Finding out that your personal information has been mishandled or used in a way you never agreed to, is an unsettling feeling. If this happens to you, here is what you should do.
You need to understand what the organisation responsible must do, and what you can actually do about the privacy breach.
This guide explains the legal paths available to you in NSW, explaining the two separate complaint schemes that apply depending on who breached your privacy. There is also the newer right to sue directly for serious invasions of privacy. We’ve covered who to complain to, what evidence to include, and what happens if you’re not satisfied with the outcome.
At a glance
- No general common law right to sue for privacy breaches, but since 10 June 2025, there is a statutory tort for serious invasions of privacy under the Privacy Act 1988 (Cth).
- State/local government, NSW councils, universities: an internal review with the agency first, then the NSW Information and Privacy Commission (IPC), within 6 months.
- Businesses with $3 million+ turnover, most private organisations: complain to the organisation first, then the Office of the Australian Information Commissioner (OAIC) within 12 months.
- NCAT can award compensation up to $40,000 for a substantiated NSW complaint; the OAIC can also order compensation for a substantiated Commonwealth complaint.
- The one thing to do now: identify which scheme applies (see below), then put your complaint in writing and keep a copy.
Is there a right to sue for a privacy breach?
Generally, no. Australia does not have a broad common law right to sue simply because your privacy was breached. For most privacy breaches, you have the statutory complaint schemes described below, not a lawsuit.
However, that changed last year in one specific respect. Since 10 June 2025, the Privacy Act 1988 (Cth) has included a statutory tort for serious invasions of privacy (introduced by the Privacy and Other Legislation Amendment Act 2024).
This gives you a direct right to sue where someone has intentionally or recklessly intruded on your privacy or misused your private information. For this, the invasion must have been serious, and a court finds the public interest in your privacy outweighs any competing public interest (such as freedom of expression).
It is a legal action, but it has a deliberately high bar. This tort sits alongside the complaint schemes below, not instead of them.
For most privacy breaches, like a leaked medical record, the usual path is still a complaint, not a court case.
Which law applies: NSW or Commonwealth?
The most important thing to establish first is which body you’re complaining about, because that decides which law governs your complaint.
Covered by Commonwealth law
- Organisations with $3 million or more in annual turnover
- Private health service providers
- Credit reporting bodies
- Businesses that trade in personal information
- Tax file number recipients
- Small businesses that have opted in to the Privacy Act
Covered by NSW law
- State government agencies
- Local councils
- Universities in NSW
- Ministers and Ministers’ offices
However, exceptions do apply to the $3 million turnover test. Some smaller organisations are covered regardless of turnover. For example, health service providers and businesses that trade in personal information, and some Commonwealth agencies have their own arrangements. If you’re unsure which category applies, the IPC or OAIC intake teams can point you the right way.
If the organisation is covered by NSW law, the relevant legislation is the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act). Complaints under both sit with the NSW Information and Privacy Commission (IPC).
If the organisation is covered by Commonwealth law, the relevant legislation is the Privacy Act 1988 (Cth), overseen by the Office of the Australian Information Commissioner (OAIC).
How do I make a NSW privacy complaint?
You must first apply for an internal review with the agency, within six months. You can also complain to the NSW Privacy Commissioner, but the Commissioner is unlikely to accept a complaint against a NSW public sector agency where you haven’t first sought an internal review.
Your application for a NSW privacy complaint should include:
- Your name and contact details
- Details of the complaint
- The specific Information Protection Principle (IPP) or Health Privacy Principle (HPIP) you say was breached, and why
- Your proposed solution
We recommend keeping a copy of your application and a record of when and how you sent it.
The agency must advise and consult with the NSW Privacy Commissioner during the internal review. After completing the review, the agency may:
- Take no further action
- Make a formal apology
- Change its practices or retrain staff so it doesn’t happen again
- Take other remedial action, such as correcting an inaccurate record
Important: The agency itself cannot award you compensation at this stage. You’ll be told the outcome of the review and your further review rights.
Reviewing a NSW decision
If 60 days pass with no review completed, or you’re unhappy with the outcome, you can apply to the NSW Civil and Administrative Tribunal (NCAT) for a review of the findings.
You must lodge this application within 28 days of receiving the internal review outcome (or 28 days after the 60-day period expires, if you’ve heard nothing). The NSW Privacy Commissioner is independent at this stage and doesn’t represent either side at NCAT.
NCAT can:
- Take no action
- Award compensation of up to $40,000 for financial loss or psychological/physical harm caused by the agency’s conduct
- Order the agency to stop the conduct
- Require the agency to comply with the relevant privacy principle
- Order correction of disclosed personal information
If you also disagree with NCAT’s decision, you may be able to appeal to the NCAT Appeal Panel. However, you are usually only able to do so if the Tribunal made an error of law or procedure. You should consider getting legal advice before deciding whether an appeal is worth pursuing.
How do I make a Commonwealth privacy complaint?
Under the Privacy Act, you must complain to the organisation itself before you can go to the OAIC. Your complaint to the OAIC must be made within 12 months of when you became aware of the conduct.
Include:
- Your name and contact details
- The nature of the complaint
- The specific Australian Privacy Principle (APP) you say was breached, and why you think so
- What outcome you’re seeking
A template you can adapt, based on the OAIC’s own example:
Dear Privacy Officer,
I am writing to make a privacy complaint about how [name of organisation] has handled my personal information.
On [date] … [explain what happened, in as much detail as possible].
As a result, … [explain the impact this has had on you].
To resolve this complaint, I would like your organisation to … [what you’re seeking].
Please call me on [phone number] to discuss.
If I don’t receive a response within a reasonable time (generally 30 days), or the complaint isn’t resolved, I may take this to the Office of the Australian Information Commissioner (OAIC).
Yours sincerely, [Your name]
Give the organisation at least 30 days to respond before escalating.
Escalating to the OAIC
If you’re not satisfied with the response, or don’t get one within a reasonable time, you can lodge a complaint with the OAIC online.
Your complaint should include:
- Your name and contact details (the OAIC can’t investigate an anonymous complaint)
- Any relevant reference numbers
- The name of the organisation or agency
- A brief description of what happened and when
- Any action already taken to resolve it
- Copies of your original complaint and any response
- What outcome you’d like
The OAIC will usually write to the organisation for a response and share that response with you. Most complaints then move to conciliation, an opportunity for both sides to work out a resolution together. If conciliation doesn’t resolve it, the OAIC decides whether to investigate further or close the complaint.
Where a complaint is substantiated, the OAIC can order:
- Access to the information, or correction of a record
- An apology
- A change to the organisation’s practices or procedures
- Staff training
- Compensation for financial or non-financial loss
- Other remedies, such as a complimentary service
Reviewing an OAIC decision
If you disagree with an OAIC decision, you have the following two options:
| Review type | Where | What it can do |
|---|---|---|
| Merits review | Administrative Review Tribunal (ART) | Reconsiders the decision on its merits, can substitute a different outcome |
| Judicial review | Federal Court of Australia or Federal Circuit and Family Court of Australia (Division 2) | Reviews whether the OAIC applied the law correctly, can’t re-decide the merits, but can send it back to the OAIC |
Since 14 October 2024, merits review of Commonwealth administrative decisions (including OAIC determinations) goes to the Administrative Review Tribunal (ART), which replaced the former Administrative Appeals Tribunal.
If you’re seeking judicial review, you’ll generally need to apply within 28 days of the decision. As the right avenue depends on exactly what you’re unhappy with, and the process for each is different, get legal advice before you file.
Your Rights and What You Can Do Now
- Ask for a copy of your personal information the organisation holds. Both NSW and Commonwealth privacy law give you a right to access it.
- Ask for a correction if the information is wrong, out of date, or misleading.
- Put everything in writing and keep dated copies of your complaint, any response, and any follow-up.
- Note the relevant time limits now (6 months for NSW agencies; 12 months for Commonwealth-covered organisations). Missing them can close off your complaint entirely.
- Don’t assume you have no options if the breach feels minor. Even where compensation isn’t awarded, an apology or a change in practice can matter, and it’s on the public record.
- If the breach feels serious (deliberate, intrusive, or causing real harm), get advice early on whether the new statutory tort for serious invasions of privacy might apply. The threshold is high, and the time limit is strict: generally the earlier of 1 year after you became aware of the invasion, or 3 years after it occurred (with special rules for people under 18).
How a Privacy Lawyer Can Help Your Case
A privacy solicitor can help you work out which scheme actually applies to your situation. This is important as NSW and Commonwealth complaints have different forms, different bodies, and different time limits. Therefore choosing the wrong one can cost you the opportunity to complain.
Beyond that, a lawyer can:
- Assess whether your circumstances meet the threshold for the statutory tort for serious invasions of privacy, or whether a complaint-based pathway is the stronger option.
- Help draft your application so it clearly identifies the principle breached and the outcome you’re seeking, which can meaningfully affect how an agency or the OAIC responds.
- Represent you at an NCAT hearing under the PPIP Act, including in seeking compensation.
- Advise on your prospects of success and likely compensation range before you commit time to a complaint or claim.
- Handle correspondence and negotiation with the organisation on your behalf, which can reduce the stress of dealing directly with the body that breached your privacy.
None of this guarantees a particular outcome, every matter depends on its own facts, but getting the pathway and the paperwork right from the outset gives your complaint the best chance of being taken seriously.
Frequently Asked Questions
Can I sue for a privacy breach in Australia?
Generally, no. There’s no broad right to sue simply because your privacy was breached. The exception is the new statutory tort for serious invasions of privacy, in force since 10 June 2025, which applies only where the invasion was serious and intentional or reckless. For most breaches, a complaint through the IPC or OAIC is the right path, not a lawsuit.
How long do I have to make a privacy complaint?
It depends which scheme applies. For NSW government agencies, councils and universities, you have 6 months from the conduct to apply for an internal review. For organisations covered by Commonwealth law, you have 12 months from when you became aware of it, and you must complain to the organisation first.
Can I get compensation for a privacy breach?
Yes, in some circumstances. NCAT can award up to $40,000 for a substantiated NSW complaint. The OAIC can also order compensation for financial or non-financial loss in a substantiated Commonwealth complaint. Neither is automatic, it depends on the harm you can demonstrate.
What if the organisation doesn’t respond to my complaint?
You can escalate. For a Commonwealth-covered organisation, if you don’t hear back within a reasonable time (generally 30 days), you can take the complaint to the OAIC. For a NSW agency, if no internal review is completed within 60 days, you can apply to NCAT.
Do I need a lawyer to make a privacy complaint?
No, you can complain yourself. Both the IPC and OAIC accept complaints directly from individuals, and their processes are designed to be accessible without legal representation. A lawyer becomes more valuable where the matter is complex, the breach is serious, compensation is being sought, or you’re considering escalation to NCAT, the ART, or a court.
How O’Brien Criminal & Civil Solicitors Can Help
Privacy complaints can involve overlapping state and Commonwealth schemes, strict time limits, and, in serious cases, a genuine civil claim, which is exactly the kind of matter where getting early advice changes the outcome. Our civil litigation team can assess which pathway applies to your situation, help you draft and lodge a complaint that gives you the best chance of a real remedy, and represent you at NCAT or in escalation if it’s needed.
Request initial advice (no-obligation) via the form below or call us on (02) 9261 4281.
Peter O'Brien is the Principal Solicitor of O'Brien Criminal & Civil Solicitors and Australia's leading expert in intentional torts litigation, with over 25 years of experience securing landmark victories in malicious prosecution and unlawful imprisonment cases. Author of Intentional Tort Litigation in Australia and recipient of the Law Council of Australia President's Medal, Peter has achieved record-breaking compensation for clients and is widely recognised for his unwavering commitment to access to justice.
