Step 1: Complain to the Organisation
What should I do if I suspect my personal information has been mishandled?
Before making a privacy complaint to OVIC, you should first complain to the organisation you believe has mishandled your personal information and allow them 28 days to respond.
What are the benefits of complaining to the organisation first?
Complaining to an organisation is often the quickest and easiest way of resolving privacy issues.
It allows you to communicate directly with the organisation, so they understand your concerns and what you want. You will also be able to get an understanding of the organisation’s point of view and ask questions.
What happens if I do not complain to the organisation first?
OVIC may refuse your complaint if you have not complained to the organisation first, or if you have not given them enough time to respond to your complaint.
If you want to complain to OVIC without going to the organisation first, please tell us why.
How do I complain to an organisation?
You can usually find out how to make a privacy complaint by looking at an organisation’s privacy statement on its website, or by asking an employee of the organisation. This may include providing details of the organisation’s privacy officer who is assigned to handle privacy complaints.
If you have any difficulties finding out how to complain to the organisation, feel free to contact us on 1300 006 842 or email firstname.lastname@example.org.
Where possible, you should put your complaint in writing. This can simply be an email to the privacy officer. You should keep copies of:
- your complaint;
- the response you receive; and
- any other communication you have with the organisation about it.
If you call the organisation to complain, make a written note of your call that includes the time and date, the name of the person you spoke to, and what was discussed.
What should I include in my complaint?
In your complaint to the organisation, you should describe:
- what happened and why you believe the organisation interfered with your privacy (include any supporting evidence you have such as copies of emails or letters relevant to the incident);
- how you have been affected and any evidence you have to support this; and
- what you would like the organisation to do to make things better (e.g. apologise; provide an explanation; improve their practices; or pay financial compensation for harm).
What happens if the organisation does not resolve my complaint?
If you do not receive a response within 28 days, or you are unsatisfied with the response you receive, you may make a complaint to OVIC.