OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If an Australian organisation has mishandled your personal information, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). The OAIC is the independent regulator responsible for enforcing the Privacy Act 1988 and the Australian Privacy Principles (APPs). This guide walks you through exactly how to lodge a complaint, what evidence to prepare, and what outcomes you can realistically expect.

What Is an OAIC Privacy Complaint?

An OAIC privacy complaint is a formal request for the Office of the Australian Information Commissioner to investigate an act or practice that may have interfered with your privacy under the Privacy Act 1988. It is the main regulatory avenue available to Australians who believe a business, Australian Government agency, or other covered entity has mishandled their personal information.

The OAIC can investigate issues ranging from unauthorised disclosure of data and failures to secure records, to refusal to provide access to or correct your personal information. Complaints can lead to conciliation, formal determinations, enforceable undertakings, and in serious or repeated cases, civil penalty proceedings in the Federal Court.

Who Can the OAIC Investigate?

Not every organisation falls within the OAIC's jurisdiction. Generally, the Privacy Act applies to:

• Australian Government agencies and the Norfolk Island administration
• Private sector organisations with an annual turnover of more than A$3 million
• All private health service providers (regardless of turnover)
• Businesses that trade in personal information, credit reporting bodies, and TFN recipients
• Some small businesses that have opted in or are contracted service providers to the Commonwealth

State and territory government agencies, most small businesses under A$3 million turnover, and individuals acting in a personal capacity generally fall outside the OAIC's remit. In those cases, state privacy regulators or industry ombudsmen may be the correct avenue.

When Should You Lodge a Complaint?

You should consider lodging an OAIC complaint when you have a genuine concern that an organisation has breached one or more of the 13 Australian Privacy Principles and you have been unable to resolve the issue directly with them.

Common scenarios that lead to OAIC complaints include:

1. Data breaches — your personal information has been exposed in a cyber incident or accidental disclosure.
2. Unauthorised collection — an organisation collected sensitive information without your consent or without a lawful basis.
3. Secondary use or disclosure — your data was used for marketing, sold, or shared with third parties without permission.
4. Access refusal — the entity refused to provide you with a copy of the personal information it holds about you.
5. Correction refusal — the organisation won't fix inaccurate, outdated, or misleading records.
6. Poor security practices — your data was stored without reasonable protection, such as unencrypted databases or unsecured cloud buckets.

Try to Resolve It Directly First

The OAIC will almost always expect you to have contacted the organisation first and given them a reasonable opportunity to respond — typically 30 days. This is not just a bureaucratic hurdle; many complaints are resolved quickly once the organisation's privacy officer becomes involved. Keep a written record of every email and letter, including dates and the names of staff you spoke with.

Step-by-Step: How to Lodge an OAIC Complaint

Lodging a complaint is free and can be done entirely online. Here is the process from start to finish.

Step 1: Contact the Organisation in Writing

Send a clear, dated complaint to the organisation's privacy officer or customer service team. Describe what happened, which personal information was affected, and what outcome you want (an apology, correction, deletion, compensation). Ask them to respond within 30 days.

Step 2: Wait for a Response (Up to 30 Days)

If the organisation responds and resolves the issue to your satisfaction, no further action is needed. If they don't respond, refuse to engage, or their response is inadequate, you can escalate to the OAIC.

Step 3: Gather Your Evidence

Before filling out the OAIC form, collect:

• Copies of all correspondence with the organisation
• Screenshots, emails, or notifications that show the breach
• Dates and a clear timeline of events
• Any notification letters sent to you under the Notifiable Data Breaches (NDB) scheme
• Evidence of harm or loss you have suffered (financial, emotional, reputational)

Step 4: Complete the Online Complaint Form

Visit oaic.gov.au and open the Privacy Complaint Form. You will need to provide:

• Your contact details
• The name and contact details of the organisation
• A description of what happened and when
• Evidence that you tried to resolve it with the organisation
• The outcome you are seeking

You can also lodge by post or email if you prefer. The OAIC provides translation services and accepts complaints via the National Relay Service for people with hearing or speech impairments.

Step 5: Acknowledgement and Preliminary Assessment

The OAIC will acknowledge your complaint, usually within a few business days, and conduct a preliminary assessment to decide whether it has jurisdiction and whether the complaint should proceed. They may ask for more information at this stage.

Step 6: Conciliation

Most accepted complaints move to conciliation — a structured negotiation where the OAIC helps you and the organisation reach a mutually acceptable outcome. Possible resolutions include an apology, changes to practices, access to or correction of records, and compensation.

Step 7: Formal Investigation or Determination

If conciliation fails, the Commissioner may investigate and make a formal determination under section 52 of the Privacy Act. Determinations can include declarations that the organisation must stop a practice, redress loss or damage, and pay compensation. In serious or repeated cases, the OAIC can seek civil penalties in the Federal Court — currently up to A$50 million for body corporates.

What the OAIC Can and Cannot Do

Setting realistic expectations matters. The OAIC is a regulator, not a court, and its processes are generally non-adversarial.

What the OAIC Can Do	What the OAIC Cannot Do
Investigate breaches of the Privacy Act and APPs	Prosecute criminal offences (that's the AFP or DPP)
Conciliate between you and the organisation	Order unlimited compensation like a civil court
Make binding determinations	Investigate most small businesses under A$3M turnover
Seek civil penalties in the Federal Court	Handle complaints about state agencies
Publish guidance and audit entities	Act as your personal lawyer

The Notifiable Data Breaches (NDB) Scheme

Since February 2018, organisations covered by the Privacy Act must notify affected individuals and the OAIC when an eligible data breach occurs — one that is likely to result in serious harm. If you received a data breach notification letter, it was almost certainly sent to comply with the NDB scheme.

Receiving an NDB notification doesn't automatically mean you should complain, but it is strong grounds to investigate further. Ask the organisation:

1. Exactly what information of mine was involved?
2. When did the breach occur and when was it detected?
3. What steps are being taken to contain it?
4. What support (credit monitoring, identity services) is being offered?

If the answers are evasive or the organisation delayed notification unreasonably, that itself may be a breach worth reporting.

Protecting Yourself While You Wait

OAIC investigations can take months. In the meantime, take practical steps to limit further harm:

• Change passwords on any account linked to the breached service, and switch on multi-factor authentication.
• Place a credit ban with Equifax, Experian, and illion if financial information was exposed. Bans are free and can be reinstated as needed.
• Monitor your myGov, banking, and superannuation accounts for unusual activity.
• Consider replacing compromised ID documents such as your driver licence or Medicare card.
• Reduce your digital footprint by using privacy-respecting tools for everyday browsing and sharing.

For example, when you need to share a link publicly — on social media, in a forum, or with a client — using a privacy-first link shortener like Lunyb helps you avoid leaking tracking parameters or exposing underlying URLs that could reveal personal data. You can read more in our honest review of Lunyb's privacy-first shortener.

Common Mistakes That Weaken a Complaint

Avoiding these pitfalls will give your complaint the best chance of success.

• Skipping the organisation — the OAIC will usually send you back to the entity if you haven't complained to them first.
• Vague descriptions — "they misused my data" is too generic. Spell out which APP was breached and how.
• No supporting evidence — unsupported assertions are hard to conciliate.
• Unrealistic outcomes — demanding millions in damages or criminal prosecution of staff is outside the OAIC's scope.
• Waiting too long — the OAIC may decline complaints lodged more than 12 months after you became aware of the issue.

How Long Does the Process Take?

Timeframes vary significantly based on complexity. Simple matters resolved at conciliation can close within 3–6 months. Complex investigations involving large organisations, multiple complainants, or determinations can take 12–24 months or longer. Civil penalty proceedings in the Federal Court can extend the timeline by several more years.

The OAIC publishes case studies and annual reports that give useful insight into typical outcomes and timeframes. Reading a few before lodging will help you anticipate what's ahead.

Alternatives and Parallel Avenues

Depending on your situation, the OAIC may not be the only — or the best — place to complain.

• State privacy regulators — e.g. IPC NSW, OVIC in Victoria — for state government agencies.
• Telecommunications Industry Ombudsman (TIO) — for telco-related privacy issues.
• Australian Financial Complaints Authority (AFCA) — for banks, insurers, and super funds.
• Australian Cyber Security Centre (ACSC) — to report cybercrime via ReportCyber.
• IDCARE — free national identity and cyber support service.

You can pursue more than one avenue simultaneously, though the OAIC may pause its investigation if another body is better placed to handle the matter.

FAQ

Is there a fee to lodge an OAIC privacy complaint?

No. Lodging a complaint with the OAIC is completely free. You do not need a lawyer, although you may choose to get legal advice for complex matters or if you are seeking significant compensation.

Can I complain anonymously?

You can raise concerns anonymously, but the OAIC generally cannot investigate a formal complaint without knowing who you are, because they need to communicate with you and verify the breach affected you personally. You can, however, ask the OAIC to keep your identity confidential from the respondent in certain circumstances.

What compensation can I receive?

Determinations under section 52 can include compensation for financial loss, out-of-pocket expenses, and non-economic loss such as distress or humiliation. Amounts in past determinations have typically ranged from a few hundred dollars to tens of thousands, depending on severity. Most matters resolved at conciliation involve smaller compensation, apologies, or practice changes rather than large payouts.

What if the organisation is based overseas?

The Privacy Act has extraterritorial reach. An overseas organisation that carries on business in Australia and collects personal information from Australians is generally covered. The OAIC can still accept your complaint, though enforcement can be more challenging.

Can I complain about a small business?

Usually not — small businesses with annual turnover under A$3 million are generally exempt from the Privacy Act. Exceptions include private health providers, businesses that trade in personal information, and Commonwealth contractors. If the exemption applies, consider state consumer protection agencies or the relevant industry body.

Final Thoughts

Reporting a privacy breach to the OAIC is one of the most effective rights Australians have to hold organisations accountable for how they handle personal data. The process rewards preparation: contact the organisation first, document everything, and frame your complaint around specific Australian Privacy Principles. Combined with sensible day-to-day privacy habits — strong passwords, selective data sharing, and privacy-respecting tools — you can both respond to breaches that have already happened and reduce the risk of future ones.