Data breach compensation in Australia: your rights

What the organisation must tell you

Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify you and the OAIC when a breach is likely to cause serious harm, and the notice must recommend steps you can take.

Complaining

1. Complain to the organisation first.
2. If it does not respond within 30 days, or you are not satisfied, lodge a complaint with the OAIC. You may be asked to use an external dispute resolution scheme first.
3. The OAIC can resolve the complaint or make a determination that can order compensation for financial or non-financial loss.

The statutory tort for serious invasions of privacy

Since 10 June 2025 you can take court action for a serious invasion of privacy. You must sue within one year of becoming aware of it and within three years of it happening (longer if you were under 18). Courts can award damages, order an apology or stop the conduct. The OAIC has no direct role in these cases.

Get help

• IDCARE, the national identity and cyber support service: 1800 595 160.
• Report scams to Scamwatch.