← ACARA Digital Technologies Years 9–10

The OAIC and making a privacy complaint

The Office of the Australian Information Commissioner: the government body that oversees the Privacy Act, gives guidance, handles privacy complaints and can act on APP breaches.

Part of: ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints — Module 29, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 75, WA Computer Science ATAR Year 11 — Data Management — Module 102, WA Computer Science ATAR Year 11 — Cyber Security — Module 165

Understanding The OAIC and making a privacy complaint in ACARA Digital Technologies Years 9–10

What it does: You start by writing to the organisation, often its privacy officer, so it can respond to your complaint. The OAIC takes complaints that the organisation has not resolved, and it has an online complaint process. The Office of the Australian Information Commissioner (OAIC) oversees the Privacy Act and handles privacy complaints. The OAIC expects you to give the organisation a chance to fix the problem first. You complain to them in writing. Serious or repeated interferences with privacy can lead to civil penalties that run into millions of dollars. The APPs are legal requirements for APP entities. The OAIC website has trusted guidance for individuals and organisations.

Common mistakes: If the organisation does not reply or you are unhappy with its answer, you escalate the privacy complaint to the OAIC, not the police. The OAIC oversees the Privacy Act 1988. ASIC regulates companies and financial services, so line 1 should be body ← OAIC.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add The OAIC and making a privacy complaint to a class →

This module's key terms are also in a printable crossword (Modules 876–944) and word search (Modules 860–944).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which body oversees the Privacy Act 1988 and handles privacy complaints in Australia?
The OAICThe Australian Tax Office
Matches
Complain to the OAIC first, before telling the organisation
↓
The OAIC usually expects you to complain to the organisation first and give it time to respond (about 30 days). Only then can you escalate to the OAIC.
Applying
Meanings
Term
OAIC
Meaning
The Office of the Australian Information Commissioner: the government body that oversees the Privacy Act, gives guidance, handles privacy complaints and can act on APP breaches.
Practice
complain_to(organisation)
Testing
Gaps
regulator =
Check Answer
Spots
3if no reply or unhappy then
4 complain to the police

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Chambered Nautilus' badge — File Explorer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which body oversees the Privacy Act 1988 and handles privacy complaints in Australia?
A. The OAIC ✓
B. The Australian Tax Office
The Office of the Australian Information Commissioner (OAIC) oversees the Privacy Act and handles privacy complaints.
2. You think an app has misused your personal data. What should you usually do FIRST?
A. Complain to the organisation ✓
B. Go straight to the OAIC
The OAIC expects you to give the organisation a chance to fix the problem first. You complain to them in writing.
3. When can you escalate a privacy complaint to the OAIC?
A. When the organisation's reply is unsatisfactory or it does not reply in time ✓
B. Only after taking the organisation to court
If the organisation does not respond within about 30 days or the response is not good enough, you can lodge a complaint with the OAIC. You do not need to go to court first.
4. Which statement about the OAIC is true?
A. It only talks to individuals and never to organisations
B. It publishes guidance to help organisations follow the APPs ✓
The OAIC gives guidance to organisations on how to follow the Australian Privacy Principles, and it also helps individuals.
5. Which is a job of the OAIC?
A. Writing the privacy policy for a company
B. Investigating a complaint about an APP breach ✓
The OAIC can investigate complaints. Each organisation writes its own privacy policy.

Match the Pairs

OAIC → The government body that oversees the Privacy Act, gives guidance and handles privacy complaints
OAIC guidance → Advice and guidelines that help organisations understand and follow the Australian Privacy Principles
Step one of a privacy complaint: contact the organisation that handled your data and give it a chance to fix the problem → Email: privacy@shopname.com.au
If the organisation does not resolve your complaint (usually within 30 days), you can escalate it to the OAIC → oaic.gov.au/privacy/privacy-complaints
Complain to the OAIC first, before telling the organisation → The OAIC usually expects you to complain to the organisation first and give it time to respond (about 30 days). Only then can you escalate to the OAIC.
The OAIC only gives advice and can never penalise anyone → This is wrong. The OAIC can investigate, make determinations and take action, including seeking civil penalties for serious or repeated breaches of the APPs.

Key Term

OAIC
The Office of the Australian Information Commissioner: the government body that oversees the Privacy Act, gives guidance, handles privacy complaints and can act on APP breaches.

Fill in the Blanks

1. regulator = OAIC
Hint: Type the acronym of the government body that oversees the Privacy Act.
2. sendComplaint(organisation) waitForReply(30)
Hint: Type who you must contact first, before going to the regulator (the one that holds your data).
3. IF reply = "none" THEN escalate(OAIC) END IF
Hint: Type the keyword that starts a condition, so the complaint is only escalated when there is no reply.
4. OAIC.publish(guidance) organisations.follow(guidance)
Hint: Type the name of the advice the OAIC publishes to help organisations follow the APPs.
5. OAIC.apply(penalty, organisation)
Hint: Type the consequence, such as a fine, that can be applied when an organisation seriously breaches the APPs.

Spot the Error

Question 1
A complain to the organisation
B wait 30 days for a reply
C if no reply or unhappy then
D complain to the police
Line D — If the organisation does not reply or you are unhappy with its answer, you escalate the privacy complaint to the OAIC, not the police.
Question 2
A body ← ASIC
B oversees ← Privacy Act 1988
C output body + oversees
Line A — The OAIC oversees the Privacy Act 1988. ASIC regulates companies and financial services, so line 1 should be body ← OAIC.
Question 3
A if APP breach is serious then
B OAIC can never penalise
C penalty can be millions
D end if
Line B — The OAIC can seek civil penalties for serious or repeated breaches of the APPs. It is wrong to say it can never penalise.
Question 4
A need ← help with APPs
B a business reads guidance
C read guidance from the ATO
Line C — The OAIC publishes guidance to help organisations follow the APPs. The ATO is the tax office, so line 3 should say the OAIC.
Question 5
A problem ← data was misused
B contact the OAIC first
C keep a copy of the complaint
Line B — You should complain to the organisation first and give it a chance to fix the problem. The OAIC is the next step if that fails.

Student with a class code? Join your class →