation

If conciliation fails, the Commissioner may open a formal investigation under section 40 of the Privacy Act. The Commissioner has powers to compel documents, examine witnesses, and make binding determinations.

Stage 4: Determination

A determination can require the organisation to stop the breaching conduct, redress loss or damage (including non-economic loss), and pay compensation. Determinations are enforceable in the Federal Court.

Realistic timeline: straightforward conciliated matters can resolve in 3–6 months. Formal investigations often take 12–18 months or longer.

Notifiable Data Breaches: A Special Category

Since February 2018, APP entities must notify both the OAIC and affected individuals when an eligible data breach occurs — one likely to result in serious harm. If you've received a data breach notification letter, you have specific rights.

• The notice must explain what information was involved, what the organisation is doing about it, and what steps you should take.
• You can still lodge a privacy complaint even if the organisation has notified correctly — notification does not immunise them from a complaint about how the breach occurred.
• If you believe an organisation has suffered a breach but failed to notify, you can report this to the OAIC separately.

Protecting Yourself While the Complaint Is Underway

Lodging a complaint doesn't fix the underlying exposure. Take practical steps immediately to limit further harm.

1. Change passwords on any affected accounts and any accounts reusing those passwords.
2. Enable two-factor authentication wherever available, preferably using an authenticator app rather than SMS.
3. Place a credit ban with Equifax, Experian, and illion if financial information was exposed. This is free and prevents new credit being opened in your name.
4. Monitor your accounts for unusual activity and report anything suspicious to IDCARE (1800 595 160) and your bank.
5. Reduce future exposure by sharing less personal information online. When sharing links, use a privacy-respecting shortener such as Lunyb that doesn't profile recipients or sell click data — see our honest Lunyb review for details on what data is and isn't collected.
6. Use encrypted DNS such as Cloudflare 1.1.1.1 or Quad9 to reduce the amount of browsing metadata available to intermediaries.

Common Mistakes That Weaken a Complaint

Based on patterns in OAIC published case notes, these are the most common reasons complaints get declined or stall.

• Skipping the organisation. Lodging straight with the OAIC without giving the entity a chance to resolve it almost always results in referral back.
• Vague descriptions. "They mishandled my data" without specifics gets nowhere. Name the data, the act, the date.
• Emotional language. Keep tone factual. The OAIC assesses legal breaches, not how upset you are.
• Unrealistic compensation demands. Non-economic loss awards in Australian privacy matters typically range from $3,000 to $20,000 for serious cases. Six-figure demands undermine credibility.
• Missing the 12-month window. Complaints lodged more than 12 months after you became aware of the issue can be declined on time grounds.
• Wrong regulator. State government agencies, small businesses, and employee records usually require a different pathway.

Alternative and Complementary Pathways

The OAIC isn't your only option, and in some cases a different body is more appropriate or faster.

Issue	Where to Complain
Telco or ISP privacy	Telecommunications Industry Ombudsman (TIO)
Bank, super, or insurance	Australian Financial Complaints Authority (AFCA)
NSW state agency or business	Information and Privacy Commission NSW
Victorian public sector	Office of the Victorian Information Commissioner (OVIC)
Health records (state)	Relevant state health complaints commissioner
Spam and unsolicited marketing	ACMA (Australian Communications and Media Authority)
Scam or identity theft	IDCARE, Scamwatch, and local police

Can You Sue Directly in Court?

Australia does not currently have a general statutory tort of serious invasion of privacy, though this has been under reform discussion for years. In most cases, the OAIC pathway is the primary remedy. However, if the breach involves breach of confidence, defamation, misleading conduct, or contract, you may have separate common law or statutory claims. Speak to a solicitor for anything involving significant financial loss or reputational damage.

Frequently Asked Questions

How much does it cost to lodge an OAIC complaint?

Nothing. Lodging a privacy complaint with the OAIC is free. You may choose to engage a lawyer for complex matters, but it's not required — the process is designed to be accessible to individuals without legal representation.

How long do I have to lodge a complaint?

You should lodge within 12 months of becoming aware of the act or practice you're complaining about. The Commissioner has discretion to accept late complaints but is not required to. Don't delay once you've exhausted the organisation's internal process.

Can I lodge an OAIC complaint anonymously?

No. The OAIC needs your identity to investigate properly and to communicate outcomes. However, your personal details are not generally shared publicly, and determinations published on the OAIC website often de-identify complainants. You can raise concerns anonymously as a general tip-off, but this won't trigger an individual complaint investigation.

What compensation can I actually get?

Compensation varies widely. Many conciliated outcomes involve no money — just an apology, data deletion, or process improvements. Where financial awards are made, they typically cover actual economic loss (fraud, remediation costs) plus a modest sum for non-economic loss such as stress and inconvenience. Published determinations show awards generally between $3,000 and $20,000, with occasional higher amounts for egregious cases.

What if the organisation ignores the OAIC's determination?

Determinations under section 52 of the Privacy Act are enforceable in the Federal Court or Federal Circuit and Family Court. The Commissioner or the complainant can apply to the court for enforcement. In practice, most organisations comply because non-compliance invites civil penalty proceedings and regulatory escalation.

Final Thoughts

The OAIC complaints process gives Australians a genuine, no-cost pathway to hold organisations accountable for mishandling personal information. The keys to success are simple: contact the organisation first, document everything, keep your complaint factual and specific, and be patient with the timeline. Combined with sensible personal privacy hygiene — strong passwords, two-factor authentication, selective data sharing, and privacy-first tools — you can both remediate past breaches and reduce the likelihood of future ones.