Customer complaints and what Australian law requires of your business

A customer complaint is usually a business problem, not a legal one. But the way you respond to it is governed by law, and a refusal, or a slip in what you say to the customer, can turn a small dispute into a compliance issue.

There is no single Australian statute that requires every business to keep a written complaints policy. What the law does is attach obligations to the act of handling a complaint. If you sell goods or services to consumers, the Australian Consumer Law (ACL) determines the remedies you must offer. If you collect personal information while investigating a complaint, privacy law may regulate how you handle it. And if you operate in a sector such as telecommunications, financial services or disability services, a mandatory complaints scheme may apply to you. This article sets out who those obligations catch, what they require, and what happens if you get them wrong.

Does the law apply to your business?

Three separate triggers decide whether you carry complaint-handling obligations:

Supplying consumers: if you supply goods or services to consumers in trade or commerce, the consumer guarantee provisions of the ACL apply. The ACL is Schedule 2 of the Competition and Consumer Act 2010 (Cth), and it does not only bite large companies. A person acquires goods as a consumer if the price is $100,000 or less, if the goods are of a kind ordinarily acquired for personal, domestic or household use, or if they are a vehicle or trailer acquired to transport goods on public roads (s 3 of the ACL). A buyer who acquires goods for re-supply, or to transform them in a production process, is not a consumer. But most retail, e-commerce, hospitality and trade customers are, so most small businesses carry the guarantees.
Privacy: the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) generally bind businesses whose annual turnover in the previous financial year exceeded $3 million. Below that threshold the small business exemption applies, but it is lost in important situations. You are not exempt if you are a health service provider holding health information, if you collect or disclose personal information for a benefit, if you are a credit reporting body, or if you provide services under a Commonwealth contract (s 6D of the Privacy Act). A complaints register full of customer details can bring you into contact with these rules even when you think you are too small to be caught.
Sector schemes: some industries carry their own mandatory complaint-handling requirements, which are covered in more detail below. Carriers and eligible carriage service providers must join the Telecommunications Industry Ombudsman (TIO) scheme. Australian financial services and credit licence holders must run internal dispute resolution (IDR) procedures and belong to the Australian Financial Complaints Authority (AFCA). NDIS providers must maintain a complaints management process. If you operate in one of these sectors, the sector scheme operates alongside the ACL, not instead of it.

Respond to guarantee failures with the right remedy

Every supply to a consumer carries a set of implied guarantees under Part 3-2 of the ACL, including that goods are of acceptable quality (s 54), fit for any purpose you made known, and match their description. When a customer complains that a guarantee has not been met, the law fixes the outcome you must offer, and the outcome depends on whether the failure is major or minor.

If the failure is minor, the customer may require you to remedy it within a reasonable time. You can satisfy that requirement by repairing the goods, replacing them with goods of an identical type, or refunding the price (s 261 of the ACL). If you refuse, or take too long, the customer can have the failure fixed elsewhere and recover the cost from you, or reject the goods.

If the failure is major, the customer is entitled to reject the goods and demand a refund, or to keep them and recover compensation for the reduction in value (s 259 of the ACL). A failure is major where a reasonable consumer would not have bought the goods knowing the full extent of the problem, where the goods depart significantly from the description, where they are substantially unfit for their common purpose and cannot be easily and promptly fixed, or where they are unsafe (s 260 of the ACL).

Services work differently. For a minor failure the customer can require you to remedy it within a reasonable time, which for services means supplying the service again. For a major failure, or one that cannot be remedied, the customer may terminate the contract and obtain a refund, or recover compensation for the reduction in value (s 267 of the ACL). In both cases the customer can also claim damages for loss that was reasonably foreseeable.

The practical point for your complaints process is that major and minor determine the remedy, and for a major failure the customer chooses between a refund and compensation. A process that reflexively offers a repair when the law entitles the customer to a refund will not settle the complaint; it will escalate it.

Do not tell customers you have no refunds

Two further ACL provisions police what you say about complaints and remedies. Section 18 prohibits misleading or deceptive conduct in trade or commerce, and s 29 prohibits false or misleading representations in connection with supplying goods or services, including statements about the existence or effect of a guarantee or remedy.

The guarantees cannot be excluded by contract. Section 64 makes void any term that purports to exclude, restrict or modify a consumer guarantee. That is why signs and website policies saying "no refunds", "no refunds on sale items" or "no refunds after 7 days" are generally unlawful. State fair trading agencies treat them as suggesting the statutory guarantees do not apply (Consumer Affairs Victoria, WA Consumer Protection). A change of mind policy is different. You can decline a refund for change of mind, provided the message does not misrepresent the customer's statutory rights.

Staff scripts, refund policies, order confirmations and FAQ pages should all be reviewed with this in mind, because a misrepresentation made while refusing a complaint is itself a contravention.

Protect the personal information complaints bring in

A complaint file can contain the customer's name, contact details, order history and sometimes sensitive information such as health details. If the APPs apply to you, several principles engage when that information is collected. APP 1 requires you to maintain a clearly expressed and up-to-date privacy policy, APP 5 requires a collection notice, APP 11 requires reasonable steps to secure the information, and APPs 12 and 13 give individuals access and correction rights.

If a data breach is likely to result in serious harm and the notifiable data breaches scheme applies to you, you must notify the Office of the Australian Information Commissioner and the affected individuals. Even where the small business exemption applies, good practice is to collect only what the complaint requires, store it securely and tell the customer how it will be used. A complaints policy that says none of this is a weak spot in any privacy complaint.

Meet sector complaint schemes if one covers you

For most businesses, an unresolved complaint ends at a state or territory fair trading agency. The ACCC does not resolve individual complaints; it records reports and uses them to inform its education, compliance and enforcement work (ACCC). Your policy should point customers to the right external avenue rather than to the ACCC.

In regulated sectors the obligations are stronger and mandatory:

Telecommunications: carriers and eligible carriage service providers must join the TIO scheme, and customers can take unresolved complaints there (ACMA).
Financial services: Australian financial services and credit licence holders must maintain IDR procedures that meet ASIC's standards and be members of AFCA for external dispute resolution (ASIC).
NDIS: providers must have a complaints management process, and registered providers must maintain a complaints management and resolution system (NDIS Quality and Safeguards Commission).
Energy: retailers are covered by dedicated energy ombudsman schemes in most states and territories, with similar schemes in other regulated sectors.

If you operate in a sector with a mandatory scheme, check its requirements before drafting your policy. These schemes often set their own acknowledgement and resolution timeframes that your internal process must be able to meet.

What happens if you get it wrong

Non-compliance can be expensive. Breaching the ACL exposes a body corporate to civil pecuniary penalties of up to the greater of $100 million, three times the benefit obtained, or 30% of adjusted turnover, and individuals to up to $2.5 million (s 224 of the ACL). The ACCC and state and territory fair trading regulators can investigate, issue infringement notices and seek court orders including injunctions and penalties, and a consumer can sue you directly under the guarantee provisions for compensation and damages.

Privacy breaches carry their own exposure. A serious or repeated interference with privacy can attract a civil penalty for a body corporate of up to the greater of $50 million, three times the benefit obtained, or 30% of adjusted turnover, and up to $2.5 million for an individual (s 13G of the Privacy Act).

In the sector schemes, decisions can bind you directly. AFCA determinations are binding on member firms, the TIO can require a provider to take remedial action, and the NDIS Commission can take compliance action against providers.

A compliance checklist for complaint handling

Use this checklist when you draft or review your complaints process:

Confirm your ACL exposure: check whether the goods or services you sell are supplied to consumers, which most retail and e-commerce sales are.
Decide whether the APPs apply: run the turnover test and the small business exemption exceptions, especially health services, personal information trading and Commonwealth contracts.
Check for a sector scheme: if you are in telecommunications, financial services, NDIS, energy or another regulated industry, identify the mandatory scheme and its timeframes.
Set realistic timeframes: acknowledge receipt promptly and commit to resolving within a reasonable time, which is the standard the ACL uses, and keep the customer updated if you need longer.
Train staff on major versus minor failures: the remedy differs, and for a major failure the customer chooses between a refund and compensation.
Audit refund messaging: remove "no refunds" style signs and wording, and keep any change of mind policy clearly framed so it does not misrepresent statutory rights.
Protect complaint information: collect only what you need, secure it, and refer customers to your privacy policy and collection notices.
Keep a complaints register: record dates, issues, actions and outcomes so you can spot patterns and show you acted fairly if a matter escalates.

Where a lawyer actually helps

Drafting a complaints policy is something many businesses can do themselves, but legal help is worth it in specific situations. A lawyer can map your sector obligations, including mandatory schemes and IDR timeframes, before you commit to a process your team cannot meet. A lawyer should also review refund and returns messaging against s 18 and s 29, because that is where most contraventions actually occur, and prepare a privacy policy and collection notices where the APPs apply. If a complaint escalates to regulator contact, a court claim or an ombudsman decision, early advice is cheaper than defending a penalty later.

Fix your refund messaging first

The duty most often missed is not the one in the policy document; it is the message the customer hears at the counter, in the automated reply or on the website. "No refunds" is the fastest way to convert a fixable complaint into a contravention of s 18 or s 29, and it costs nothing to correct. Review your signs, website, order confirmations and staff scripts this week, and make sure your complaints process acknowledges receipt and states a realistic timeframe. And if you run a health service, collect personal information for a benefit or handle tax file numbers, do not assume the $3 million threshold protects you. The small business exemption has exceptions that catch businesses by surprise, and a complaint file is where that exposure tends to surface.