What to do today
1. Write to the organisation or agency that mishandled your information. Look for the privacy policy on its website. It should explain how to complain and give a privacy officer's contact details. Say what happened and when, why you think your information was mishandled, what it has cost you, and what you want them to do (for example, delete it, give you access, correct it, apologise or pay for a loss). The OAIC has a template letter on its Complain to an organisation or agency page.
2. Keep proof of the date. Send it by email or through the organisation's online form, and keep a copy. If you complain by phone or in person, write down the date, who you spoke to and what you asked for. The OAIC will ask for a copy of your complaint and any reply.
3. Diary two dates. First, 30 days from the day you complained. The OAIC says that is a reasonable time for the organisation to respond. If you get no reply by then, or a reply you are not satisfied with, you can go to the OAIC. Second, 12 months from the day you found out about the problem. The OAIC may decide not to investigate a complaint made more than 12 months after you became aware of it (Privacy Act 1988 (Cth) s 41(1)(c)).
4. Then lodge with the OAIC. Use the OAIC privacy complaint form. It is free to lodge a complaint and you do not need a lawyer. The OAIC does not take complaints over the phone, but you can email oaicintake@oaic.gov.au or post to GPO Box 5288, Sydney NSW 2001. For questions, call 1300 363 992 (Monday to Thursday, 10 am to 4 pm).
The wait: the OAIC does not publish a set time for handling a complaint.
This is legal information about the Privacy Act 1988 (Cth), not legal advice.
Who you can complain about
The OAIC handles complaints about Australian Government agencies and organisations covered by the Privacy Act. That includes businesses with annual turnover of more than $3 million, and some smaller ones regardless of turnover: for example any business that provides a health service and holds health information, one that sells or buys personal information, a contractor to the Commonwealth, and a credit reporting body (s 6D(4)).
You can complain about how your personal information was collected, used, disclosed, stored or kept secure. Common complaints are a wrongful disclosure (your details sent to the wrong person, or shared without a good reason), a refusal to give you access to your own information, a refusal to correct it, and a data breach. The Act does not cover the information of someone who has died.
Asking for your own information. A federal agency must respond to a request for access within 30 days, and it cannot charge you for the request or for giving access. A private organisation must respond within a reasonable period, and while it can charge for giving access, the charge must not be excessive and cannot apply to making the request (Australian Privacy Principle 12.4, 12.7 and 12.8, in Schedule 1 of the Act). If it refuses, it must tell you why in writing and how to complain (APP 12.9).
Do you have to complain to them first?
Usually yes. The Commissioner must not investigate if you did not complain to the organisation or agency first, unless the Commissioner considers it was not appropriate for you to do so (s 40(1A)). The OAIC's guide to its complaint process says this can apply where there is a significant power imbalance, a history of similar issues with that organisation, or a systemic problem. If that is you, explain why in your OAIC complaint.
The OAIC can also decline to investigate if the organisation has not yet had an adequate opportunity to deal with your complaint (s 41(2)(b)). That is why waiting the 30 days matters.
If the organisation belongs to an external dispute resolution scheme (for example a bank, insurer, energy, water or phone company), the OAIC may expect you to use that scheme instead, and can decline a complaint that the scheme has dealt with or would deal with better (s 41(1)(dc) and (dd)). See the OAIC's list of external dispute resolution schemes.
What to put in your OAIC complaint
Your complaint must be in writing and must name the organisation or agency you are complaining about (s 36(3) and (5)). OAIC staff must help you put it together if you need help (s 36(4)). The OAIC asks for:
- your name and contact details
- the organisation's or agency's name, and its ABN if you know it
- what happened and when
- a copy of your complaint to them (or notes of a verbal one) and their reply
- any reference numbers, and anything they have done to fix the problem
- the outcome you want
You can complain for someone else with their consent and written authority. If many people were affected by the same conduct, one of them can make a representative complaint for all of them (s 36(2)).
What the OAIC can do
First the OAIC may make preliminary inquiries of you or the organisation (s 42), and it tries to resolve complaints early. If it thinks a complaint can be settled, it must make a reasonable attempt to conciliate (s 40A). Conciliation is usually a phone conference with both sides and a trained conciliator, and what is said in it cannot be used later in a hearing or court case (s 40A(5)).
If that does not resolve it, the OAIC can investigate. After an investigation the Commissioner can dismiss the complaint, or find it substantiated and make a determination (s 52). A determination can order the organisation or agency to stop the conduct, take specific steps so it does not happen again, publish a statement, take reasonable steps to fix your loss, and pay you compensation. Loss includes injury to feelings and humiliation, not just money (s 52(1AB)). The OAIC says compensation needs evidence of loss or damage caused directly by the breach.
A determination is not binding on its own. If an organisation does not comply, you or the Commissioner can ask the Federal Court or the Federal Circuit and Family Court to enforce it (s 55A).
If you were told about a data breach
Organisations and agencies covered by the Act must notify you if a data breach involving your information is likely to cause you serious harm (ss 26WE, 26WL). Act on the letter today: the OAIC says to change your email and banking passwords, turn on multi-factor authentication, tell your bank, check your statements and get a copy of your credit report, and to treat calls and emails about the breach with care because scammers target people after a breach. The full checklist (including what to do about a leaked licence, Medicare card or tax file number) is on the OAIC page Act quickly if you're affected by a data breach.
If you want to complain about the breach itself, or that you were not told quickly enough, the same steps apply: complain to the organisation first, then the OAIC (see Make a data breach complaint).
Worked example
On Monday 2 March 2026, Mei finds out that a private health clinic emailed her test results to another patient. The clinic is covered by the Act because it provides a health service and holds health information.
On Wednesday 4 March 2026, she emails the clinic's privacy officer with what happened, how it has affected her, and that she wants an apology, an explanation of what the clinic has changed, and compensation for the distress. She saves the sent email.
The 30 days runs from the day after she complained, so it ends on Friday 3 April 2026. The clinic sends only a short reply saying it is "looking into it". On Monday 6 April 2026, Mei lodges the OAIC online form, attaching her email and the clinic's reply. She is well inside the 12 months, which would run to Tuesday 2 March 2027.
Other routes
Credit report errors. A wrong default or enquiry on your credit report has its own correction rules and a free AFCA route. See How to fix an error on your credit report.
A federal agency refused your FOI request. Getting documents from a Commonwealth agency under freedom of information, and reviewing a refusal, is a separate process with its own clocks. See FOI request refused or ignored.
State and territory agencies. The Privacy Act does not cover state, territory or local government agencies. Complaints about them go to the privacy or information commissioner for that state or territory, listed on the OAIC's state and territory privacy legislation page.