# Can the Privacy Commissioner check up on how my data is being handled during an investigation?

- Jurisdiction: Australia
- Practice area: Privacy & Data Protection
- Published: 2026-10-23
- Last updated: 2026-10-23
- Canonical: https://lawasked.com/au/privacy-law/can-privacy-commissioner-check-up-how-my-data

## Question

I am writing to seek some guidance regarding a situation here in Victoria. About three months ago, in early February, a large retail company I deal with regularly notified me that they had suffered a significant data breach involving my personal details and banking information. Since then, I have been quite worried about how my private information is being managed. I recently heard that the Privacy Commissioner might be looking into this specific breach to see if the company followed the rules. I have already tried contacting the company's customer service department twice to ask about their security measures, but they just gave me generic responses about their data protection programme and didn't say much else. I am now confused about whether the Commissioner actually has the power to monitor the specific information the company provides during their investigation or assessment. Specifically, I want to know if there is a formal process where the Commissioner can oversee the data being handed over to ensure everything is being handled properly under the law, or if they just take the company's word for it?

## Summary

Yes, the Privacy Commissioner has significant powers to monitor and oversee the information provided by companies during investigations or assessments. They do not simply take a company's word for it; they have legal authority to require documents and monitor the data being handled.

## Analysis

In your situation involving the retail company's data breach from February, the Privacy Commissioner is not limited to the generic responses you received from customer service. Under the law, the Commissioner has specific 'monitoring powers' that allow them to oversee how information is being handled during formal processes.

Specifically, if the Commissioner is conducting an assessment regarding the Australian Privacy Principles (the rules for how companies handle personal data), the information provided is subject to monitoring [cite:au-privacy-1988-sec80tb]. This means there is a formal oversight mechanism in place. Furthermore, if the Commissioner is conducting an assessment, they have the power to demand specific evidence. The law states the Commissioner may "require the entity or file number recipient to give the information or produce the document within the period specified in the notice" [cite:au-privacy-1988-sec33c]. This means the company must hand over the actual documents or data requested, rather than just providing verbal assurances.

During an investigation, the Commissioner's powers are even broader. They may "obtain information from such persons, and make such inquiries, as he or she thinks fit" [cite:au-privacy-1988-sec43]. This allows the Commissioner to dig deeper into the company's actual security measures and data handling practices to see if they truly complied with the law. 

It is important to note that while the Commissioner has these powers, the law does not specify exactly how much detail they will share with you personally regarding the specific documents they have reviewed from the retail company. The Commissioner's role is to oversee the company's compliance, not necessarily to act as your personal data auditor.

## Statutory citations

- Privacy Act 1988, Section 80TB - Monitoring powers [in force] (https://www.legislation.gov.au/C2004A03712/latest/text)
  > Information given in compliance, or purported compliance, with any of the following provisions is subject to monitoring... (b) subsection 33C(3) (requirement to provide information relating to an assessment)
- Privacy Act 1988, Section 33C - Commissioner may conduct an assessment relating to the Australian Privacy Principles etc. [in force] (https://www.legislation.gov.au/C2004A03712/latest/text)
  > the Commissioner may, by written notice, require the entity or file number recipient to give the information or produce the document within the period specified in the notice
- Privacy Act 1988, Section 43 - Conduct of investigations [in force] (https://www.legislation.gov.au/C2004A03712/latest/text)
  > The Commissioner may, for the purposes of an investigation, obtain information from such persons, and make such inquiries, as he or she thinks fit.

---
General information only, not legal advice. See https://lawasked.com/disclaimer