If my complaint is upheld, will the organisation be punished?

If the IC thinks the organisation has breached the Act, they can ask them to put things right so that they comply with the data protection principles.

You should be aware that the IC cannot punish an organisation for breaking the law. Their priority is to get the organisation to change the way it handles personal information properly in the future. In most cases organisations will agree to comply with the data protection principles. If they do not, and the case is a serious one, the IC can order them to do so.