Making a complaint about a breach of personal information protection principles (PIPP)

Who can I complain about?

Complaints can only be made against ‘personal information custodians’. This includes Tasmanian public authorities like state government departments, local councils, statutory bodies, the University of Tasmania, Tasmania Police, state-owned companies and, in some circumstances, organisations providing services for the state.

Private organisations are not covered by the Act unless they have entered into a contract with a personal information custodian relating to the collection, use or storage of personal information.

Who can complain?

The general rule is that you can only complain about an act that amounts to a breach of a personal information protection principle (PIPP) involving your own personal information. However, you may be able to complain on behalf of someone else in some circumstances.

What can I complain about?

Complaints can only be made if you think there has been a breach of one or more of the ten personal information protection principles in the Act.

When can I make a complaint?

A complaint must be made within six months of an alleged breach unless the Ombudsman allows a further period.

If you have requested that a public authority should change personal information about you and this has been refused, you can make a complaint within 20 working days of the date on which the notice of decision is given. Complaints can only be about personal information that is recorded in some form.

Last updated: 8 October 2026