On this page

  • Complain to a CDR provider first, before you complain to us
  • What to include in your complaint
  • Keep a record of your complaint
  • Give them at least 30 days to respond

Complain to the CDR provider first

If you think a CDR provider has mishandled your CDR data, you need to complain to them first, before you complain to us.

Check the CDR provider’s CDR policy, which must explain how a consumer can make a complaint. The policy may be available through its online service, such as a website or mobile application. CDR providers are also required to provide you with a copy of the CDR policy if you ask.

What to include in your complaint

When you make the complaint to the business, you should:

  • identify yourself
  • give any identification or reference number(s), if relevant
  • give a brief description of the matter and why you think the business has mishandled your CDR data (what happened, when it happened and any consequences)
  • let them know what you would like them to do to resolve the matter

If you put your complaint in writing, also include:

  • a contact address
  • a contact phone number
  • the date (if you’re sending a letter)

You may wish to use this template to make your complaint:

Dear Privacy/CDR Officer,

I am writing to you to make a CDR complaint about how [name of business] has handled my CDR data.

On [date]... [provide an explanation of what happened, including as much detail as possible].

As a result of this… [explain the impact the incident has had on you and why you are concerned about this].

To resolve this complaint, I would like you to... [outline what you are seeking to resolve the complaint].

Please call me on [your phone number] to discuss the complaint.

If I do not receive a response from you within a reasonable time (generally 30 days) or the complaint is not resolved, I may contact the Office of the Australian Information Commissioner to make a CDR complaint.

Yours sincerely

[Your name]

Keep a record of your complaint and any responses

Make sure you keep a record of your complaint.

If you complained in person or over the phone, make a record of:

  • the date you complained
  • the name of the business you complained to
  • the name of the person you complained to, if available
  • a brief description of why you think the business has mishandled your CDR data (what happened, when it happened and any consequences)
  • a brief description of what you asked the CDR provider to do to resolve the matter

If you receive a response, make a record of:

  • the date you received the response
  • the name of the business that responded
  • the name of the person you spoke to, if available
  • a description of the response

If the business responds in writing, keep a record of their response.

Give them at least 30 days to respond

You need to give the business a reasonable amount of time to respond to your complaint. We think 30 days is a reasonable time.

If the business doesn’t respond to your complaint or you’re not happy with their response, you can lodge a complaint with us.

Was this page helpful?

Thank you.

If you would like to provide more feedback, please email us at websitefeedback@oaic.gov.au