How to Make a Privacy Complaint to the OAIC

If an organisation or agency has mishandled your personal information, you can complain to the Office of the Australian Information Commissioner (OAIC), but you must complain to the organisation first and give it about 30 days to respond before the OAIC will consider your complaint under the Privacy Act 1988 (Cth).

This page sits under the Australia data privacy laws guide and focuses only on the complaints pathway: the steps, the conciliation process, and what the Commissioner can order.

Step one: complain to the organisation or agency first

Before the OAIC will look at your complaint, you generally must raise it directly with the organisation or agency you believe mishandled your personal information. Section 40(1A) of the Privacy Act 1988 (Cth) provides that the Commissioner must not investigate a complaint unless the complainant has first complained to the respondent and given it a chance to respond. The OAIC treats 30 days as a reasonable period for the organisation to reply. Put your complaint in writing, describe what happened and when, and say what outcome you want, because you will need a copy of that complaint and the response later. If the organisation does not reply within about 30 days, or its response does not satisfy you, you can escalate. The OAIC recognises limited exceptions where you may not have to complain to the respondent first, for example where there is a significant power imbalance, a systemic issue, or a history of similar conduct.

Watch out: Many privacy policies must, under APP 1, tell you how to complain and how the entity handles complaints. Following that internal process and keeping the paperwork makes your OAIC complaint stronger.

Step two: lodge a complaint with the OAIC

If the organisation does not respond in a reasonable time or you remain dissatisfied, you can lodge a complaint with the OAIC. Section 36 of the Privacy Act 1988 (Cth) lets an individual complain to the Commissioner about an act or practice that may be an interference with their privacy. The OAIC states that the Act requires your complaint to it to be in writing, so it cannot be taken over the phone. Your submission should include your name and contact details, the organisation's name, a description of what happened and when, a copy of your written complaint to the organisation and its response, any reference numbers, and a statement of the outcome you are seeking. After lodgement, the OAIC may make preliminary inquiries under s 42 to clarify the allegations or confirm it has jurisdiction.

Watch out: Under s 41, the OAIC may decline to investigate on several grounds, including where the complaint was made more than 12 months after you became aware of the act or practice, where it is frivolous or lacking in substance, or where another body is better placed to handle it. Lodge promptly.

The conciliation process

The OAIC's preferred way to resolve a complaint is conciliation, not a formal ruling. Section 40A of the Privacy Act 1988 (Cth) directs the Commissioner to attempt to conciliate a complaint where it appears reasonably possible that the matter can be settled by conciliation and it is appropriate to do so. Conciliation is a structured, confidential negotiation: the OAIC acts as a neutral facilitator between you and the respondent to reach an agreed outcome, which might be an apology, a change in the organisation's practices, correction or deletion of information, or a payment. Conciliation is confidential, and anything said or admitted during the process generally cannot be used in later proceedings without the parties' consent. If conciliation succeeds, the agreed terms resolve the matter. If it fails, or the complaint raises a systemic issue that warrants a formal outcome, the Commissioner can move to a formal investigation under s 40 and, ultimately, a determination.

Determinations and compensation under section 52

Where a complaint is investigated and not resolved by conciliation, the Commissioner can make a determination under s 52 of the Privacy Act 1988 (Cth). The Commissioner may dismiss the complaint under s 52(1)(a), or find the complaint substantiated and make declarations under s 52(1)(b). Those declarations can require that the respondent must not repeat or continue the conduct (s 52(1)(b)(i)), must take specified steps to ensure the conduct is not repeated (s 52(1)(b)(ia)), and must perform any reasonable act to redress loss or damage suffered by the complainant (s 52(1)(b)(ii)).

The Commissioner can also declare that the complainant is entitled to compensation for any loss or damage suffered (s 52(1)(b)(iii)). Importantly, the OAIC and the courts have generally held that loss or damage in this context can include injury to the complainant's feelings and humiliation, not only financial loss. The Commissioner may also declare that the complainant is entitled to a specified amount to reimburse expenses reasonably incurred in connection with making the complaint (s 52(3)).

Watch out: A determination under s 52 is not, on its own, binding or conclusive between the parties. To make it enforceable, either you or the Commissioner can begin proceedings in the Federal Court or the Federal Circuit and Family Court of Australia to enforce the determination (s 55A).

Time limits to keep in mind

There is no single hard deadline written into the complaint provisions, but timing matters in two ways. First, you should give the organisation a reasonable period, treated by the OAIC as around 30 days, to respond before escalating (s 40(1A)). Second, under s 41, the OAIC may decide not to investigate if the complaint was made more than 12 months after you became aware of the act or practice. Acting within 12 months of becoming aware of the issue is the safer course. Note also that the separate statutory tort for serious invasions of privacy, which lets you sue directly in court rather than going through the OAIC, carries its own limitation period and is covered in the parent guide.

Civil penalties for serious or repeated interferences

The OAIC complaint system is mainly about resolving an individual's grievance, but the most serious conduct can attract civil penalties separate from any compensation to you. Section 13G of the Privacy Act 1988 (Cth) makes it a civil penalty provision to engage in a serious interference with the privacy of an individual. The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), in force from 13 December 2022, sharply increased the maximum penalties, and the Privacy and Other Legislation Amendment Act 2024 (Cth), in force from 11 December 2024, removed the separate "repeated interference" trigger so that repetition is now one of the factors used to decide whether an interference is serious. For a body corporate, the maximum is now the greatest of AUD 50 million, three times the value of the benefit obtained from the conduct, or, if that benefit cannot be determined, 30% of the entity's adjusted turnover during the breach turnover period. These penalties are sought by the Commissioner in the Federal Court and are paid to the Commonwealth, not to the complainant. They sit alongside, rather than replace, the compensation a complainant may receive through a s 52 determination.