How to Make a Privacy Complaint to the OAIC

If an organisation or agency has mishandled your personal information, you can complain to the Office of the Australian Information Commissioner (OAIC), but you must complain to the organisation first and give it about 30 days to respond before the OAIC will consider your complaint under the Privacy Act 1988 (Cth). Complaints about access to, or correction of, credit reporting information are exempt from that complain-first requirement (s 40(1B)) and can go straight to the OAIC. If the respondent belongs to an approved external dispute resolution scheme, such as the Telecommunications Industry Ombudsman or the Australian Financial Complaints Authority, the OAIC may require you to complain to that scheme before it will take your complaint.

This page sits under the Australia data privacy laws guide and focuses only on the complaints pathway: the steps, the conciliation process, and what the Commissioner can order.

Step one: complain to the organisation or agency first

Before the OAIC will look at your complaint, you generally must raise it directly with the organisation or agency you believe mishandled your personal information. Section 40(1A) of the Privacy Act 1988 (Cth) provides that the Commissioner must not investigate a complaint unless the complainant has first complained to the respondent and given it a chance to respond. The OAIC treats 30 days as a reasonable period for the organisation to reply. Put your complaint in writing, describe what happened and when, and say what outcome you want, because you will need a copy of that complaint and the response later. If the organisation does not reply within about 30 days, or its response does not satisfy you, you can escalate. The OAIC recognises limited exceptions where you may not have to complain to the respondent first, for example where there is a significant power imbalance, a systemic issue, or a history of similar conduct. Those three are discretionary. Section 40(1B) goes further and switches the complain-first bar off entirely for complaints about access to, or correction of, credit reporting information (ss 20R, 20T, 21T and 21V, or the matching provisions of the registered CR code), so a credit report access or correction complaint can go straight to the OAIC.

Watch out: Many privacy policies must, under APP 1, tell you how to complain and how the entity handles complaints. Following that internal process and keeping the paperwork makes your OAIC complaint stronger.

Step two: check whether an approved EDR scheme has to deal with it first

For several industries there is a middle tier between the respondent and the OAIC. The Commissioner recognises approved external dispute resolution (EDR) schemes under s 35A of the Privacy Act 1988 (Cth), and the OAIC describes a three-tiered complaint process: the respondent first, then a recognised EDR scheme the respondent belongs to, then the OAIC.

Approved schemes currently handle privacy complaints about a bank, insurer, superannuation fund, financial planner or mortgage broker (the Australian Financial Complaints Authority), a telecommunications provider (the Telecommunications Industry Ombudsman), an electricity, gas or water provider in New South Wales, Queensland, South Australia, Victoria or Western Australia (the relevant energy and water ombudsman) or in the Australian Capital Territory (the ACT Civil and Administrative Tribunal, which is the recognised scheme for ACT utility providers), public transport in Victoria (the Public Transport Ombudsman Victoria), and tolling in New South Wales, Queensland or Victoria (the Tolling Customer Ombudsman).

If a scheme covers your respondent, complain to it first. The OAIC states that you may be required to, and it can decline to investigate where the matter is being or has been dealt with by a recognised EDR scheme (s 41(1)(dc)) or would be more effectively or appropriately dealt with by one (s 41(1)(dd)). It can also transfer the complaint to the scheme under s 50. These schemes are free, and they can usually deal with your non-privacy complaint about the same company at the same time, which the OAIC cannot.

Watch out: Skipping this tier can get a telco, banking or energy privacy complaint redirected or declined at the OAIC. If no approved scheme covers your respondent, go straight to the next step.

Step three: lodge a complaint with the OAIC

If the organisation does not respond in a reasonable time, or you remain dissatisfied after its response and after any approved EDR scheme has dealt with the matter, you can lodge a complaint with the OAIC. Section 36 of the Privacy Act 1988 (Cth) lets an individual complain to the Commissioner about an act or practice that may be an interference with their privacy. The OAIC states that the Act requires your complaint to it to be in writing, so it cannot be taken over the phone. Your submission should include your name and contact details, the organisation's name, a description of what happened and when, a copy of your written complaint to the organisation and its response, any reference numbers, and a statement of the outcome you are seeking. After lodgement, the OAIC may make preliminary inquiries under s 42 to clarify the allegations or confirm it has jurisdiction.

Watch out: Under s 41, the OAIC may decline to investigate on several grounds, including where the complaint was made more than 12 months after you became aware of the act or practice, where it is frivolous, vexatious, misconceived or lacking in substance, or where a recognised external dispute resolution scheme is dealing with it or would deal with it more effectively (s 41(1)(dc) and (dd)). Lodge promptly.

The conciliation process

The OAIC's preferred way to resolve a complaint is conciliation, not a formal ruling. Section 40A(1) of the Privacy Act 1988 (Cth) requires the Commissioner to make a reasonable attempt to conciliate a complaint where the Commissioner considers it reasonably possible that the complaint may be conciliated successfully. That duty does not apply if the Commissioner has already decided under s 41 or s 50 not to investigate (s 40A(2)). Conciliation is a structured, confidential negotiation: the OAIC acts as a neutral facilitator between you and the respondent to reach an agreed outcome, which might be an apology, a change in the organisation's practices, correction or deletion of information, or a payment. Conciliation is confidential, and anything said or admitted during the process generally cannot be used in later proceedings without the parties' consent. If conciliation succeeds, the agreed terms resolve the matter.

Investigation is not an escalation that conciliation has to fail before it starts. Section 40(1) obliges the Commissioner to investigate a complaint made under s 36, subject only to s 40(1A) and the s 41 grounds, so conciliation under s 40A runs alongside that process rather than ahead of it. If the Commissioner is satisfied there is no reasonable likelihood the complaint will be resolved by conciliation, the Commissioner must notify you and the respondent in writing (s 40A(3)) and may then decide not to investigate further (s 40A(4)). Otherwise the investigation continues and can end in a determination.

Determinations and compensation under section 52

Where a complaint is investigated and not resolved by conciliation, the Commissioner can make a determination under s 52 of the Privacy Act 1988 (Cth). The Commissioner may dismiss the complaint under s 52(1)(a), or find the complaint substantiated and make declarations under s 52(1)(b). Those declarations can require that the respondent must not repeat or continue the conduct (s 52(1)(b)(i)), must take specified steps to ensure the conduct is not repeated (s 52(1)(b)(ia)), must perform any reasonable act to redress loss or damage suffered by the complainant (s 52(1)(b)(ii)), and must prepare and publish, or otherwise communicate, a statement about the conduct (s 52(1)(b)(iia), with the mechanics in s 52A). The specified steps can include engaging a suitably qualified independent adviser, in consultation with the Commissioner, to review the respondent's practices and give the review to the Commissioner (s 52(1AAA)). The Commissioner can also declare that it would be inappropriate for any further action to be taken (s 52(1)(b)(iv)), and a determination may include any other order the Commissioner considers necessary or appropriate (s 52(3A)).

The Commissioner can also declare that the complainant is entitled to compensation for any loss or damage suffered (s 52(1)(b)(iii)). Importantly, s 52(1AB) expressly provides that the loss or damage includes injury to the complainant's feelings and humiliation, so this is settled by the words of the Act rather than left to argument. Case law and past determinations guide how much is awarded, and the Commissioner can award aggravated damages as well as general damages. The Commissioner may also declare that the complainant is entitled to a specified amount to reimburse expenses reasonably incurred in connection with making the complaint (s 52(3)).

Watch out: A determination under s 52 is not, on its own, binding or conclusive between the parties (s 52(1B)), and how it is enforced depends on who the respondent is.

If the respondent is an organisation or a small business operator, s 55 obliges it to comply with the declarations. If it does not, the complainant or the Commissioner, and nobody else, can begin proceedings in the Federal Court or the Federal Circuit and Family Court of Australia (s 55A(1)). That court deals with the question whether there was an interference with privacy by way of a hearing de novo (s 55A(5)) and can make such orders as it thinks fit (s 55A(2)).

If the respondent is a Commonwealth agency, s 55A does not apply at all: s 54(1) takes agency determinations out of that Division. Instead the agency must comply with the declarations (s 58), the principal executive must take reasonable steps to ensure compliance (s 59), any compensation or expenses declared is recoverable as a debt due by the agency, or otherwise by the Commonwealth, to you (s 60), and you or the Commissioner can apply to the same two courts for an order directing the agency to comply (s 62). A s 62 application is a compliance order rather than a fresh trial, and it cannot be made until the time for review of the determination has expired or the Administrative Review Tribunal decision has come into operation (s 62(5)).

Time limits to keep in mind

There is no single hard deadline written into the complaint provisions, but timing matters in two ways. First, you should give the organisation a reasonable period to respond before escalating. Section 40(1A) bars the Commissioner from investigating if you did not complain to the respondent first, and the OAIC treats 30 days as a reasonable period to wait. Second, under s 41, the OAIC may decide not to investigate if the complaint was made more than 12 months after you became aware of the act or practice. Acting within 12 months of becoming aware of the issue is the safer course. Note also that the separate statutory tort for serious invasions of privacy, which lets you sue directly in court rather than going through the OAIC, carries its own limitation period and is covered in the parent guide.

The fixed clocks in this process sit at the other end, after a decision. A party can apply to the Administrative Review Tribunal for merits review of a decision under s 52(1) or (1A) to make a determination (s 96(1)(c)), and the Tribunal can affirm, vary or set the determination aside. The OAIC puts that window at 28 days after the day the determination is given, and gives the same 28 days for judicial review of a determination in the Federal Court or the Federal Circuit and Family Court under the Administrative Decisions (Judicial Review) Act 1977. The OAIC guidance still names the former Administrative Appeals Tribunal, which the Administrative Review Tribunal replaced on 14 October 2024. A decision under s 41 not to investigate, or not to investigate further, may itself be challenged under that judicial review Act.

Civil penalties for interferences with privacy

The OAIC complaint system is mainly about resolving an individual's grievance, but conduct that interferes with privacy can also attract civil penalties, which are separate from any compensation to you. Section 13G of the Privacy Act 1988 (Cth) makes it a civil penalty provision to engage in a serious interference with the privacy of an individual. The Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), in force from 13 December 2022, sharply increased the maximum penalties, and the Privacy and Other Legislation Amendment Act 2024 (Cth), in force from 11 December 2024, removed the separate "repeated interference" trigger so that repetition is now one of the factors used to decide whether an interference is serious. For a body corporate, the maximum for a s 13G contravention is the greatest of AUD 50 million, three times the value of the benefit obtained from the conduct, or, if that benefit cannot be determined, 30% of the entity's adjusted turnover during the breach turnover period (s 13G(3)). For a person other than a body corporate the maximum is AUD 2.5 million (s 13G(2)).

The same 2024 amendments added two lower tiers, both in force from 11 December 2024, so the headline figure is no longer the only exposure. Section 13H is contravened by any interference with the privacy of an individual, serious or not, with a maximum of 2,000 penalty units (s 13H(3)). That is AUD 728,000 for conduct on or after 1 July 2026, when the Commonwealth penalty unit rose to AUD 364. That figure is the individual tier. Section 80U(1) makes every civil penalty provision in the Act enforceable under Part 4 of the Regulatory Powers (Standard Provisions) Act 2014, and s 82(5)(a) of that Act caps a body corporate at five times the units specified in the provision, so a company faces up to 10,000 penalty units, or AUD 3,640,000. Section 13G(4) switches that multiplier off for s 13G alone, which is why the s 13G maxima above are already stated as dollar figures. Section 13J lets a court that is satisfied there was an interference, but not that it was serious, make a s 13H penalty order instead of a s 13G one. Section 13K covers specified breaches, including failing to have an APP privacy policy or the required contents in it, denying the option to deal anonymously, the direct marketing opt-out requirements, failures in handling correction requests (APP 13.5), and a non-compliant eligible data breach statement under s 26WK, with a maximum of 200 penalty units (s 13K(4)), or AUD 72,800 on the same basis. Again that is the individual tier: with the s 82(5)(a) multiplier a body corporate faces up to 1,000 penalty units, or AUD 364,000. A s 13K contravention can also be dealt with by an infringement notice (s 80UB) or by a compliance notice requiring the entity to fix the problem (s 80UC), which the entity can ask a court to review. An infringement notice is not the civil penalty, and its amount is set separately. Section 80UB(1A) fixes it at 200 penalty units, AUD 72,800, where the entity is a listed corporation within the meaning of the Corporations Act 2001. Every other entity falls back to s 104(2) of the Regulatory Powers Act, which is the lesser of one-fifth of the maximum a court could impose and 12 penalty units for an individual or 60 for a body corporate.

These penalties are sought by the Commissioner in the Federal Court or the Federal Circuit and Family Court (s 80U) and are paid to the Commonwealth, not to the complainant. They sit alongside, rather than replace, the compensation a complainant may receive through a s 52 determination.