OAIC Complaints: How to Report a Privacy Breach in Australia (2026 Guide)

If your personal information has been mishandled by an Australian business or government agency, you have the right to complain to the Office of the Australian Information Commissioner (OAIC). The process is free, it is designed for everyday people, and it can lead to real outcomes including apologies, compensation, and changes to how an organisation handles data. This guide walks you through exactly how to lodge an OAIC complaint in 2026 — and how Lunyb helps you spot a breach, gather the right evidence, and protect yourself while the complaint moves through the system.

What an OAIC complaint actually is

An OAIC complaint is a formal request for the Australian Information Commissioner to investigate an interference with your privacy under the Privacy Act 1988. It applies when an entity covered by the Act — most businesses with turnover over $3 million, all health service providers, credit reporting bodies, and Australian Government agencies — mishandles your personal information.

You can complain about things like a data breach that exposed your details, a company refusing to give you access to your own information, unwanted direct marketing, your data being used for a purpose you never agreed to, or a credit provider reporting incorrect information about you.

Who the OAIC can and cannot investigate

The OAIC covers Australian Privacy Principle (APP) entities. It generally does not handle complaints about state or territory government agencies (those go to state privacy regulators such as the IPC in NSW or OVIC in Victoria), small businesses under the turnover threshold unless an exception applies, or employee records held by your current employer.

Why acting fast matters more than ever in 2026

Since the wave of major Australian breaches in recent years, the OAIC has tracked a sustained increase in Notifiable Data Breach reports, and the Australian Government has strengthened penalties for serious or repeated privacy interference. Scammers now weaponise leaked data within days — sometimes hours — of it hitting criminal marketplaces.

That means two things for you:

1. The sooner you know your data is exposed, the sooner you can lock accounts, change passwords, and warn your bank.
2. The sooner you document the breach, the stronger your OAIC complaint will be.

This is exactly where Lunyb fits in. Our Data Breach Alerts monitor your email and phone number against known exposures, our Scam Checker lets you paste a suspicious message or link and get a verdict in seconds, and our Scam Shield helps block the follow-up calls that almost always come after a leak. You get early warning and a fighting chance to respond before the damage spreads.

Step 1: Complain to the organisation first

The OAIC requires you to raise the issue directly with the organisation before they will accept your complaint, except in limited circumstances. This is not a hoop to jump through — it is often the fastest route to a fix.

1. Find the organisation's privacy officer or privacy contact. It is usually listed in their privacy policy.
2. Put your complaint in writing — email is fine and gives you a timestamped record.
3. Clearly state what happened, what information was involved, how you became aware, and what outcome you want (apology, correction, deletion, compensation, process change).
4. Give them a reasonable time to respond. 30 days is the benchmark the OAIC uses.

Keep every email, letter, reference number, and screenshot. If you used Lunyb to detect the breach, export the alert details — the date you were notified, the source of the exposure, and the data types involved — and attach them to your complaint. Clear evidence shortens everything that follows.

What to say in your initial complaint letter

• Your full name and the account or customer reference the organisation uses.
• A short, factual timeline of what went wrong.
• Which Australian Privacy Principle you believe was breached, if you know (APP 6 for misuse, APP 11 for poor security, APP 12 for access refusals, APP 13 for inaccurate data).
• The outcome you are seeking.
• A deadline — 30 days is standard.

Step 2: Lodge your OAIC complaint

If the organisation ignores you, gives you an unsatisfactory response, or takes longer than 30 days, you can escalate to the OAIC. Lodging is free.

1. Go to oaic.gov.au and open the online Privacy Complaint form.
2. Create an account or sign in. You can save a draft and come back.
3. Fill in your contact details and the details of the organisation you are complaining about.
4. Describe what happened in plain English. Stick to facts and dates.
5. Upload supporting documents: your original complaint to the organisation, their reply (or proof they did not reply), screenshots, breach notifications, scam messages you received afterwards, and any Lunyb breach alerts.
6. Say what resolution you want.
7. Submit and save your reference number.

You can also lodge by post, email, or phone if the online form is not accessible for you. The OAIC offers interpreter and accessibility support.

How long you have to complain

Generally you should lodge within 12 months of becoming aware of the issue. The Commissioner can decide not to investigate complaints that are out of time, frivolous, or already being dealt with by another body — so earlier is always better.

Step 3: What happens after you lodge

The OAIC's role is to try to resolve the complaint, not to punish organisations on your behalf. Most matters are handled through conciliation.

1. Assessment. The OAIC checks it has jurisdiction and that you contacted the organisation first.
2. Early resolution. Many complaints settle here, with the organisation offering an apology, a correction, or a goodwill payment.
3. Investigation. If the matter is complex or serious, the Commissioner can formally investigate, require documents, and interview staff.
4. Conciliation. The OAIC facilitates a discussion between you and the organisation to reach an agreed outcome.
5. Determination. If there is no agreement, the Commissioner can make a binding determination, including ordering compensation for financial loss and non-economic loss such as stress and humiliation.

Determinations are enforceable in the Federal Court or Federal Circuit and Family Court of Australia.

Outcomes you can realistically ask for

Being specific about the outcome you want makes conciliation faster.

Outcome	When it fits
Apology	Most privacy interferences — it is often the starting point.
Correction or deletion of data	Inaccurate records, data held without a valid purpose.
Access to your records	APP 12 refusals or excessive delays.
Stop direct marketing	Ongoing unwanted contact after you opted out.
Staff training or process change	Systemic failures likely to affect other people.
Compensation	Out-of-pocket costs, identity-repair expenses, significant distress.

Protect yourself with Lunyb while your complaint is in progress

An OAIC complaint can take weeks or months. During that time your exposed data does not sit still — it circulates. Attackers try your email in credential stuffing, text you fake delivery notices, and call pretending to be your bank. Lunyb is built to shut down those follow-on attacks and help you stay in control.

Here is how Lunyb helps at each stage of a privacy breach:

• Data Breach Alerts monitor your email address and phone number, so you learn about exposures early and have dated evidence to attach to your OAIC complaint.
• Scam Checker lets you paste any suspicious SMS, email, or link and get a quick verdict before you tap. Breaches almost always trigger a wave of targeted phishing — this is your filter.
• Scam Shield helps reduce the flood of spam and scam calls that follow a phone-number leak.
• Privacy Check reviews the permissions your apps have asked for and flags the ones that look excessive, so you can tighten up before the next incident.
• Password & Photo Vault gives you an encrypted place to rotate the credentials that were exposed, without storing them in a notes app.
• On-device tracker and threat blocking uses a local DNS shield to cut off known malicious domains and trackers at the network level on your phone.
• Browsing-history eraser and Photo Guard reverse-image check help you clean up and investigate how your data or images may be circulating.
• Security Score gives you one number to track whether your overall posture is improving week on week.

Plans start from about $19.99/month and renew until you cancel, which you can do online anytime. Optional Leak Protection is billed separately and can be paused without cancelling the main plan. No hidden commitments, no surprise locks — that is the kind of transparency you deserve from a privacy tool.

Start with the free privacy quiz at lunyb.com — it takes a couple of minutes and shows you where you are most exposed. If you want to see how we think about trust and transparency more broadly, read our honest review of Lunyb.

Evidence checklist before you hit submit

Strong OAIC complaints are specific. Weak ones are vague. Use this checklist.

• The organisation's name and ABN if you can find it.
• The date you became aware of the issue and how you found out (including any Lunyb breach alert).
• The exact personal information involved — email, phone, address, Medicare, driver licence, financial data.
• A copy of your written complaint to the organisation.
• Their response, or proof they did not respond within 30 days.
• Screenshots of scam calls, texts, or phishing emails you received after the breach.
• Any financial losses, with receipts or bank statements.
• A short impact statement describing stress, time lost, or identity-repair work.

Common mistakes that weaken a complaint

1. Skipping the organisation. The OAIC will usually bounce you back to do this first.
2. Emotional language without facts. Stay cool and specific. Dates and quotes beat adjectives.
3. No ask. If you do not say what outcome you want, you will not get one.
4. No evidence of harm. Even non-economic loss needs a clear description — how often, how long, what it affected.
5. Waiting too long. Memories fade, logs get rotated, and the 12-month window closes.

Other Australian regulators to consider

Depending on the breach, you may also have grounds to contact:

• Scamwatch (run by the National Anti-Scam Centre) — report scams and losses.
• IDCARE — free national identity and cyber support service.
• Your state privacy regulator — for state government or local council matters.
• Australian Financial Complaints Authority (AFCA) — if a bank, insurer, or super fund is involved.
• Australian Cyber Security Centre (ACSC) via cyber.gov.au — for cybercrime incidents.

These are complementary. Lodging with the OAIC does not stop you using any of the above.

Take the next step with Lunyb

You do not have to wait for the next breach to start protecting yourself. The Australians who recover fastest from privacy incidents are the ones who already had alerts switched on, strong passwords in a vault, and a quick way to check suspicious messages before clicking. Lunyb gives you all of that in one app.

• Take the free privacy quiz at lunyb.com and see your exposure in minutes.
• Download the Lunyb app from the App Store or Google Play to turn on Data Breach Alerts, Scam Shield, and the on-device threat blocker.
• Need a safer way to share a long OAIC form link or evidence URL? Use Lunyb's link shortener and secure QR tool.

Lodging an OAIC complaint is your right. Lunyb is how you make sure it is the last time the same breach catches you off guard.

Frequently asked questions

Does it cost anything to lodge an OAIC complaint?

No. Lodging a privacy complaint with the OAIC is free. You do not need a lawyer, although you can choose to use one. The process is designed to be accessible to ordinary consumers.

How long does an OAIC complaint take to resolve?

It varies. Simple matters can be resolved through early resolution in a matter of weeks. Complex investigations and formal conciliations can take many months. Providing clear evidence and a specific requested outcome is the single biggest thing you can do to speed it up.

Can I get compensation through the OAIC?

Yes. The Commissioner can order compensation for financial loss and for non-economic loss such as stress, humiliation, or injury to feelings. Amounts vary widely depending on the seriousness of the interference and the evidence of harm.

What if the breach involved a small business under the turnover threshold?

Many small businesses are exempt from the Privacy Act, but there are exceptions — including health service providers, businesses that trade in personal information, and contractors to Australian Government agencies. If the business is exempt, you may still have options through state regulators, Scamwatch, or consumer law bodies.

How does Lunyb help after an Australian data breach?

Lunyb alerts you when your email or phone appears in known exposures, helps you check suspicious messages and links before you tap, reduces scam calls with Scam Shield, and gives you an encrypted vault to rotate passwords. It will not stop every scam, but it dramatically shortens the time between a leak and your response — which is what actually limits the damage.