Complain to a CDR provider first, before you complain to us
What to include in your complaint
Keep a record of your complaint
Give them at least 30 days to respond
Complain to the CDR provider first
If you think a CDR provider has mishandled your CDR data, you need to complain to them first, before you complain to us.
Check the CDR provider’s CDR policy, which must explain how a consumer can make a complaint. The policy may be available through its online service, such as a website or mobile application. CDR providers are also required to provide you with a copy of the CDR policy if you ask.
What to include in your complaint
When you make the complaint to the business, you should:
identify yourself
give any identification or reference number(s), if relevant
give a brief description of the matter and why you think the business has mishandled your CDR data (what happened, when it happened and any consequences)
If you put your complaint in writing, also include:
a contact address
a contact phone number
the date (if you’re sending a letter)
You may wish to use this template to make your complaint:
Dear Privacy/CDR Officer,
I am writing to you to make a CDR complaint about how [name of business] has handled my CDR data.
On [date]... [provide an explanation of what happened, including as much detail as possible].
As a result of this… [explain the impact the incident has had on you and why you are concerned about this].
To resolve this complaint, I would like you to... [outline what you are seeking to resolve the complaint].
Please call me on [your phone number] to discuss the complaint.
If I do not receive a response from you within a reasonable time (generally 30 days) or the complaint is not resolved, I may contact the Office of the Australian Information Commissioner to make a CDR complaint.
Yours sincerely
[Your name]
Keep a record of your complaint and any responses
Make sure you keep a record of your complaint.
If you complained in person or over the phone, make a record of:
the date you complained
the name of the business you complained to
the name of the person you complained to, if available
a brief description of why you think the business has mishandled your CDR data (what happened, when it happened and any consequences)
a brief description of what you asked the CDR provider to do to resolve the matter
If you receive a response, make a record of:
the date you received the response
the name of the business that responded
the name of the person you spoke to, if available
a description of the response
If the business responds in writing, keep a record of their response.
Give them at least 30 days to respond
You need to give the business a reasonable amount of time to respond to your complaint. We think 30 days is a reasonable time.
If the business doesn’t respond to your complaint or you’re not happy with their response, you can lodge a complaint with us.
