How to Make a Privacy Complaint in Australia: The OAIC Complaint Process

Making a privacy complaint in Australia starts with the organisation itself, not the regulator. Only after giving it a reasonable opportunity to respond, generally 30 days, can you lodge a written complaint with the Office of the Australian Information Commissioner (OAIC).

This article addresses how an individual makes a privacy complaint about an organisation or agency covered by the Privacy Act 1988 (Cth), through the complaint-handling process administered by the Office of the Australian Information Commissioner (OAIC), current as at 19 July 2026. It does not address complaints under state or territory health-records or information-privacy legislation, which have separate regulators in several states and territories, or bringing a claim under the federal statutory tort for serious invasions of privacy, which is a separate court-based path covered later in this article and in recordinglaw.com's guide to the statutory tort for serious invasions of privacy.

Step One: Complain to the Organisation or Agency Itself

If you think an organisation or agency has mishandled your personal information, you must complain to it directly before the OAIC will consider your complaint. Start by checking its privacy policy, which should set out how to make a complaint, whether in writing, in person or by phone, and the contact details for a privacy officer. The OAIC's own guidance is direct on this point: a complaint to it is a second step, not a first one, and it exists to review how the organisation responded, not to substitute for that first approach entirely.

What to Include in Your Complaint to the Organisation

A complaint to the organisation should include your name, any relevant reference or identification numbers, a description of what happened and when, and any consequences you experienced. State clearly what you would like the organisation to do to resolve the matter. If you complain in writing, include a contact address, phone number and the date. The OAIC publishes a complaint template covering these elements, and following it makes the complaint easier for the organisation to act on and easier for you to rely on later if you need to escalate the matter.

Keep a Record of What You Sent and What You Were Told

Whether you complained in writing, by phone or in person, keep a record. For a written complaint, keep a copy. For a phone or in-person complaint, note the date, the organisation's name, who you spoke to if known, and a description of the matter and what you asked for. Do the same for any response you receive. If you later lodge a complaint with the OAIC, you will need to provide a copy of your complaint to the organisation and, if you have it, its response, so a contemporaneous record matters.

Give the Organisation a Reasonable Time to Respond

The OAIC's guidance treats 30 days as a reasonable period for an organisation or agency to respond to your complaint. This is the OAIC's stated expectation for when it will consider a complaint about the same matter, not a fixed statutory deadline the organisation itself must meet. If the organisation does not respond within that time, or you are not satisfied with its response, you can move to lodging a complaint with the OAIC.

Check Whether an External Dispute Resolution Scheme Applies First

Before complaining to the OAIC, check whether your complaint falls within an approved external dispute resolution (EDR) scheme. EDR schemes are approved to handle privacy complaints in specific sectors, including electricity, gas or water providers in several states and territories, financial service providers, public transport in Victoria, telecommunications providers, and tolling in New South Wales, Queensland or Victoria. For example, a privacy complaint about how a bank handled your personal information generally goes to the Australian Financial Complaints Authority (AFCA), which has the power to deal with privacy complaints as an approved EDR scheme and may also resolve related non-privacy complaints about the same institution at the same time.

How to Lodge a Written Complaint With the OAIC

The Privacy Act 1988 (Cth) requires a complaint to the OAIC to be made in writing; the OAIC cannot take a complaint over the phone. The OAIC's online form is the primary channel, with a downloadable form available by email or post for anyone unable to use it. A complete complaint should include your name and contact details, the name of the organisation or agency (the OAIC cannot progress a complaint without this), a description of what happened and when, a copy of your written complaint to the organisation or details of a verbal complaint and its response, any reference numbers, and what outcome you are seeking. If the complaint involves credit reporting, include a copy of your credit report. You can withdraw a complaint at any time without penalty, and you can nominate a representative, including a lawyer, to act for you using the OAIC's authorised representative form.

Reasons the OAIC May Decline to Investigate

The OAIC will not investigate every complaint it receives. Common reasons it may not investigate include that the complaint does not involve your own personal information, you have not first complained to the organisation or given it an opportunity to respond, you are complaining about something you learned of more than 12 months earlier, the matter is better dealt with by a recognised EDR scheme or another law or agency, or the organisation is not one the Privacy Act 1988 (Cth) covers at all. The OAIC cannot investigate an anonymous complaint, and it will let you know and close the matter if it decides not to proceed, with a right to appeal that decision.

What to Realistically Expect: The OAIC's Enforcement-First Approach

The single most useful thing to understand before you lodge is that the OAIC has publicly changed how it handles individual complaints. In a March 2026 statement, the Commissioner set out a shift towards "a greater focus on enforcement", explaining that resources are being directed at systemic harms and market practices rather than at every individual matter. That shift changes what a complainant should expect, and most guides have not caught up with it.

Three points matter for planning. First, lodging a valid complaint does not mean it will be investigated. The OAIC has said that "[n]ot all individual privacy complaints will be taken through to investigation", and that in exercising its discretion it weighs its "enforcement-focussed stance and our regulatory priorities", alongside whether a complaint meets "a threshold of seriousness that warrants the proportionate investment of our resources". Those considerations sit on top of the specific grounds for declining set out above.

Second, expect delay. The OAIC stated that, as at February 2026, it was "unlikely that we will be able to substantially progress new validly lodged individual privacy complaints for some 6 to 12 months after they are lodged", absent exceptional circumstances. Handling can also be paused where your complaint relates to a matter already under investigation or covered by a representative complaint.

Third, a substantiated complaint does not guarantee a payment. The OAIC has said that where it investigates and finds a complaint substantiated, "although we have the power to make a range of declarations in remediation, we will not always award compensation", and that where the entity has already offered a resolution the OAIC considers reasonable, it is unlikely to take the complaint through to investigation.

None of this makes complaining pointless. It does mean that accepting a reasonable offer from the organisation early is often the faster path, and that the separate court-based statutory tort described below may matter more than it used to for people seeking compensation.

How the OAIC Investigates and What It Can Do

The OAIC acts as an impartial third party, not as an advocate for either side. If it proceeds, it will generally write to the organisation, provide a copy of your complaint, and seek its response, and it may collect further information from you or relevant third parties. The OAIC tries to help both sides agree on an outcome, often through conciliation with a trained conciliator. If agreement is not reached, or if the organisation's response is not adequate, the OAIC can make a formal determination stating what it must do.

Where a breach is very serious, the OAIC may seek a civil penalty through the courts, which functions like a fine and is not paid to the individual who complained.

If You Disagree With the Outcome: Your Review Rights

You have the right to seek judicial review of an OAIC decision or determination in the Federal Court of Australia or the Federal Circuit Court, generally within 28 calendar days of the decision being sent to you (or posted, with the 28 days running from the post date). A court reviewing the decision on judicial review will not re-examine the merits of your complaint; it will consider only whether the OAIC's decision was legally correct or properly exercised. For a merit review of an OAIC determination, an application can be made to the Administrative Review Tribunal (ART), the federal tribunal that replaced the Administrative Appeals Tribunal (AAT) in October 2024 as Australia's general administrative review body; the OAIC's own public statements now refer to the ART, including in relation to a 2026 decision reviewing one of its privacy determinations. Separately, if you think the OAIC itself treated you unfairly in how it handled your complaint, you can make a free complaint to the Commonwealth Ombudsman, which can investigate the OAIC's administrative actions.

The OAIC Complaint Path vs the Statutory Tort: Two Different Routes

Australia now has two distinct ways to respond to a privacy invasion, and they should not be confused. The OAIC complaint process is a regulatory pathway: it is free, does not require a lawyer, and results in conciliation or a determination against an organisation covered by the Privacy Act 1988 (Cth). The statutory tort for serious invasions of privacy, contained in Schedule 2 of the Privacy Act 1988 (Cth) and in force since 10 June 2025, is a civil court action a plaintiff brings directly against a defendant, seeking remedies such as damages, an injunction or an order for an apology. The OAIC has stated plainly that it does not have a direct role in administering the tort and that individuals considering it should seek independent legal advice. The tort is also broader than the OAIC's jurisdiction in one respect: it can apply to an individual or entity that is not an APP entity covered by the Privacy Act, such as a private individual who is not conducting a business.

Recordinglaw.com's Australia data privacy laws hub is the starting point for the wider framework, its overview of the Australian Privacy Principles explains the underlying obligations an OAIC complaint is measured against, and the notifiable data breaches page covers the related complaint path specific to a data breach. If your complaint concerns your employer's handling of your records, see recordinglaw.com's guide to employee records and privacy in Australia, since a significant exemption applies there.

This article provides general legal information about the Office of the Australian Information Commissioner's privacy complaint process under the Privacy Act 1988 (Cth), current as at 19 July 2026. It is not legal advice and does not account for your individual circumstances. For advice about a specific complaint or the statutory tort, consult a legal practitioner admitted in the relevant Australian state or territory.