How to Make a Privacy Complaint When Your Personal Information Is Mishandled

When can you make a privacy complaint?

You can complain when you believe an organisation or agency covered by the Privacy Act 1988 has mishandled your personal information. Handling includes collecting, using or disclosing personal information. Complaints can also concern sensitive information such as health information, credit reporting information, tax file numbers and certain criminal-record information.

The OAIC can receive complaints about Australian Government agencies and organisations covered by the Privacy Act. Organisations with annual turnover above $3 million are generally covered, while some smaller organisations are also covered, including private-sector health service providers, businesses that trade in personal information, credit reporting bodies and certain other specified entities.

Generally, the matter must have occurred less than 12 months ago.

You must usually complain to the organisation or agency first

Before lodging a privacy complaint with the OAIC, complain directly to the organisation or agency you believe mishandled your information. Check its privacy policy first. The policy should explain how complaints can be made and provide contact details for its privacy officer.

Your complaint should identify you, provide any relevant account or reference number, explain what happened and when, describe the consequences and state what you want the entity to do to resolve the problem. For a written complaint, include your contact address, phone number and the date.

The OAIC considers 30 days a reasonable time for the organisation or agency to respond. If there is no response after that period, or you are dissatisfied with the response, escalation may be appropriate.

What evidence should you keep?

Keep a copy of the complaint you send and any written response. If you complain by phone or in person, make a record showing the date, the organisation or agency, the person you spoke to if known, what happened, why you believe your information was mishandled and what resolution you requested.

Also keep records of later responses, including dates, names of people you spoke with and what the entity said or offered to do. You will need to provide a copy of your complaint, or details of a verbal complaint, if you later complain to the OAIC.

Do you need to use an external dispute resolution scheme?

Possibly. Before complaining to the OAIC, you may be required to complain to an approved external dispute resolution scheme first. OAIC-approved schemes deal with privacy complaints in sectors including financial services, telecommunications, certain electricity, gas and water providers, Victorian public transport, and tolling in New South Wales, Queensland and Victoria.

For example, the OAIC directs privacy complaints about banks and financial services to the Australian Financial Complaints Authority where that approved scheme can deal with the matter. Checking the appropriate dispute-resolution route before lodging with the OAIC can prevent your complaint being sent elsewhere.

How do you escalate a complaint to the OAIC?

If the initial complaint has not resolved the problem and the OAIC is the appropriate regulator, you can submit the OAIC privacy complaint form online. A complaint to the OAIC must be made in writing; the OAIC cannot accept the complaint over the phone.

If you cannot access the online form, the OAIC provides a downloadable privacy complaint form that can be emailed to its intake team or posted to the OAIC.

Your OAIC complaint should include your name and contact details, the name of the organisation or agency, what happened and when, your original complaint and the entity's response, relevant reference numbers, any steps the entity has taken to fix the issue and the outcome you want. Include the entity's ABN if you know it. For a credit-reporting complaint, the OAIC asks you to include a copy of your credit report.

Can someone make the complaint for you?

Yes. You can nominate a representative, including a lawyer. If someone lodges the complaint for you, you must give them consent and written authority, subject to any legal limitation on their ability to act for you. The OAIC requires its Privacy Complaint Authorised Representative Form to be provided so it can communicate with the representative.

You can also withdraw an OAIC privacy complaint at any time without penalty.

What if the complaint is about a state or territory agency?

The federal Privacy Act generally does not cover state or territory government agencies, including state and territory public hospitals and healthcare facilities, although there are limited exceptions. Most jurisdictions have their own privacy or information-handling arrangements and regulators.

This distinction matters before lodging with the OAIC. For example, privacy complaints about public-sector agencies in New South Wales, Queensland, the Northern Territory, Tasmania and Victoria are directed to the relevant jurisdictional regulator. The ACT has an ACT Privacy Commissioner, while Western Australia's Privacy and Information Sharing Act 2024 commenced on 1 July 2026. Private-sector health providers are covered by the federal Privacy Act across Australia, although additional state or territory health privacy laws can also apply in some jurisdictions.

What if the Privacy Act does not cover the organisation?

Not every privacy problem falls within the OAIC's Privacy Act complaint jurisdiction. The Privacy Act generally does not cover an individual acting in a personal capacity, most small business operators unless an exception applies, public schools, most state and territory government agencies, registered political parties and political representatives, and certain acts or practices of media organisations acting in journalism. A private-sector employer's handling of employee records may also be exempt in particular circumstances.

If your problem concerns an identity document rather than how an organisation handled your information, the appropriate process may be different. For example, separate procedures apply to changing passport identity details and updating your USI personal details.

What happens after you lodge with the OAIC?

The OAIC considers the information you provide when deciding how to handle your complaint. It is not required to seek additional information beyond the material available and may decide not to investigate or may proceed with an investigation. Where appropriate, the OAIC may seek information from you or the respondent, attempt early resolution or conciliation, investigate the complaint, or make other decisions available under the Privacy Act.

There is no standard published completion time for every individual complaint. The OAIC stated in 2026 that it had a significant backlog and that, as at February 2026, it was unlikely to substantially progress new validly lodged individual privacy complaints for approximately 6 to 12 months after lodgement, unless exceptional circumstances warranted faster consideration. This is a workload estimate, not a statutory deadline or a guaranteed processing time.