How to make a privacy complaint

You can make a complaint under the Privacy and Responsible Information Sharing Act 2024 (WA) (PRIS Act) if you think an IPP entity has interfered with your privacy. 

What is an IPP entity?

IPP entities include Western Australian government departments, statutory authorities, the Police Force of Western Australia, Local Governments, Ministers (in their executive capacity), Parliamentary Secretaries and government trading enterprises. It also includes some contracted service providers to government. 

What is an ‘interference with privacy’?

An interference with privacy is when an IPP entity handles your personal information inconsistently with their privacy obligations under PRIS Act including the 11 Information Privacy Principles (IPPs).

You can find out more about your privacy rights and what you can complain about by visiting ‘What are my privacy rights?” 

What is personal information?

Personal information is any information or an opinion relating to a person that identifies them or could reasonably be used to identify them. 

Personal information is a broad concept. It captures information that may not be factually correct, opinions about individuals and information about deceased individuals. Importantly, personal information can also include information inferred or generated by analysing or using other information about you. There are a number of subcategories of personal information, including sensitive personal information and health information. 

Some examples of personal information include name, date of birth, address, contact information, location information, unique identifiers (eg. drivers licence number or IP address) and information that relates to someone’s features or behaviour. It can include inferences made about people. 

You can find out more about personal information under the PRIS Act by visiting What is personal information?.

Step 1 – make a privacy complaint directly to the IPP entity

• Make a privacy complaint directly to the IPP entity that you think has mishandled your personal information.  
• Allow the IPP entity a reasonable time to respond to your complaint (usually 30 days) in writing. 

Tip: Consider if there are any steps you can take to reduce the risk caused by the alleged mishandling of your personal information. For example, you might consider changing your password or security questions, contacting your bank if you think your financial information might have been compromised. Do not respond to any suspicious communications you receive after the event, you may want to keep a record of them. 

Step 2 – make a privacy complaint to the OIC

• If you do not receive a response from the IPP entity, or you are not satisfied with the response to your privacy complaint, you may lodge a privacy complaint with the OIC. 

You can usually find out how to make a privacy complaint to the entity your complaint is about (called an IPP entity) by:

• visiting the IPP entity’s privacy policy or the ‘Contact Us’ section on the entity’s website, or 
• asking an employee of the IPP entity by phone or in person. 

If you think your complaint is about a service provider to an IPP entity, but you are unsure you can either complain directly to the IPP entity or to the service provider. 

You should make your complaint in writing and keep a copy.

What should I include in my complaint?

If the IPP entity has a privacy complaint form (or a general complaint form) use this to make your complaint. 

If the IPP entity does not have a complaint form, make your complaint in writing and include the following information: 

• Personal information so the IPP entity can contact you in response to your complaint, including:
  • your name
  • your contact details (such as an email address or phone number). 
• A description of: 
  • what happened 
  • when it happened 
  • why you believe your personal information has been mishandled (include any supporting information you have, such as copies of emails or letters relevant to the incident);
  • how you have been affected and any evidence you have to support this and
  • what you would like the IPP entity to do to resolve your complaint. 

Tip: Keep a record of your complaint to the IPP entity and their response.

If you receive a response from the IPP entity by phone or in person, you should record: 

• the date and time of the conversation 
• the name of the person you spoke to and 
• a brief description of the conversation including what the IPP entity said they would do.   

If you subsequently want to make a complaint to the OIC, you will need to provide us a copy of your complaint to the IPP entity and its response.

What are my options for resolving my privacy complaint?

Your options for resolving your complaint may include asking the IPP entity:

• for an apology.
• to explain their decision-making process or the reasons for doing what they did.
• to improve their practices or update their policies to prevent future or similar incidents.
• to provide training for their staff.
• to help you manage the privacy risks associated with the mishandling of your personal information.
• to take steps to address the matter (this may include updating their records, providing you with access to your information, or compensating you for loss or damage suffered because of the alleged interference with your privacy).

What happens if the IPP entity does not resolve or respond to my complaint?

If you do not receive a response to your privacy complaint within a reasonable timeframe (usually 30 days) or if you are dissatisfied with the IPP entity’s response, you may make a complaint to the OIC. 

What happens if I do not complain to the IPP entity first?

The OIC may refuse to investigate if:

• you have not complained to the IPP entity first
• you have not given the IPP entity enough time to respond to your complaint (usually 30 days) or
• the Commissioner considers the IPP entity is appropriately dealing with your complaint.

To make a privacy complaint to the OIC use the privacy complaint form on our website. The complaint form outlines the information you need to include in your complaint.

If you need help making your complaint, please contact the OIC on 08 6551 7888 or email: info@oic.wa.gov.au.

When can I make a complaint to the OIC?

The OIC can only investigate privacy complaints where the alleged interference with your privacy occurred on or after 1 July 2026. 

What privacy complaints will the OIC not investigate?

The OIC cannot investigate privacy complaints about events involving personal information that:

• occurred before 1 July 2026 
• you became aware of more than 12 months before you complained to the OIC

Please note, the IPPs relating to collection of personal information (IPP 1), unique identifiers (IPP 7), anonymity (IPP 8) and automated decision making (IPP 10) only apply to personal information collected on or after 1 July 2026. Therefore, the OIC can only investigate complaints about these IPPs if the affected personal information was collected on or after 1 July 2026. For more information visit Understanding my privacy rights – when do they commence?

The OIC cannot investigate privacy complaints about:

• Commonwealth government agencies (such as the Australian Taxation Office or Centrelink)
• private organisations (unless they are providing a service to the WA government)
• government agencies of another State/Territory  
• individuals who were acting in their personal capacity.

See other helpful contacts at the end of this guidance if the OIC cannot investigate your complaint.

What information do I need to include in my privacy complaint to the OIC?

The privacy complaint form asks you to describe your complaint in your own words. 

Your complaint must include the following information:

• your name
• an address in Australia 
• your contact details so we can communicate with you about your complaint 
• the name of the entity you are complaining about
• what happened including what personal information of yours was affected
• why you believe your personal information was mishandled
• how you found out about the events you are complaining about<\/strong>
• whether you have made a complaint directly the entity you are complaining about and whether they have responded to your complaint<\/strong>
• how you would like your privacy complaint resolved.<\/strong>

Your complaint should include relevant supporting documents (for example a copy of your privacy complaint to the entity, a copy of the entity’s response to your complaint and other documents that support the impact it has had on you).   

Email your completed privacy complaint form with your supporting documents to info@oic.wa.gov.au.

Tip: Keep the description of your privacy complaint and what would resolve it to no more than two (2) A4 pages in length (single spaced, in a minimum of 11-point font). While dealing with your privacy complaint the OIC will ask you for more information as required.

Tip: Keep a copy of your completed privacy complaint form for your own reference.

How does the OIC handle privacy complaints?

The OIC handles privacy complaints impartially and on their merits in accordance with the PRIS Act. The OIC encourages parties to resolve privacy complaints by agreement at any time, with or without our assistance. When the OIC deals with a complaint, we may exercise powers under the PRIS Act to conciliate, investigate and determine the complaint. 

What can I do if I am unhappy with a decision of the Information Commissioner?

Under the PRIS Act, if you are unhappy with a decision of the Information Commissioner or the Privacy Deputy Commissioner you may apply to the State Administrative Tribunal (SAT) for a merit review of that decision. 

You must make your application to the SAT within 28 days of the notice of the decision.  For more information see the State Administrative Tribunal (SAT) website. 

Other privacy complaint contacts

If your privacy complaint is about a:

• a private organisation (other than a service provider to a Western Australian government entity); or 
• Commonwealth agency (such as the Australian Tax Office, Centrelink, or Australian Border Force) 

you can complain to the Office of the Australian Information Commissioner.

If your complaint is about a government agency in another state or territory you should contact:

Australian Capital Territory – ACT Ombudsman

New South Wales – Information and Privacy Commission

Northern Territory – Information Commissioner

Queensland – Office of the Information Commissioner QLD

South Australia – Ombudsman SA

Tasmania – Ombudsman Tasmania

Victoria – Office of the Victorian Information Commissioner 

Other Western Australian complaint contacts 

Other Western Australian services that might be able to assist you include the:

Ombudsman Western Australia receives, investigates and resolve complaints about State Government departments and authorities, and local governments.

Health and Disability Services Complaints Office (HaDSCO) is responsible for the Code of Conduct for certain health care workers in Western Australia and the Indian Ocean Territories through receiving complaints, undertaking investigations, and issuing prohibition orders when necessary.

The Energy and Water Ombudsman Western Australia investigates and resolves complaints about electricity, gas and water providers.