Reputation Management in Australia: A Route Map

Reputation management in Australia works best when you match the problem to the right door: eSafety for serious online abuse and intimate images, the Privacy Act and the OAIC for personal information held by organizations, a defamation concerns notice for false statements of fact, and the platform's own reporting tool for almost everything else. There is no single Australian law about "reputation", so the order in which you use those doors matters more than any one of them.

Most people start with the loudest option, usually a lawyer's letter, and discover later that a platform report or a polite correction request would have worked sooner. This guide is the practical map: what each route covers, what it will not do, what comes first, and a realistic sequence.

This is information, not legal advice. Australian states and territories have their own defamation Acts, facts change outcomes, and your own lawyer decides what applies to you. We read New South Wales legislation directly for the defamation points below, and we say plainly where a source could not be read for this guide.

28 daysdefault period after a concerns notice before a New South Wales defamation case can start

1 yearNew South Wales limitation period for defamation, from publication

7 dayswindow for a digital intermediary to act on a written complaint and keep its defense

New South Wales Defamation Act 2005 sections 12B, 14 and 31A, and Limitation Act 1969 section 14B, as read on legislation.nsw.gov.au. Other states and territories have their own Acts, which were not read for this guide.

Which Australian law or regulator fits which problem

Start with what the content is, not with who you are angry at. Each route below has a different trigger, and a post can fit more than one.

The last row is real: much of what worries people is accurate, lawful or opinion, and the honest route there is better content and monitoring.

eSafety: what it covers and what you must do first

The eSafety Commissioner's report page lists four areas: cyberbullying of children, adult online abuse, image-based abuse, and illegal and harmful content such as child sexual abuse material and material that promotes or instructs in terrorist acts or violent crimes. The page does not give time limits for reporting and does not say that you must report to the platform before contacting eSafety. The topic pages for each area do.

Related readUAE Defamation Law Online: Claim, Complaint, Limits

Adult cyber abuse: a high bar

For adults, eSafety's adult cyber abuse page says the content must target a specific Australian adult, be intended to cause serious harm, and be menacing, harassing or offensive in all the circumstances. Its examples include realistic threats and repeated targeting of the same person. It says rudeness, annoyance or disagreement does not meet the bar.

The same page says to report to the platform first and describes that as usually the fastest way to get content removed. It says eSafety can step in when the platform does not help, and that eSafety can direct the person responsible and the service provider to remove seriously harmful content quickly. The main reporting page says only that eSafety's Cyber Report team investigates complaints and assists in getting content removed, without stating the tests. Treat eSafety as a serious-cases route, not a removal service you can count on. As far as we could read the Online Safety Act 2021, a complaint seeking a removal notice for adult cyber abuse must come with evidence that the material was first reported to the service. We could not read the removal notice and compliance sections for this guide, so we state no deadline for a platform to comply.

Image-based abuse: report soon, and deepfakes count

For intimate images or video shared, or threatened to be shared, without consent, the image-based abuse page says it affects people regardless of age. It says eSafety can help have the content removed or stop the threats, and in some cases may take action against the person responsible. It says altered or faked images that look like you, also called deepfakes, are included. It gives no removal deadline, and it does not say whether to use the platform's tool first, so doing both on the same day is the safer pattern. Our leak removal page covers how we handle these files. The regulator route is worth starting early.

Related readGDPR Right to Erasure Exceptions: When Refusal Is Lawful

Cyberbullying of under 18s

The cyberbullying page tells young people to report to the site, game or app first, and says that if it does not help and the cyberbullying is serious enough, eSafety can ask the service to remove the content. A parent or guardian can report serious cyberbullying themselves, the person must live in Australia, and the content must be threatening, intimidating, harassing or humiliating and likely to harm physical or mental health. The page sets no waiting period.

Privacy Act and OAIC: correcting personal information

The Office of the Australian Information Commissioner (OAIC) says the Privacy Act regulates how Australian Government agencies and organizations with an annual turnover of more than $3 million, and some other organizations, handle personal information. The 13 Australian Privacy Principles apply to any organization or agency the Act covers. The pages we read did not set out the exemptions in detail, so check whether the organization is covered first.

A correction request, step by step

The OAIC's guidance on correcting personal information says you ask the organization or agency holding the information to correct it, and that only you or someone you authorize can make the request. It must respond within a reasonable period, and the OAIC considers 30 days reasonable. There is no charge. The organization may add, change or delete the information, or refuse where correction would be unreasonable.

If it refuses, it must tell you in writing the reasons, your right to ask for a statement to be associated with the information, and how to complain. A statement says you believe the information is inaccurate, out of date, incomplete, irrelevant or misleading, and the organization must take reasonable steps to associate it with the record so that users of the record can see it. It is a modest outcome, but a record can then carry your version.

Related readDefamation law France: claim, proof and the clock

Complaining, in the right order

The OAIC's complaints guidance says to complain to the organization first, and states that it thinks 30 days is a reasonable time to wait for a response. If the organization does not respond or you are unhappy with the response, you can lodge a complaint with the OAIC and bring a copy of your original complaint. Keep a record of every step, including dates, names and what you asked for.

What the Privacy Act route does not do

It is aimed at organizations that hold personal information, not at a stranger who posted about you. The OAIC's consultation page on doxing and privacy reform describes a right to erasure and a power to require search engines to de-index certain results as proposals the Government agreed to in principle in its response of 28 September 2023. We found no enacted law for either in the sources read. Do not plan around an Australian right to be forgotten that works like the European one.

The statutory tort for serious invasions of privacy

The OAIC's page on the statutory tort says the tort for serious invasions of privacy commenced on 10 June 2025. An individual may bring a claim against a person or organization, including entities that are not covered by the Privacy Act. The plaintiff must show an intrusion upon seclusion or a misuse of information relating to them, a reasonable expectation of privacy, and that the public interest in protecting their privacy outweighs any countervailing public interest. Consent and lawful authority are defenses, and exemptions include certain bodies and, in some circumstances, journalists.

On limits, the OAIC says that for a plaintiff under 18 at the time, proceedings must start before their 21st birthday, and otherwise by the earlier of one year after awareness or three years after the invasion. It also says the OAIC has no direct role in administering the tort and advises independent legal advice. It is a court route, so for most people it comes after cheaper steps.

Related readGermany defamation online: claims, crime, takedown

Defamation: the concerns notice comes first

Defamation is the route for a false statement of fact that harms your reputation. This section covers the practical machinery, as read in the New South Wales Defamation Act 2005.

Section 10A makes serious harm to reputation an element of the claim. That already filters out many complaints: a post that is rude but has reached few people, or that no one believed, may fail on harm.

The notice is a precondition

Under section 12B, an aggrieved person cannot start defamation proceedings unless they have given the proposed defendant a concerns notice, the imputations they rely on were particularised in it, and the applicable period for an offer to make amends has elapsed. Section 12A describes a concerns notice: it tells the publisher the defamatory imputations the person considers the matter carries, and a copy of the matter is provided where practicable.

Under section 14(2), the default period for an offer to make amends is 28 days from when the publisher was given the concerns notice. Under sections 17 and 18, an accepted offer ends the claim against that publisher, and a reasonable offer that was refused can be a defense.

The limitation clock

In New South Wales, section 14B of the Limitation Act 1969 says an action for defamation is not maintainable if brought after a limitation period of one year. If a concerns notice is given within the 56 days before that period ends, the period is extended by 56 days minus any days remaining after the notice day. Section 56A lets a court extend it to up to three years from publication. Do not rely on an extension. Note the publication date and send the notice early.

Related readIndia Defamation Online: Claim, Clock and Takedown

Defenses make a notice harder than it looks

The Act has a public interest defense in section 29A, where the matter concerns an issue of public interest and the defendant reasonably believed publication was in the public interest, and a qualified privilege defense in section 30, defeated by malice. A notice about a story with a real public-interest angle can become a second story. We do not help hide accurate, lawful reporting on wrongdoing.

Platforms and search engines: what the law adds

For most user posts, the first and fastest door is the platform. The Defamation Act adds leverage in one place. Section 31A gives a digital intermediary a defense if it had an accessible complaints mechanism and, where a written complaint was given, took access prevention steps either before the complaint or within 7 days after it. The defense is defeated only if the plaintiff proves the defendant was actuated by malice. That does not oblige a platform to remove anything on request, but a clear, specific written complaint is worth more than an emotional report.

After a judgment, section 39A allows a court to order a non-party digital intermediary to take access prevention steps, but only after the intermediary has been given an opportunity to be heard and only where the plaintiff has obtained judgment against the defendant. That is a late-stage tool, not a starting point.

For search results, the practical route is the search engine's own legal removal process. Google's legal removal page for its products says it will review material that violates the law or your rights and consider blocking, limiting or removing access, asks for the specific URLs and a specific explanation, and says to try to flag the content in the relevant product first. It also notes that restricting access in its products does not remove content that may still exist elsewhere on the web, so contact the site owner as well. Other search engines and AI assistants have their own forms, which we did not read for this guide.

Related readDefamation law South Africa: claim, defenses, clock

Newspapers and publishers: the Press Council and the editor

If the problem is an article, the quickest practical step is often a polite, factual request to the editor to correct or update it, with the evidence attached. The Australian Press Council says it responds to complaints about Australian newspapers, magazines and associated digital outlets, its jurisdiction extends to the print publications and related digital outlets of its constituent bodies, and its online form is the fastest way to complain. The page we read does not say whether you must contact the publication first or give a time limit, so read its complainant information before you file.

A Press Council complaint will not fit a blog or forum outside its membership. A concerns notice is the stronger, costlier alternative.

A realistic order of operations

The sequence below is the one we see work most often, with each step cheap before the next is expensive. It is a guide, not a rule: skip a step that does not fit.

1. Capture before you contactSave full-page captures with the URL, date and time, and the name of the author or account. eSafety's adult cyber abuse page says to save a screenshot, the address, the account name and the date and time, and not to delete the content or block anyone yet, because you may need it as proof.
2. Sort the content by typeIs it an intimate image, abuse, personal data held by an organization, a false statement of fact, or opinion? The table in the first section decides the door.
3. Use the platform tool the same dayReport under the platform's rules. For adult cyber abuse and cyberbullying, eSafety expects this first. Write down the report number and date.
4. Go to the regulator if the platform fails and the threshold is metImage-based abuse can go to eSafety straight away. For other abuse, go once the platform has not helped.
5. Send the correction or complaint to the right partyAn editor, a data holder or the publisher, with your evidence. For personal data, allow the 30 days the OAIC treats as reasonable before escalating.
6. Decide on a concerns notice before the clock runs downIf the statement is false, factual and damaging, take legal advice and send a notice early, because the limitation period in New South Wales is one year.
7. Work on the search side in parallelWhere nothing can be removed, strengthen accurate pages you own so they hold the first results for your name.

How long it usually takes

These ranges are experience, not guarantees, and they shift with the platform and the case. The legal periods in the right-hand column come from the sources above.

A worked scenario, with the assumptions stated

This is an invented scenario with generic parties. A consultant based in New South Wales finds three things in one week: an anonymous social media post accusing her of fraud, a directory page that shows an outdated business address and a wrong qualification, and an old regional news story that is accurate but now misleading because the matter it describes was later resolved in her favor.

She does not treat them as one problem. The post is a false statement of fact, so she captures it, reports it to the platform with a precise explanation, and, if it stays up, takes legal advice about a concerns notice, noting the one-year clock. The directory page holds personal information, so she sends a correction request to the operator if it is a covered organization, waits about 30 days, and escalates to the OAIC if refused, asking for an associated statement. The news story was accurate when published, so she writes to the editor with proof of the outcome and asks for an update.

Related readOnline Harassment Laws by Country: Where Each Route Leads

None of the three removes a search result on its own, so she also builds an accurate profile page and bio that can rank for her name. Each problem goes to the cheapest effective door.

Mistakes that make Australian routes fail

• Starting with a lawyer's letter for an abuse or intimate-image problem. The regulator and platform routes are cheaper and often faster there.
• Missing the clock. In New South Wales the limitation period is one year and the notice step takes 28 days by default.
• Sending a notice about an accurate story. There is nothing to correct, and the attempt can draw new attention.
• Assuming one state's rules apply everywhere. We read New South Wales. Check your own state's Act.

Your next step: sort the content before you contact anyone

Reputation Partners works on the removal and search side of Australian files: reaching the right party, writing the specific request, and strengthening the accurate pages that should hold your name's results. Where a legal step is needed, such as a concerns notice, it belongs with your own Australian lawyer. If your problem is about harmful content that a publisher or platform will not remove, our removal service page explains how that work runs.

Questions people ask

Is there a right to be forgotten in Australia?

Not in the European sense. The OAIC's consultation page on doxing and privacy reform describes a right to erasure and a power to require search engines to de-index certain results as proposals the Government agreed to in principle in September 2023. We found no enacted law for either in the sources read. The practical routes are correction requests, platform and search engine processes, and legal claims.

Can I make a platform remove a post that is false but not abusive?

Not by right. A platform removes content that breaks its rules, and falsehood alone often does not. In New South Wales, section 31A gives a digital intermediary a defense if it has a complaints mechanism and acts within 7 days of a written complaint, which gives a clear, specific written complaint some weight. It is not a duty to remove on request.

How long do I have to take defamation action in Australia?

In New South Wales, one year from publication under section 14B of the Limitation Act 1969, extended by up to 56 days if a concerns notice is given in the last 56 days, and a court may extend to up to three years. Other states and territories have their own Acts, which we did not read, so confirm your state's period with a lawyer.

Do I have to report to the platform before eSafety?

For adult cyber abuse and cyberbullying, eSafety's pages say to report to the platform first. For image-based abuse, the page we read does not say. If intimate images are involved, doing both on the same day is sensible. eSafety pages give no waiting period.

Does the Privacy Act let me remove something a stranger posted about me?

No. The Privacy Act covers how agencies and covered organizations handle personal information, and it gives you correction and complaint rights against them. For a private person's post, consider the platform report, a defamation notice if the post is false, or the statutory tort for serious invasions of privacy, which commenced on 10 June 2025.