How to Make an OAIC Complaint About a Privacy Breach

To make an OAIC complaint, first complain in writing to the organization that handled your personal information. If it doesn’t respond within 30 days, or you’re unhappy with its response, lodge a complaint with the Office of the Australian Information Commissioner through its official website, oaic.gov.au, with copies of your correspondence. It’s free, and you don’t need a lawyer.

The OAIC is Australia’s national privacy regulator. It can look into how a business or Australian Government agency handled your information and try to resolve the complaint, but it doesn’t act for you and not every complaint leads to an investigation. This guide covers when the OAIC is the right place, how to prepare, what to send and what to expect. It’s general information, not legal advice. For the law behind it, see our guide to the Australian Privacy Act.

What the OAIC handles

The OAIC deals with complaints about the handling of personal information by organizations covered by the Privacy Act 1988. In general terms, that includes:

• Australian Government agencies, such as federal departments.
• Businesses and not-for-profits with annual turnover above 3 million Australian dollars.
• Some smaller businesses regardless of size, including private health service providers and businesses that trade in personal information.
• Credit reporting bodies and credit providers, for complaints about your credit information.

The OAIC also handles some freedom of information matters involving Australian Government agencies, but this guide focuses on privacy complaints.

It generally can’t help with:

• State or territory government agencies, such as a state hospital or council. These usually go to your state or territory privacy body, such as the Information and Privacy Commission in New South Wales or the Office of the Victorian Information Commissioner.
• Most small businesses under the turnover threshold, unless an exception applies.
• Things individuals post about you in a personal capacity, such as a neighbor’s social media post.
• Disputes that aren’t about personal information, such as a faulty product or a billing error.

If someone is posting abusive material about you online, the eSafety Commissioner is usually the better route. If a post is false and damaging, Australian defamation law may apply.

What you can complain about

Common reasons for an OAIC complaint include:

• An organization ignored or refused your request to access your personal information.
• It refused to correct information that’s inaccurate, out of date or misleading.
• It shared your information with someone it shouldn’t have.
• It collected more information than it needed, or didn’t tell you why it was collecting it.
• It kept sending you direct marketing after you asked it to stop.
• It had a data breach involving your information and you’re unhappy with how it was handled.
• Your credit report contains an error that the credit provider or credit reporting body won’t fix.

Step 1: Complain to the organization first

The OAIC expects the organization to have a chance to fix the problem. If you haven’t complained to it first, the OAIC will usually ask you to do that before it looks at your complaint.

1. Find the right contact. The organization’s privacy policy should say how to make a privacy complaint, often to a privacy officer.
2. Put it in writing. Email or a letter gives you a dated record. If you complain by phone, follow up in writing.
3. Explain what happened, with dates, account or reference numbers and anything that shows what went wrong.
4. Say what you want: access to your information, a correction, an explanation, an apology, a change in practice, or for it to stop using your details.
5. Keep copies of everything you send and receive.

Here’s example wording you can adapt:

Subject: Privacy complaint

To the privacy officer,

I am making a complaint about how you have handled my personal information. On [date], [describe what happened, for example “I asked for access to the information you hold about me and have not received a response” or “you disclosed my contact details to a third party without my consent”].

I would like you to [provide access / correct the record / explain how this happened / stop using my information for marketing]. Please respond within 30 days. If this isn’t resolved, I intend to complain to the Office of the Australian Information Commissioner.

[Your name, contact details and any account or reference numbers]

Step 2: Wait 30 days, then decide

Give the organization 30 days to respond. After that, the OAIC complaint route is open if:

• the organization hasn’t responded at all,
• it responded, but you’re not satisfied with the answer, or
• it said it would fix the problem and hasn’t.

Check for an industry ombudsman

Some sectors have their own external dispute resolution schemes, and they may be a better or faster fit. For example, the Australian Financial Complaints Authority handles complaints about banks, insurers and many credit providers, and the Telecommunications Industry Ombudsman handles complaints about phone and internet providers. States also have energy and water ombudsmen. If the organization belongs to a scheme that can deal with your privacy issue, the OAIC may refer you there instead.

Step 3: Lodge your OAIC complaint

1. Go to the OAIC’s official website. Type oaic.gov.au yourself and use its privacy complaint form. Complaining is free, so be wary of anyone charging to lodge a complaint for you.
2. Identify the organization and give its full name and contact details.
3. Describe what happened, in date order, and explain why you think it breached your privacy.
4. Attach your evidence: your complaint to the organization, its reply, and any other documents that support your account.
5. Say what outcome you want, such as a correction, an apology, a change in practice or compensation.
6. Keep your reference number for any follow-up.

If you need help, you can ask someone you trust, or a representative, to help you complain. If many people have been affected by the same issue, such as a large data breach, the Privacy Act also allows representative complaints on behalf of a group.

What happens after you complain

The OAIC will first assess your complaint. What happens next depends on the facts, and the time it takes depends on the complexity of the case and the OAIC’s workload.

Possible step	What it means in general terms
Preliminary inquiries	The OAIC may contact the organization to get its side and understand what happened.
Decision not to investigate	The OAIC can decline in some cases, for example if the organization has dealt with it adequately, another body is better placed, or the complaint falls outside its powers.
Conciliation	The OAIC helps you and the organization work toward an agreed outcome. Many complaints are resolved this way.
Investigation and determination	In some cases the Commissioner can make a formal determination, which may require the organization to take steps or, in some cases, pay compensation.

Possible outcomes from conciliation can include an apology, access to or correction of your information, a change to the organization’s practices, or a payment. None of these are guaranteed, and it depends on the facts and on what both sides agree.

The OAIC isn’t your lawyer and doesn’t take sides at the start. If you want to pursue a claim in court, including under the statutory tort for serious invasions of privacy introduced by the 2024 reforms, talk to an Australian lawyer about whether that fits your situation.

A worked example

This is an illustrative scenario, not a real client.

Priya, a bookkeeper in Perth, asks a large online retailer for a copy of the personal information it holds about her after she starts getting targeted marketing from companies she’s never dealt with. She also asks whether it has shared her details.

1. She emails the privacy officer named in the retailer’s privacy policy, asking for access under the Privacy Act and asking who her details have been disclosed to.
2. Thirty-five days later she has had only an automated acknowledgment. She sends one follow-up, quoting her original email and the date.
3. With still no substantive answer, she lodges an OAIC complaint online, attaching both emails and a short timeline.
4. The OAIC contacts the retailer, which then provides the information and explains its marketing partners. Priya asks it to stop disclosing her information for marketing, and the complaint is closed with that agreement.

Priya couldn’t control what the OAIC decided, but her dated paper trail made the complaint easy to assess.

Common mistakes

• Skipping the organization. The OAIC will usually send you back to complain to it first.
• Complaining about the wrong body. State agencies and most small businesses fall outside the OAIC’s usual reach.
• Ignoring industry ombudsmen. For banks, insurers, telcos and energy providers, an external dispute scheme may resolve things faster.
• Sending no evidence. Without copies of your complaint and the reply, the OAIC can’t see what happened.
• Using the OAIC for online content disputes. A negative review or a post by an individual is usually a matter for the platform, eSafety or defamation law, not privacy law.
• Waiting too long. Complain promptly while the facts and records are fresh.

When to get help

You can make an OAIC complaint yourself at no cost. If your concern is about data held overseas, compare the process with our guide on how to make an ICO complaint in the UK or our guide on making a data subject access request, which has request wording you can adapt. If personal information about you is appearing in search results and on websites, our content removal service can help work out which removal routes are realistic.

Frequently asked questions

Is it free to make an OAIC complaint?

Yes. Complaining to the Office of the Australian Information Commissioner is free, and you don’t need a lawyer. Be wary of any service that charges to lodge a complaint for you.

Do I have to complain to the organization first?

Generally yes. The OAIC expects you to complain to the organization first and give it 30 days to respond. If it doesn’t respond in that time, or you’re unhappy with its answer, you can then complain to the OAIC.

Can the OAIC get me compensation?

Sometimes. Conciliation can lead to an agreed payment, and in some cases the Commissioner can make a determination that includes compensation. It isn’t guaranteed and depends on the facts of your complaint.

Can I complain to the OAIC about a state government agency?

Usually not. State and territory agencies are generally covered by their own privacy laws, so complain to the privacy body in your state or territory instead.

How long does an OAIC complaint take?

It depends on how complex the complaint is and how quickly the organization responds. Some complaints are resolved early through inquiries or conciliation, while formal investigations take longer.