Direct answer
The correct route depends on what happened and who was involved. A complaint about a covered organisation's handling of information is different from a court claim for a serious invasion of privacy. State or territory rules may also matter. Obtain advice promptly about the right route and any time limit.
Video chapters
Question: What can I do if my privacy has been breached in Australia?
Information-handling complaints
Check coverage before choosing a complaint body. The OAIC guidance requires a complaint to the organisation first and identifies situations in which an approved external dispute-resolution scheme should be approached. Keep the organisation's response and the outcome you want.
Court claims are different
A serious-invasion claim is not an OAIC compensation application. Its elements, exceptions, remedies and limitation rules require separate consideration. Do not assume an information-handling exemption settles whether the tort applies.
Common questions
Does the OAIC decide the new privacy tort?
No. The OAIC says it has no direct role in administering that court-based cause of action.
Does every accidental disclosure justify a court claim?
No. Seriousness, the required state of mind and other legal elements must be established; defences and exemptions may apply.
Full video transcript
If your privacy has been breached, first identify what happened, and who was responsible. An information handling complaint and a court claim for a serious invasion of privacy are different pathways. Not every privacy problem belongs with the same regulator.
For an information handling complaint, check whether the organisation and conduct are covered. The Federal Privacy Framework has exceptions, and some state and territory bodies are governed by other rules. A small organisation is not automatically exempt. Exceptions to the small business exemption can apply.
For a matter within the OAIC complaint process, its guidance says to complain to the organisation or agency first. If it has not responded within thirty days or you are dissatisfied with the response, you can approach the OAIC. An approved external dispute resolution scheme may need to be used first. An OAIC complaint must be in writing.
Since ten June twenty twenty five, a separate statutory tort has provided a court pathway for serious invasions of privacy. It can extend beyond organisations covered by the Australian Privacy Principles. The OAIC does not directly administer this tort.
This is not a right to compensation for every mistake. The legal test includes a serious, intentional or reckless invasion, a reasonable expectation of privacy, and a public interest balance. Defences and exemptions also matter. Get advice on how those requirements apply before starting proceedings.
Make a dated record of what happened. Keep the correspondence and responses you already have, and note the outcome you are seeking. Do not spread private material further to prove your point. Seek advice promptly about evidence, urgent protection and deadlines. Do not assume a regulator complaint pauses a court time limit.
For help with your circumstances, use the Go to Court Booking link to request a lawyer consultation. Availability depends on your matter and location this is general information, not personal legal advice.
Official sources
Checked 7 September 2026.
Important
General information only, not personal legal advice. Laws and court arrangements can change. Check the current official sources and obtain advice about your own circumstances. This guide concerns Australian law.