Privacy Breach Complaint & Access Request

What this document does

• A formal privacy complaint under the Privacy Act 1988 that cites the exact Australian Privacy Principles breached, demands an explanation, access, correction, deletion, apology and compensation, and starts the 30-day clock the OAIC requires before it will take your complaint.
• Records the facts that matter on paper: state or territory the agency or council belongs to, organisation / agency complained of, information involved and what was done with it, date of the conduct and date you became aware.
• Sets a clear deadline and spells out what happens if they ignore it.
• Cites the right Act, regulator and tribunal for your state — all eight states and territories covered.
• You review the draft first; we only send it to the other party on your say-so.

What we'll ask you

Plain-English questions, one at a time. No legal knowledge needed — if you don't know an answer exactly, your best estimate is fine.

1. What kind of organisation is it?
2. Which state or territory does the agency or council belong to?
3. Who mishandled your information? The business, health provider, bank, employer, real estate agent, or the agency or council — its legal or trading name (and the privacy officer's name or email if you have it).
4. Tell me what happened — how they came to hold your information, what went wrong, how you found out, what you've said to them so far and what they've said back.
5. Exactly what information, and what did they do with it? For example: sent my medical file to another patient; gave my address and phone number to my ex; a data breach exposed my licence and passport; used my details for marketing after I opted out; refused to give me a copy of my file; won't correct a wrong record; recorded or tracked me without telling me.
6. When did it happen?
7. When did you find out? If they sent you a breach notice, its date too.
8. What harm has it caused? Money lost or spent (new documents, credit monitoring, moving), risk of identity theft, effect on your job or relationships, distress or health impact, and anything you had to do to protect yourself.optional
9. What do you want from them? A written explanation of what happened and who received the information; a copy of everything they hold about you; correction or deletion; confirmation of what they've done to stop it happening again; a written apology; compensation (say a figure if you have one).
10. What do you have? Emails, screenshots, the breach notification, letters, call notes, a copy of the record with the error, anyone who saw the information.optional
11. Do you have their privacy officer or complaints email? We can send the complaint straight to them once you approve it.optional
12. The state or territory the matter is in — so the document cites the right Act, regulator and tribunal.
13. Your name and email — so the draft lands in your dashboard and inbox.