On this page
- Complain to a CDR provider first, before you complain to us
- What to include in your complaint
- Keep a record of your complaint
- Give them at least 30 days to respond
Complain to the CDR provider first
If you think a CDR provider has mishandled your CDR data, you need to complain to them first, before you complain to us.
Check the CDR provider’s CDR policy, which must explain how a consumer can make a complaint. The policy may be available through its online service, such as a website or mobile application. CDR providers are also required to provide you with a copy of the CDR policy if you ask.
What to include in your complaint
When you make the complaint to the business, you should:
- identify yourself
- give any identification or reference number(s), if relevant
- give a brief description of the matter and why you think the business has mishandled your CDR data (what happened, when it happened and any consequences)
- let them know what you would like them to do to resolve the matter
If you put your complaint in writing, also include:
- a contact address
- a contact phone number
- the date (if you’re sending a letter)
You may wish to use this template to make your complaint:
Dear Privacy/CDR Officer,
I am writing to you to make a CDR complaint about how [name of business] has handled my CDR data.
On [date]... [provide an explanation of what happened, including as much detail as possible].
As a result of this… [explain the impact the incident has had on you and why you are concerned about this].
To resolve this complaint, I would like you to... [outline what you are seeking to resolve the complaint].
Please call me on [your phone number] to discuss the complaint.
If I do not receive a response from you within a reasonable time (generally 30 days) or the complaint is not resolved, I may contact the Office of the Australian Information Commissioner to make a CDR complaint.
Keep a record of your complaint and any responses
Make sure you keep a record of your complaint.
If you complained in person or over the phone, make a record of:
- the date you complained
- the name of the business you complained to
- the name of the person you complained to, if available
- a brief description of why you think the business has mishandled your CDR data (what happened, when it happened and any consequences)
- a brief description of what you asked the CDR provider to do to resolve the matter
If you receive a response, make a record of:
- the date you received the response
- the name of the business that responded
- the name of the person you spoke to, if available
- a description of the response
If the business responds in writing, keep a record of their response.
Give them at least 30 days to respond
You need to give the business a reasonable amount of time to respond to your complaint. We think 30 days is a reasonable time.
If the business doesn’t respond to your complaint or you’re not happy with their response, you can lodge a complaint with us.
Was this page helpful?
If you would like to provide more feedback, please email us at firstname.lastname@example.org