OAIC

What OAIC does

The Office of the Australian Information Commissioner (OAIC) is the independent national regulator for privacy and freedom of information in Australia, established under federal law and headquartered in Sydney. It operates under the Privacy Act 1988, the Freedom of Information Act 1982, the Consumer Data Right framework, and the Digital ID Act 2020, with statutory powers to investigate privacy breaches, make binding determinations on complaints, issue enforceable undertakings, and pursue civil penalties in the Federal Court. Its service portfolio spans privacy complaints handling, the Notifiable Data Breaches Scheme, FOI reviews and decisions, Consumer Data Right oversight (across banking, energy, and telecommunications), privacy assessments, and maintenance of public privacy registers. The agency also administers external dispute resolution scheme recognition, working with AFCA, TIO, energy ombudsmen, and state-based tribunals.

OAIC's primary constituents are Australian Government agencies and organisations with annual turnover exceeding $3 million that are subject to the Privacy Act, alongside Australian consumers exercising privacy and information access rights, and children and young people protected under the Children's Online Privacy Code currently in development. Its funding comes from Australian Government appropriations rather than commercial revenue, and statutory fees may apply for certain FOI reviews or privacy assessments. Notable recent enforcement activity includes the landmark $50 million Meta/Cambridge Analytica settlement, joint UK ICO investigation into Clearview AI, civil penalty proceedings against Medibank and Australian Clinical Labs, and investigations into Optus, HWL Ebsworth, Bunnings, Kmart, and 7-Eleven over facial recognition and data breach matters. The agency participates in cross-border regulatory cooperation through MOUs with the UK ICO and Singapore PDPC, and the multi-agency Digital Platform Regulators Forum (DP-REG) alongside ACCC, ACMA, and eSafety.

Name

OAIC

Legal name

Office of the Australian Information Commissioner

Website

https://oaic.gov.au

Company type

Private

Founded year

2010

Operating status

Operating

Headcount range

101–250 employees

Short description

OAIC is Australia's independent national regulator for privacy and freedom of information. It enforces the Privacy Act, FOI Act, Consumer Data Right, and Digital ID Act, handling complaints, data breach notifications, FOI reviews, and civil penalty actions.

Ownership category

akta.pro rank

Product category

Government Regulatory Services

NAICS

Public Administration (92), Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors (926150)

akta.pro primary industry

Data Protection, Privacy & Cybersecurity Regulators (BPAIAOAH)

akta.pro secondary industries

Privacy Management (Consent, DSAR, RoPA) (HDADAFAH), Privacy Governance & Consent Management (HDADAIAI), Customer Permissioning & Consent Management (OAuth, scopes, revocation) (FSAGACAC)

Keywords

• Privacy regulation
• Freedom of information
• Data breach oversight
• Consumer data right
• Privacy compliance

Headquarters

HQ city

Sydney

HQ country

Australia

HQ region

Oceania

Offices1 record

Markets served

GTM type

B2B and B2C

Offering type

Services

Cost components

Personnel, Operations, Infrastructure, Technology or R&D, Others

Distribution channels3 records

Marketing channels8 records

Core offering

OAIC is Australia's independent national regulator for privacy and freedom of information. It administers the Privacy Act 1988, Freedom of Information Act 1982, and Consumer Data Right framework by receiving and investigating privacy complaints, managing the Notifiable Data Breaches Scheme, conducting FOI reviews, and providing privacy guidance and statutory registers to regulated entities, government agencies, and the Australian public.

Product overview

OAIC is a unified regulatory platform offering privacy regulation, freedom of information oversight, and Consumer Data Right governance. The core service portfolio includes: privacy complaints handling and determinations; notifiable data breaches scheme management; FOI reviews and decisions; Consumer Data Right oversight with privacy safeguards; privacy assessments of agencies and organisations; and privacy registers. The Children's Online Privacy Code represents a major new regulatory code under development. Additional services include privacy guidance and education, Digital ID oversight, and external dispute resolution scheme recognition.

Differentiator

Problem solved

Functional benefit

Products and services

• Privacy Complaints Handling Receives, investigates, and determines privacy complaints lodged against agencies and organisations covered by the Privacy Act 1988.
• Notifiable Data Breaches Scheme Manages the reporting, assessment, and investigation of eligible data breaches that are likely to result in serious harm.
• Freedom of Information Services Handles FOI reviews and complaints about Australian Government agencies' handling of access to information requests.
• Consumer Data Right Oversight Regulates and provides guidance for the Consumer Data Right, ensuring privacy safeguards in the banking, energy, and telecommunications sectors.
• Privacy Assessments Conducts assessments of agencies and organisations to examine their compliance with privacy obligations under the Privacy Act.
• Privacy Guidance and Education Provides guidance materials, resources, and educational content for organisations, government agencies, and individuals on privacy compliance.
• Children's Online Privacy Code A special set of rules being developed under the Privacy and Other Legislation Amendment Act 2024 to protect the privacy of children when using the internet.
• Privacy Registers Maintains registers including the classes of lawful tax file number recipients, privacy codes, privacy opt-in register, and public interest determinations.
• Digital ID Services Provides oversight and guidance for Digital ID systems as part of the Consumer Data Right framework.

Quantifiable outcome

• Over 235 children participated in the Children's Online Privacy Code consultation

Segments3 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Partnerships

Six partnerships are on record, tiered core.

• Digital Platform Regulators Forum (DP-REG)coreStrategic or Co-development PartnerDP-REG is a forum comprising Australian digital platform regulators including OAIC, ACCC, ACMA, and eSafety. The forum signed a Memorandum of Understanding to strengthen coordination in oversight of digital platforms. Joint activities include working papers on algorithms, AI, and immersive technologies.
• UK Information Commissioner's Office (ICO)coreStrategic or Co-development PartnerOAIC and the UK's ICO have signed a memorandum of understanding for joint investigations and cooperation on privacy enforcement. The two regulators conducted a joint investigation into Clearview AI.
• Singapore Personal Data Protection Commission (PDPC)coreStrategic or Co-development PartnerOAIC and Singapore's PDPC strengthened ties through a Memorandum of Understanding to cooperate on privacy regulation and enforcement.
• Association of Information Access Commissioners of Australia and New Zealand (AIAC)coreStrategic or Co-development PartnerOAIC participates in AIAC, a forum of information access commissioners and ombudsmen from Australia and New Zealand, meeting twice yearly to share best practices and develop harmonised approaches.
• Privacy Authorities AustraliacoreStrategic or Co-development PartnerOAIC collaborates with state and territory privacy authorities in Australia on joint initiatives including Privacy Awareness Week and consistent regulatory approaches.
• International investigators (Clearview AI joint investigation)coreStrategic or Co-development PartnerOAIC participated in a global privacy investigation with international counterparts into Clearview AI, with findings that the company breached Australians' privacy.

Scale indicators1 record

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• European Data Protection Board (EDPB): EU body composed of national DPAs that issues binding decisions and guidance under GDPR. Broader incumbent setting pan-EU privacy policy with which OAIC's framework is increasingly compared.

Regional players

• Australian Competition and Consumer Commission (ACCC): Australian competition and consumer regulator co-member of DP-REG. Adjacent regulator with overlapping digital platform oversight but distinct consumer protection rather than privacy mandate.
• eSafety Commissioner (Australia): Australian regulator for online safety, cyberbullying, and harmful content. Domestic peer within DP-REG with overlapping jurisdiction on digital platforms but distinct privacy remit.

Direct peers

• Commission Nationale de l'Informatique et des Libertés (CNIL): France's data protection authority under GDPR. Direct peer with comparable powers including investigations, sanctions, and codes of practice; reference regulator for global privacy standards.
• Hong Kong Privacy Commissioner for Personal Data (PCPD): Hong Kong's independent privacy regulator enforcing the Personal Data (Privacy) Ordinance. Comparable mandate on data protection, breach handling, and compliance oversight in an Asia-Pacific jurisdiction.
• Office of the Privacy Commissioner of New Zealand: New Zealand's independent privacy regulator and OAIC's nearest trans-Tasman counterpart. Conducts joint investigations (e.g., Latitude Financial) and aligns on cross-border privacy enforcement.
• Irish Data Protection Commission (DPC): Ireland's data protection authority and lead GDPR supervisor for many US tech multinationals' EU operations. Direct peer on cross-border privacy enforcement and big-tech investigations.
• Personal Data Protection Commission (PDPC) Singapore: Singapore's privacy and personal data protection regulator. Holds an MOU with OAIC for cooperation on privacy regulation and enforcement, comparable mandate and enforcement tools.
• Information Commissioner's Office (ICO): The UK's independent data protection and information rights regulator. Direct peer to OAIC, sharing an MOU and the joint Clearview AI investigation; both oversee privacy, FOIA-equivalents, and consumer data regimes.
• Office of the Privacy Commissioner of Canada: Canada's federal privacy regulator under PIPEDA. Comparable mandate covering private-sector privacy, breach reporting, and enforcement; useful peer for benchmarking OAIC's regulatory approach.

Market position

Strengths5 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights7 records

Customer concentration

• Xx.com/OAICgov
• YouTubeyoutube.com/user/oaicgov
• Facebookfacebook.com/OAICgov
• LinkedInlinkedin.com/company/office-of-the-australian-information-commissioner
• Instagraminstagram.com/oaicgov

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about OAIC