How to Make a Privacy Complaint to the OAIC

If an organisation or agency has mishandled your personal information, you can complain to the Office of the Australian Information Commissioner (OAIC), but you must complain to the organisation first and give it about 30 days to respond before the OAIC will consider your complaint under the Privacy Act 1988 (Cth). Complaints about access to, or correction of, credit reporting information are exempt from that complain-first requirement (s 40(1B)) and can go straight to the OAIC. If the respondent belongs to an approved external dispute resolution scheme, such as the Telecommunications Industry Ombudsman or the Australian Financial Complaints Authority, the OAIC may require you to complain to that scheme before it will take your complaint.

This page sits under the Australia data privacy laws guide and focuses only on the complaints pathway: the steps, the conciliation process, and what the Commissioner can order.

Step one: complain to the organisation or agency first

Before the OAIC will look at your complaint, you generally must raise it directly with the organisation or agency you believe mishandled your personal information. Section 40(1A) of the Privacy Act 1988 (Cth) provides that the Commissioner must not investigate a complaint unless the complainant has first complained to the respondent and given it a chance to respond. The OAIC treats 30 days as a reasonable period for the organisation to reply. Put your complaint in writing, describe what happened and when, and say what outcome you want, because you will need a copy of that complaint and the response later. If the organisation does not reply within about 30 days, or its response does not satisfy you, you can escalate. The OAIC recognises limited exceptions where you may not have to complain to the respondent first, for example where there is a significant power imbalance, a systemic issue, or a history of similar conduct. Those three are discretionary. Section 40(1B) goes further and switches the complain-first bar off entirely for complaints about access to, or correction of, credit reporting information (ss 20R, 20T, 21T and 21V, or the matching provisions of the registered CR code), so a credit report access or correction complaint can go straight to the OAIC.

Watch out: Many privacy policies must, under APP 1, tell you how to complain and how the entity handles complaints. Following that internal process and keeping the paperwork makes your OAIC complaint stronger.

Step two: check whether an approved EDR scheme has to deal with it first

For several industries there is a middle tier between the respondent and the OAIC. The Commissioner recognises approved external dispute resolution (EDR) schemes under s 35A of the Privacy Act 1988 (Cth), and the OAIC describes a three-tiered complaint process: the respondent first, then a recognised EDR scheme the respondent belongs to, then the OAIC.

Approved schemes currently handle privacy complaints about a bank, insurer, superannuation fund, financial planner or mortgage broker (the Australian Financial Complaints Authority), a telecommunications provider (the Telecommunications Industry Ombudsman), an electricity, gas or water provider in New South Wales, Queensland, South Australia, Victoria or Western Australia (the relevant energy and water ombudsman) or in the Australian Capital Territory (the ACT Civil and Administrative Tribunal, which is the recognised scheme for ACT utility providers), public transport in Victoria (the Public Transport Ombudsman Victoria), and tolling in New South Wales, Queensland or Victoria (the Tolling Customer Ombudsman).

If a scheme covers your respondent, complain to it first. The OAIC states that you may be required to, and it can decline to investigate where the matter is being or has been dealt with by a recognised EDR scheme (s 41(1)(dc)) or would be more effectively or appropriately dealt with by one (s 41(1)(dd)). It can also transfer the complaint to the scheme under s 50. These schemes are free, and they can usually deal with your non-privacy complaint about the same company at the same time, which the OAIC cannot.

Watch out: Skipping this tier can get a telco, banking or energy privacy complaint redirected or declined at the OAIC. If no approved scheme covers your respondent, go straight to the next step.

Step three: lodge a complaint with the OAIC

If the organisation does not respond in a reasonable time, or you remain dissatisfied after its response and after any approved EDR scheme has dealt with the matter, you can lodge a complaint with the OAIC. Section 36 of the Privacy Act 1988 (Cth) lets an individual complain to the Commissioner about an act or practice that may be an interference with their privacy. The OAIC states that the Act requires your complaint to it to be in writing, so it cannot be taken over the phone. Your submission should include your name and contact details, the organisation's name, a description of what happened and when, a copy of your written complaint to the organisation and its response, any reference numbers, and a statement of the outcome you are seeking. After lodgement, the OAIC may make preliminary inquiries under s 42 to clarify the allegations or confirm it has jurisdiction.

Watch out: Under s 41, the OAIC may decline to investigate on several grounds, including where the complaint was made more than 12 months after you became aware of the act or practice, where it is frivolous, vexatious, misconceived or lacking in substance, or where a recognised external dispute resolution scheme is dealing with it or would deal with it more effectively (s 41(1)(dc) and (dd)). Lodge promptly.

The conciliation process

The OAIC's preferred way to resolve a complaint is conciliation, not a formal ruling. Section 40A(1) of the Privacy Act 1988 (Cth) requires the Commissioner to make a reasonable attempt to conciliate a complaint where the Commissioner considers it reasonably possible that the complaint may be conciliated successfully. That duty does not apply if the Commissioner has already decided under s 41 or s 50 not to investigate (s 40A(2)). Conciliation is a structured, confidential negotiation: the OAIC acts as a neutral facilitator between you and the respondent to reach an agreed outcome, which might be an apology, a change in the organisation's practices, correction or deletion of information, or a payment. Conciliation is confidential, and anything said or admitted during the process generally cannot be used in later proceedings without the parties' consent. If conciliation succeeds, the agreed terms resolve the matter.

Investigation is not an escalation that conciliation has to fail before it starts. Section 40(1) obliges the Commissioner to investigate a complaint made under s 36, subject only to s 40(1A) and the s 41 grounds, so conciliation under s 40A runs alongside that process rather than ahead of it. If the Commissioner is satisfied there is no reasonable likelihood the complaint will be resolved by conciliation, the Commissioner must notify you and the respondent in writing (s 40A(3)) and may then decide not to investigate further (s 40A(4)). Otherwise the investigation continues and can end in a determination.

Determinations and compensation under section 52

Where a complaint is investigated and not resolved by conciliation, the Commissioner can make a determination under s 52 of the Privacy Act 1988 (Cth). The Commissioner may dismiss the complaint under s 52(1)(a), or find the complaint substantiated and make declarations under s 52(1)(b). Those declarations can require that the respondent must not repeat or continue the conduct (s 52(1)(b)(i)), must take specified steps to ensure the conduct is not repeated (s 52(1)(b)(ia)), must perform any reasonable act to redress loss or damage suffered by the complainant (s 52(1)(b)(ii)), and must prepare and publish, or otherwise communicate, a statement about the conduct (s 52(1)(b)(iia), with the mechanics in s 52A). The specified steps can include engaging a suitably qualified independent adviser, in consultation with the Commissioner, to review the respondent's practices and give the review to the Commissioner (s 52(1AAA)). The Commissioner can also declare that it would be inappropriate for any further action to be taken (s 52(1)(b)(iv)), and a determination may include any other order the Commissioner considers necessary or appropriate (s 52(3A)).

The Commissioner can also declare that the complainant is entitled to compensation for any loss or damage suffered (s 52(1)(b)(iii)). Importantly, s 52(1AB) expressly provides that the loss or damage includes injury to the complainant's feelings and humiliation, so this is settled by the words of the Act rather than left to argument. Case law and past determinations guide how much is awarded, and the Commissioner can award aggravated damages as well as general damages. The Commissioner may also declare that the complainant is entitled to a specified amount to reimburse expenses reasonably incurred in connection with making the complaint (s 52(3)).

Watch out: A determination under s 52 is not, on its own, binding or conclusive between the parties (s 52(1B)), and how it is enforced depends on who the respondent is.

If the respondent is an organisation or a small business operator, s 55 obliges it to comply with the declarations. If it does not, the complainant or the Commissioner, and nobody else, can begin proceedings in the Federal Court or the Federal Circuit and Family Court of Australia (s 55A(1)). That court deals with the question whether there was an interference with privacy by way of a hearing de novo (s 55A(5)) and can make such orders as it thinks fit (s 55A(2)).

If the respondent is a Commonwealth agency, s 55A does not apply at all: s 54(1) takes agency determinations out of that Division. Instead the agency must comply with the declarations (s 58), the principal executive must take reasonable steps to ensure compliance (s 59), any compensation or expenses declared is recoverable as a debt due by the agency, or otherwise by the Commonwealth, to you (s 60), and you or the Commissioner can apply to the same two courts for an order directing the agency to comply (s 62). A s 62 application is a compliance order rather than a fresh trial, and it cannot be made until the time for review of the determination has expired or the Administrative Review Tribunal decision has come into operation (s 62(5)).

Time limits to keep in mind

There is no single hard deadline written into the complaint provisions, but timing matters in two ways. First, you should give the organisation a reasonable period to respond before escalating. Section 40(1A) bars the Commissioner from investigating if you did not complain to the respondent first, and the OAIC treats 30 days as a reasonable period to wait. Second, under s 41, the OAIC may decide not to investigate if the complaint was made more than 12 months after you became aware of the act or practice. Acting within 12 months of becoming aware of the issue is the safer course. Note also that the separate statutory tort for serious invasions of privacy, which lets you sue directly in court rather than going through the OAIC, carries its own limitation period and is covered in the parent guide.

The fixed clocks in this process sit at the other end, after a decision. A party can apply to the Administrative Review Tribunal for merits review of a decision under s 52(1) or (1A) to make a determination (s 96(1)(c)), and the Tribunal can affirm, vary or set the determination aside. The OAIC puts that window at 28 days after the day the determination is given, and gives the same 28 days for judicial review of a determination in the Federal Court or the Federal Circuit and Family Court under the Administrative Decisions (Judicial Review) Act 1977. The OAIC guidance still names the former Administrative Appeals Tribunal, which the Administrative Review Tribunal replaced on 14 October 2024. A decision under s 41 not to investigate, or not to investigate further, may itself be challenged under that judicial review Act.

Civil penalties for interferences with privacy

The OAIC complaint system is mainly about resolving an individual's grievance, but conduct that interferes with privacy can also attract civil penalties, which are separate from any compensation to you. Section 13G of the Privacy Act 1988 (Cth) makes it a civil penalty provision to engage in a serious interference with the privacy of an individual. The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), in force from 13 December 2022, sharply increased the maximum penalties, and the Privacy and Other Legislation Amendment Act 2024 (Cth), in force from 11 December 2024, removed the separate "repeated interference" trigger so that repetition is now one of the factors used to decide whether an interference is serious. For a body corporate, the maximum for a s 13G contravention is the greatest of AUD 50 million, three times the value of the benefit obtained from the conduct, or, if that benefit cannot be determined, 30% of the entity's adjusted turnover during the breach turnover period (s 13G(3)). For a person other than a body corporate the maximum is AUD 2.5 million (s 13G(2)).

The same 2024 amendments added two lower tiers, both in force from 11 December 2024, so the headline figure is no longer the only exposure. Section 13H is contravened by any interference with the privacy of an individual, serious or not, with a maximum of 2,000 penalty units (s 13H(3)). That is AUD 728,000 for conduct on or after 1 July 2026, when the Commonwealth penalty unit rose to AUD 364. That figure is the individual tier. Section 80U(1) makes every civil penalty provision in the Act enforceable under Part 4 of the Regulatory Powers (Standard Provisions) Act 2014, and s 82(5)(a) of that Act caps a body corporate at five times the units specified in the provision, so a company faces up to 10,000 penalty units, or AUD 3,640,000. Section 13G(4) switches that multiplier off for s 13G alone, which is why the s 13G maxima above are already stated as dollar figures. Section 13J lets a court that is satisfied there was an interference, but not that it was serious, make a s 13H penalty order instead of a s 13G one. Section 13K covers specified breaches, including failing to have an APP privacy policy or the required contents in it, denying the option to deal anonymously, the direct marketing opt-out requirements, failures in handling correction requests (APP 13.5), and a non-compliant eligible data breach statement under s 26WK, with a maximum of 200 penalty units (s 13K(4)), or AUD 72,800 on the same basis. Again that is the individual tier: with the s 82(5)(a) multiplier a body corporate faces up to 1,000 penalty units, or AUD 364,000. A s 13K contravention can also be dealt with by an infringement notice (s 80UB) or by a compliance notice requiring the entity to fix the problem (s 80UC), which the entity can ask a court to review. An infringement notice is not the civil penalty, and its amount is set separately. Section 80UB(1A) fixes it at 200 penalty units, AUD 72,800, where the entity is a listed corporation within the meaning of the Corporations Act 2001. Every other entity falls back to s 104(2) of the Regulatory Powers Act, which is the lesser of one-fifth of the maximum a court could impose and 12 penalty units for an individual or 60 for a body corporate.

These penalties are sought by the Commissioner in the Federal Court or the Federal Circuit and Family Court (s 80U) and are paid to the Commonwealth, not to the complainant. They sit alongside, rather than replace, the compensation a complainant may receive through a s 52 determination.

Frequently Asked Questions

Do I have to complain to the company before going to the OAIC?

Generally yes. Section 40(1A) of the Privacy Act 1988 (Cth) means the Commissioner will not investigate unless you first complained to the organisation or agency and gave it a chance to respond. The OAIC's guidance treats 30 days as a reasonable time to wait before escalating. Limited exceptions can apply, for example where there is a significant power imbalance or a systemic issue, and s 40(1B) removes the requirement altogether for complaints about access to, or correction of, credit reporting information. Separately, if the respondent belongs to an approved external dispute resolution scheme, such as the Telecommunications Industry Ombudsman or the Australian Financial Complaints Authority, you may need to complain to that scheme before the OAIC will take the matter.

How long should I give the organisation to respond?

The OAIC considers 30 days a reasonable period for an organisation or agency to respond to your privacy complaint. If it does not reply within about 30 days, or its response does not resolve the matter, the next step is the OAIC, unless the respondent belongs to an approved external dispute resolution scheme such as the Telecommunications Industry Ombudsman, the Australian Financial Complaints Authority, a state energy and water ombudsman, the ACT Civil and Administrative Tribunal for ACT utility providers, the Public Transport Ombudsman Victoria or the Tolling Customer Ombudsman. In that case complain to the scheme first, because the OAIC can decline to investigate under s 41(1)(dc) or (dd).

Does my complaint to the OAIC have to be in writing?

Yes. The OAIC states that the Privacy Act 1988 (Cth) requires complaints to it to be made in writing under s 36, so the OAIC cannot take your complaint over the phone. You can use the OAIC's online form, email, or post.

Is there a deadline for making a privacy complaint?

There is no single fixed cut-off, but under s 41 the OAIC may decline to investigate if the complaint was made more than 12 months after you became aware of the conduct. As a practical matter, lodge within 12 months of becoming aware of the issue.

What is conciliation and is it confidential?

Conciliation is a confidential, OAIC-facilitated negotiation aimed at resolving the complaint without a formal finding, conducted under s 40A of the Privacy Act 1988 (Cth). Outcomes can include an apology, changed practices, correction or deletion of information, or a payment. What is said in conciliation generally cannot be used in later proceedings without the parties' consent.

Can the OAIC order an organisation to pay me compensation?

Yes, through a determination under s 52 of the Privacy Act 1988 (Cth). If the complaint is substantiated, the Commissioner can declare that you are entitled to compensation for loss or damage under s 52(1)(b)(iii), and reimbursement of reasonable expenses under s 52(3). The Commissioner can also order the organisation to stop the conduct and take corrective steps.

Can I be compensated for hurt feelings, not just financial loss?

Yes. Section 52(1AB) of the Privacy Act 1988 (Cth) expressly provides that loss or damage includes injury to the complainant's feelings and humiliation, so compensation is not limited to out-of-pocket financial loss. Case law and past determinations guide how the amount is assessed, and the Commissioner can also award aggravated damages.

What happens if the organisation ignores the OAIC's determination?

That depends on who the respondent is, and a determination is not, on its own, binding or conclusive between the parties (s 52(1B)). If the respondent is an organisation or small business operator, it must comply under s 55, and if it does not, you or the Commissioner can begin proceedings in the Federal Court or the Federal Circuit and Family Court of Australia under s 55A. That court re-hears the interference question de novo and can make the orders it thinks fit. If the respondent is a Commonwealth agency, s 55A does not apply (s 54(1)): the agency must comply under s 58, any compensation or expenses declared is recoverable as a debt (s 60), and you or the Commissioner can apply under s 62 for an order directing the agency to comply once the review window has closed.

What are the penalties for serious privacy breaches in Australia?

It depends on the tier. For a serious interference with privacy under s 13G of the Privacy Act 1988 (Cth), the maximum for a body corporate is the greatest of AUD 50 million, three times the benefit obtained, or 30% of adjusted turnover (s 13G(3)), and for a person other than a body corporate it is AUD 2.5 million (s 13G(2)). The AUD 50 million maximum took effect on 13 December 2022, and from 11 December 2024 repetition is a factor in deciding whether an interference is serious rather than a separate trigger. Since that date any interference has also carried up to 2,000 penalty units under s 13H, and specified privacy policy, anonymity, direct marketing and correction-request breaches carry up to 200 penalty units under s 13K. Both of those are the individual tier. Section 82(5)(a) of the Regulatory Powers Act multiplies them by five for a body corporate, so a company faces up to 10,000 penalty units (AUD 3,640,000) under s 13H and 1,000 penalty units (AUD 364,000) under s 13K. The Commissioner can also pursue a s 13K breach by infringement notice or compliance notice, and the notice amount is a separate figure again: 200 penalty units for a listed corporation under s 80UB(1A), and the lower Regulatory Powers Act default for everyone else. These penalties are paid to the Commonwealth, separate from any compensation to you.

Can the OAIC refuse to investigate my complaint?

Yes. Under s 41 of the Privacy Act 1988 (Cth) the Commissioner can decline to investigate for several reasons, including that the act is not an interference with privacy, the complaint is frivolous, vexatious, misconceived or lacking in substance, more than 12 months have passed since you became aware of it, or a recognised external dispute resolution scheme is dealing with the matter or would deal with it more effectively (s 41(1)(dc) and (dd)). A decision not to investigate may itself be challenged under the Administrative Decisions (Judicial Review) Act 1977.