Privacy complaints

You can lodge an information privacy complaint if you believe that the Department of Health has breached its obligations under the Information Privacy Act 2009 (the Act) to comply with the:

  • privacy principles including the National Privacy Principles, and/or
  • conditions attached to a public interest approval granted under section 157 of the Act.

It’s best to make your privacy complaint as soon as you are aware that your privacy may have been breached. The earlier you tell us, the sooner we can act. Make sure you tell us what outcome you are seeking or the action you want us to take.

The Department of Health may decline to deal with a complaint where 12 months or more has elapsed since you first became aware of the act or practice. If you wish to complain about an act or practice that took place more than 12 months ago, tell us the reason for the delay when lodging your complaint.

Hospital or Health Service privacy complaint

If your complaint is about the way a Hospital and Health Service (HHS) has dealt with your personal information, you will need to contact them directly.

Find the privacy contact for your HHS.

Department of Health privacy complaint

Privacy complaints made to the Department of Health must:

  • be in writing
  • include an address so we can reply
  • be about your personal information (not someone else)
  • give specific detail about your concerns/issues with how the department has handled your personal information.

In order to properly and efficiently respond to your privacy complaint, you should ensure that it contains sufficient information to enable the department to understand the nature of your complaint, the impact it has had on you and what outcome you are seeking.

Attach copies of any documents you consider may assist the department to investigate your privacy complaint.

In the course of conducting the investigation, the nature of your privacy complaint and your identity may need to be disclosed to relevant business areas within the department and third parties. You can advise us that you do not wish for the department to do this, but be aware that this may mean the department cannot properly investigate and resolve the privacy complaint.

Your privacy complaint should be marked Private and Confidential and sent:

By post:

Principal Privacy Officer
Privacy and Right to Information Unit
Department of Health
GPO Box 48

By email:

Responding to your privacy complaint

An acknowledgement letter or email will be sent to you within 5 business days of the receipt of the privacy complaint. To make sure your personal information is protected, we take precautions to verify the identity of complainants. Depending on the nature of your privacy complaint, we may request that you provide sufficient evidence of identity in order to progress with your complaint. If we require further information, we will contact you.

We will then respond within 45 business days outlining our decision and reasons for this decision.

However, if your privacy complaint is complex or requires extensive work and consultation, we may not be able to respond within 45 business days. If this happens, we will notify of the delay in writing.

Anonymous privacy complaint

We will accept and process anonymous privacy complaints. However, an anonymous privacy complaint may be difficult to deal with and a response may be unable to be provided.

Withdraw a privacy complaint

If you wish to withdraw a privacy complaint, it must be in writing. We may still continue with the assessment if the privacy complaint involves a serious or significant issue that requires further management.

Further action

If you are not satisfied with our response, or have not received a response, and at least 45 business days have passed since the privacy complaint was made in writing to the Department of Health, you can refer the privacy complaint to the Office of the Information Commissioner (OIC) Queensland.

This can be done through the online complaints form or in person, post, email or fax.

Find out more about lodging a privacy complaint with the OIC.

Last updated: 19 January 2024