How to Make a Privacy Complaint in Australia: The OAIC Complaint Process

Making a privacy complaint in Australia starts with the organisation itself, not the regulator. In most cases you can lodge a written complaint with the Office of the Australian Information Commissioner (OAIC) only after giving the organisation a reasonable opportunity to respond, generally 30 days, though the Privacy Act carries two exceptions to that rule.

This article addresses how an individual makes a privacy complaint about an organisation or agency covered by the Privacy Act 1988 (Cth), through the complaint-handling process administered by the Office of the Australian Information Commissioner (OAIC), current as at 19 July 2026. It does not address complaints under state or territory health-records or information-privacy legislation, which have separate regulators in several states and territories, or bringing a claim under the federal statutory tort for serious invasions of privacy, which is a separate court-based path covered later in this article and in recordinglaw.com's guide to the statutory tort for serious invasions of privacy.

Step One: Complain to the Organisation or Agency Itself

If you think an organisation or agency has mishandled your personal information, you must usually complain to it directly before the OAIC will consider your complaint. Start by checking its privacy policy, which should set out how to make a complaint, whether in writing, in person or by phone, and the contact details for a privacy officer.

The OAIC's own guidance is direct on this point: a complaint to it is a second step, not a first one. What the OAIC then investigates is the act or practice you say interfered with your privacy (Privacy Act 1988 (Cth) s 40(1)), not the politeness or adequacy of the reply you received. It describes itself as an impartial third party, acting for neither side, and it may decline to investigate where the organisation has already dealt with your complaint adequately, or has not yet had an adequate opportunity to (s 41(2)).

Two statutory exceptions to the complain-first rule matter. The Commissioner may still investigate a complaint where he or she considers it was not appropriate for you to complain to the respondent, which covers the safety or family-violence situation where the respondent is the person causing the harm (s 40(1A)). And the rule does not apply at all where the complaint is about an act or practice that may breach section 20R, 20T, 21T or 21V of the Privacy Act, or a provision of the registered CR code relating to one of those sections. Those are the access and correction rights for credit reporting information, so a credit reporting access or correction complaint can come straight to the OAIC (s 40(1B)).

What to Include in Your Complaint to the Organisation

A complaint to the organisation should include your name, any relevant reference or identification numbers, a description of what happened and when, and any consequences you experienced. State clearly what you would like the organisation to do to resolve the matter. If you complain in writing, include a contact address, phone number and the date. The OAIC publishes a complaint template covering these elements, and following it makes the complaint easier for the organisation to act on and easier for you to rely on later if you need to escalate the matter.

Keep a Record of What You Sent and What You Were Told

Whether you complained in writing, by phone or in person, keep a record. For a written complaint, keep a copy. For a phone or in-person complaint, note the date, the organisation's name, who you spoke to if known, and a description of the matter and what you asked for. Do the same for any response you receive. If you later lodge a complaint with the OAIC, you will need to provide a copy of your complaint to the organisation and, if you have it, its response, so a contemporaneous record matters.

Give the Organisation a Reasonable Time to Respond

The OAIC's guidance treats 30 days as a reasonable period for an organisation or agency to respond to your complaint. This is the OAIC's stated expectation for when it will consider a complaint about the same matter, not a fixed statutory deadline the organisation itself must meet. If the organisation does not respond within that time, or you are not satisfied with its response, you can move to lodging a complaint with the OAIC.

Check Whether an External Dispute Resolution Scheme Applies First

Before complaining to the OAIC, check whether your complaint falls within an approved external dispute resolution (EDR) scheme. EDR schemes are approved to handle privacy complaints in specific sectors, including electricity, gas or water providers in several states and territories, financial service providers, public transport in Victoria, telecommunications providers, and tolling in New South Wales, Queensland or Victoria. For example, a privacy complaint about how a bank handled your personal information generally goes to the Australian Financial Complaints Authority (AFCA), which has the power to deal with privacy complaints as an approved EDR scheme and may also resolve related non-privacy complaints about the same institution at the same time.

How to Lodge a Written Complaint With the OAIC

The Privacy Act 1988 (Cth) requires a complaint to the OAIC to be made in writing; the OAIC cannot take a complaint over the phone. The OAIC's online form is the primary channel, with a downloadable form available by email or post for anyone unable to use it. A complete complaint should include your name and contact details, the name of the organisation or agency (the OAIC cannot progress a complaint without this), a description of what happened and when, a copy of your written complaint to the organisation or details of a verbal complaint and its response, any reference numbers, and what outcome you are seeking. If the complaint involves credit reporting, include a copy of your credit report. A complaint about access to, or correction of, credit reporting information is the one class that does not require you to approach the credit reporting body or credit provider first (s 40(1B)). You can withdraw a complaint at any time without penalty, and you can nominate a representative, including a lawyer, to act for you using the OAIC's authorised representative form.

Reasons the OAIC May Decline to Investigate

The OAIC will not investigate every complaint it receives. Common reasons it may not investigate include that the complaint does not involve your own personal information, you have not first complained to the organisation or given it an opportunity to respond, you are complaining about something you learned of more than 12 months earlier, the matter is better dealt with by a recognised EDR scheme or another law or agency, or the organisation is not one the Privacy Act 1988 (Cth) covers at all. The OAIC cannot investigate an anonymous complaint, and it will let you know and close the matter if it decides not to proceed. A decision under section 41 not to investigate, or not to investigate further, cannot be taken to the Administrative Review Tribunal for a merits review; the avenue against it is judicial review in the Federal Court of Australia or the Federal Circuit and Family Court of Australia (Division 2).

What to Realistically Expect: The OAIC's Enforcement-First Approach

The single most useful thing to understand before you lodge is that the OAIC has publicly changed how it handles individual complaints. In a March 2026 statement, the Commissioner set out a shift towards "a greater focus on enforcement", explaining that resources are being directed at systemic harms and market practices rather than at every individual matter. That shift changes what a complainant should expect, and most guides have not caught up with it.

Three points matter for planning. First, lodging a valid complaint does not mean it will be investigated. The OAIC has said that "[n]ot all individual privacy complaints will be taken through to investigation", and that in exercising its discretion it weighs its "enforcement-focussed stance and our regulatory priorities", alongside whether a complaint meets "a threshold of seriousness that warrants the proportionate investment of our resources". Those considerations sit on top of the specific grounds for declining set out above.

Second, expect delay. The OAIC stated that, as at February 2026, it was "unlikely that we will be able to substantially progress new validly lodged individual privacy complaints for some 6 to 12 months after they are lodged", absent exceptional circumstances. Handling can also be paused where your complaint relates to a matter already under investigation or covered by a representative complaint.

Third, a substantiated complaint does not guarantee a payment. The OAIC has said that where it investigates and finds a complaint substantiated, "although we have the power to make a range of declarations in remediation, we will not always award compensation", and that where the entity has already offered a resolution the OAIC considers reasonable, it is unlikely to take the complaint through to investigation.

None of this makes complaining pointless. It does mean that accepting a reasonable offer from the organisation early is often the faster path, and that the separate court-based statutory tort described below may matter more than it used to for people seeking compensation.

How the OAIC Investigates and What It Can Do

The OAIC acts as an impartial third party, not as an advocate for either side. If it proceeds, it will generally write to the organisation, provide a copy of your complaint, and seek its response, and it may collect further information from you or relevant third parties. The OAIC tries to help both sides agree on an outcome, often through conciliation with a trained conciliator. If agreement is not reached, or if the organisation's response is not adequate, the OAIC can make a formal determination setting out what the organisation or agency must do. A determination is not the end of the matter. Section 52(1B) of the Privacy Act 1988 (Cth) provides that it is not binding or conclusive between the parties, and how it is given effect depends on who the respondent is, as the next section explains.

Where a breach is very serious, the OAIC may seek a civil penalty through the courts, which functions like a fine and is not paid to the individual who complained.

Getting a Determination Enforced

A determination in your favour is not self-executing, and this is the single most consequential feature of the Australian complaint path. Under section 52(1B) of the Privacy Act 1988 (Cth), a determination made under section 52(1) or (1A) is not binding or conclusive between any of the parties to it. What happens next turns on who the respondent is.

Where the respondent is a company, another organisation or a small business operator, section 55 obliges it to comply. If it does not, the determination has to be enforced in court. Section 55A allows you, where the determination was made on your complaint, or the Commissioner, to commence proceedings in the Federal Court of Australia or the Federal Circuit and Family Court of Australia (Division 2) for an order to enforce it.

Those proceedings are not a rubber stamp on the OAIC's findings. Section 55A(5) requires the court to deal by way of a hearing de novo with the question whether the respondent engaged in conduct that constitutes an interference with the privacy of an individual. If satisfied that it did, the court may make such orders, including a declaration of right, as it thinks fit, and it may grant an interim injunction in the meantime. The Commissioner's written reasons and the material that was before the Commissioner are admissible (s 55A(6)), and an evidentiary certificate issued under section 55B is prima facie evidence of the Commissioner's findings of fact, although not of a finding that an Australian Privacy Principle or a registered APP code was breached.

Where the respondent is a Commonwealth agency or the principal executive of an agency, that enforcement division does not apply (s 54(1)). Instead section 58 obliges the agency to comply with the determination, section 60 makes any compensation or expenses declared in the determination recoverable as a debt due by the agency or the Commonwealth, and section 62 allows you or the Commissioner to apply to the Federal Court of Australia or the Federal Circuit and Family Court of Australia (Division 2) for an order directing the agency to comply. A section 62 application cannot be made until the time for an Administrative Review Tribunal application has expired, or the Tribunal has decided such an application and its decision has come into operation.

The practical consequence is that a determination against an organisation may still require a court case to realise, while the statutory tort described below runs on its own short limitation clock. If you are weighing both paths, take legal advice before that clock expires.

If You Disagree With the Outcome: Your Review Rights

You have the right to seek judicial review of an OAIC decision or determination in the Federal Court of Australia or the Federal Circuit and Family Court of Australia (Division 2), generally within 28 calendar days of the decision being sent to you (or posted, with the 28 days running from the post date). A court reviewing the decision on judicial review will not re-examine the merits of your complaint; it will consider only whether the OAIC's decision was legally correct or properly exercised.

Merits review is narrower. Section 96(1) of the Privacy Act 1988 (Cth) sets out the decisions of the Commissioner that can be taken to the Administrative Review Tribunal, and the only complaint-related entry is paragraph (c), a decision under section 52(1) or (1A) to make a determination. A decision under section 41 not to investigate, or not to investigate further, is not on that list, so judicial review is the only court avenue against it. That distinction matters here, because the OAIC has said a refusal to take a complaint through to investigation is now a common outcome. The ART is the federal tribunal that replaced the Administrative Appeals Tribunal (AAT) in October 2024 as Australia's general administrative review body, and the OAIC's own public statements now refer to the ART, including in relation to a 2026 decision reviewing one of its privacy determinations.

Separately, if you think the OAIC itself treated you unfairly in how it handled your complaint, you can make a free complaint to the Commonwealth Ombudsman, which can investigate the OAIC's administrative actions.

The OAIC Complaint Path vs the Statutory Tort: Two Different Routes

Australia now has two distinct ways to respond to a privacy invasion, and they should not be confused. The OAIC complaint process is a regulatory pathway: it is free, does not require a lawyer, and results in conciliation or a determination against an organisation covered by the Privacy Act 1988 (Cth). The statutory tort for serious invasions of privacy, contained in Schedule 2 of the Privacy Act 1988 (Cth) and in force since 10 June 2025, is a civil court action a plaintiff brings directly against a defendant, seeking remedies such as damages, an injunction or an order for an apology. The OAIC has stated plainly that it does not have a direct role in administering the tort and that individuals considering it should seek independent legal advice. Damages for non-economic loss, together with any exemplary or punitive damages, are capped at the greater of $478,550 and the maximum non-economic loss damages available in defamation proceedings under an Australian law, and a court cannot award aggravated damages (Schedule 2, clauses 11(2) and 11(5)).

The tort is broader than the OAIC's jurisdiction in one respect: it can apply to an individual or entity that is not an APP entity covered by the Privacy Act, such as a private individual who is not conducting a business. It is narrower in another. Part 3 of Schedule 2 exempts whole classes of defendant. The Schedule does not apply to an invasion of privacy by a journalist, a journalist's employer or engager, or a person assisting a journalist, to the extent it involves collecting, preparing for publication or publishing journalistic material (clause 15); by an agency or a State or Territory authority, or a staff member of one, acting in good faith in performing a function or exercising a power (clauses 16 and 16A); by a law enforcement body or a staff member of one acting in their duties (clause 16B); by an intelligence agency (clause 17); or by a person who is under 18 years of age (clause 18).

Recordinglaw.com's Australia data privacy laws hub is the starting point for the wider framework, its overview of the Australian Privacy Principles explains the underlying obligations an OAIC complaint is measured against, and the notifiable data breaches page covers the related complaint path specific to a data breach. If your complaint concerns your employer's handling of your records, see recordinglaw.com's guide to employee records and privacy in Australia, since a significant exemption applies there.

This article provides general legal information about the Office of the Australian Information Commissioner's privacy complaint process under the Privacy Act 1988 (Cth), current as at 19 July 2026. It is not legal advice and does not account for your individual circumstances. For advice about a specific complaint or the statutory tort, consult a legal practitioner admitted in the relevant Australian state or territory.