A Company Leaked My Personal Information: What Can I Do? (The 30-Day Letter the OAIC Needs First)

The notification email was three paragraphs of corporate calm: “We recently identified unauthorised access… your name, date of birth, address and driver licence number may have been affected… we take your privacy seriously.” Two weeks later someone tried to open a phone account in your name. Or it was smaller and more personal: the physio’s receptionist sent your treatment notes to another patient, or your manager forwarded your medical certificate to the team WhatsApp.

The Privacy Act 1988 gives you a right to complain, a right to an explanation, a right to access and correction, and a path to compensation. But it has a gate: the Office of the Australian Information Commissioner will generally not investigate until you’ve complained to the organisation in writing and given it a reasonable period, treated in practice as 30 days, to respond. The first letter is not a formality. It’s the document the whole process runs on.

Your rights

• The Australian Privacy Principles (Schedule 1 to the Privacy Act 1988 (Cth)) bind Australian Government agencies and most private organisations with turnover above $3 million, plus all health service providers, credit providers and some others regardless of size. APP 6 limits use and disclosure to the purpose of collection; APP 11 requires reasonable security and destruction of information no longer needed; APP 12 gives you access; APP 13 gives you correction.
• Notifiable data breaches. Part IIIC requires an entity that suffers an eligible data breach likely to result in serious harm to notify you and the OAIC, and to tell you what happened and what to do.
• Complain to the entity first, then the OAIC. Section 40(1A) means the Commissioner will ordinarily require that you have complained to the respondent first. The OAIC may decline a complaint lodged more than 12 months after you became aware of the conduct, so the escalation clock is real.
• Remedies. The Commissioner can make a determination under s 52 requiring the entity to stop the conduct, take corrective steps, apologise, and pay compensation for loss including non-economic loss (distress). Serious or repeated interferences can attract civil penalties.
• A new tort. Since 10 June 2025 the Act also creates a statutory cause of action for serious invasions of privacy (intentional or reckless intrusion or misuse), litigated in court rather than through the OAIC. It sits alongside the complaint route; it doesn’t replace it.

By state

The Privacy Act is federal and applies to private organisations and Commonwealth agencies everywhere. If the entity is a state or territory government body (a public hospital, a state school, a council, police, a state department), a state law applies instead:

• New South Wales. Privacy and Personal Information Protection Act 1998 and Health Records and Information Privacy Act 2002; ask the agency for an internal review within 6 months; review of that decision by NCAT. The Information and Privacy Commission New South Wales oversees.
• Victoria. Privacy and Data Protection Act 2014 (Office of the Victorian Information Commissioner) for public-sector personal information; Health Records Act 2001 (Health Complaints Commissioner) for health information, including private providers in Victoria.
• Queensland. Information Privacy Act 2009; complain to the agency first, then to the Office of the Information Commissioner (s 164); the Queensland Privacy Principles apply from 1 July 2025.
• Western Australia. Privacy and Responsible Information Sharing Act 2024 is being brought into operation in stages; until it fully applies to the relevant agency, the Western Australia Ombudsman and the Health and Disability Services Complaints Office handle public-sector privacy grievances. Check which regime applies on the date of your complaint.
• South Australia. No privacy statute; state agencies follow the Information Privacy Principles Instruction, and complaints go to the South Australia Ombudsman (health complaints to the Health and Community Services Complaints Commissioner).
• Tasmania. Personal Information Protection Act 2004; complaints to the Tasmanian Ombudsman after complaining to the agency.
• Australian Capital Territory. Information Privacy Act 2014, with complaints handled by the OAIC under an arrangement with the Territory; Health Records (Privacy and Access) Act 1997 for health records (ACT Human Rights Commission).
• Northern Territory. Information Act 2002; complaints to the Northern Territory Information Commissioner after complaining to the public-sector organisation.

The Claim Done document asks your state first and, where the entity is a state body, drafts to that state’s Act and complaint pathway instead of the federal Act.

What to do right now

1. Protect yourself before you write. If ID documents were exposed, contact IDCARE (free), put a ban on your credit file with Equifax, Experian and illion, and replace the compromised document through the issuing agency.
2. Collect the facts. The notification, the misdirected email, screenshots, dates, names. Who disclosed what, to whom, when, and how you found out.
3. Quantify the harm. Time spent, fees for document replacement, a GP visit for anxiety, lost work, the practical consequences of a colleague knowing your diagnosis. Compensation follows evidence.
4. Send the formal complaint and give 30 days. Identify the APPs breached, ask for a written explanation of what happened and why, ask what has been done to contain it, request access to everything they hold on you (APP 12) and correction or deletion where appropriate, and state the remedy: apology, security changes, and a specified sum.
5. Diarise day 31. No response, or an inadequate one, and the OAIC complaint goes in, attaching your letter and their reply.

What “adequate response” looks like, and what usually arrives

A proper response tells you what information was involved, how the breach happened, who received it, what has been done to retrieve or secure it, what has been changed so it doesn’t recur, and what they propose by way of remedy. What usually arrives is a template apology and a year of credit monitoring. That is not nothing, but it does not address the APP 11 failure or your loss, and accepting it in silence weakens the later complaint. Reply briefly, in writing, saying which of your questions remain unanswered and that you will be lodging with the OAIC. Conciliation at the OAIC produces apologies, undertakings and payments regularly; determinations with compensation orders are less common but do happen, and the size of the class of affected people (in a large breach) does not bar an individual complaint.

Who to complain to

The organisation first, in writing, 30 days. Then the OAIC (free; within 12 months of becoming aware). For a state body, the state regulator listed above. IDCARE for identity-theft support. AFCA if the entity is a bank, insurer or credit provider and the complaint is also about financial loss. For a health provider, your state health complaints body handles the clinical side in parallel.

Get the privacy complaint drafted — $49

Claim Done drafts your Privacy Complaint to the organisation: the APPs breached, the dated facts, the demand for a written explanation, access, correction or deletion, an apology and compensation, a 30-day response deadline, and a note on the OAIC (or state regulator) escalation and its 12-month limit.

Draft My Privacy Complaint — $49 →

You review every word before it’s sent.