DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If an organisation has mishandled your personal data, ignored your access request, or refused to delete your information, you have the right to complain to the Data Protection Commission (DPC), Ireland's national data protection authority. This guide explains exactly how to file a privacy complaint with the DPC, what evidence you need, how long it takes, and what outcomes you can realistically expect under the GDPR and the Irish Data Protection Act 2018.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's independent supervisory authority responsible for upholding the fundamental right of individuals to have their personal data protected. Because most of the world's largest technology companies — including Meta, Google, TikTok, Apple, LinkedIn, and Microsoft — have their European headquarters in Ireland, the DPC also acts as the lead regulator for these firms across the entire European Union under the GDPR's "one-stop-shop" mechanism.

The DPC's core functions include:

• Handling complaints from individuals (data subjects) about how their personal data is processed.
• Investigating suspected breaches of data protection law.
• Issuing fines, reprimands, and corrective orders against organisations.
• Providing guidance to controllers, processors, and the public.
• Cooperating with other EU data protection authorities.

When Can You File a Complaint With the DPC?

You can lodge a complaint with the DPC whenever you believe your rights under the GDPR or the Data Protection Act 2018 have been infringed by an organisation established in Ireland, or one whose main EU establishment is in Ireland. Common grounds for a complaint include:

• Unlawful processing: An organisation is using your data without a valid legal basis (consent, contract, legitimate interest, etc.).
• Failure to respond to a subject access request (SAR): You asked for a copy of your personal data and received no reply within one month.
• Refusal to erase data: The controller ignored your right-to-be-forgotten request.
• Direct marketing without consent: Unsolicited emails, SMS, or calls in breach of the ePrivacy Regulations.
• Data breach: Your data was exposed and the organisation failed to notify you or the DPC.
• Excessive CCTV or workplace monitoring.
• Inaccurate data that the controller refuses to correct.

Step 1: Try to Resolve It Directly First

The DPC strongly encourages complainants to contact the organisation directly before escalating. This is not strictly required by law, but in practice the DPC will almost always ask what steps you took to resolve the matter yourself. Most controllers must have a designated Data Protection Officer (DPO) or a privacy contact address.

1. Locate the organisation's privacy policy and find the DPO or privacy contact email.
2. Send a written request in clear language, specifying which right you are exercising (access, erasure, rectification, objection, portability, or restriction).
3. Keep a copy of your email, any receipts, and any responses.
4. Give the organisation one calendar month to reply — this is the statutory GDPR deadline (extendable by two months for complex requests).

If they fail to respond, respond inadequately, or refuse without a lawful reason, you now have solid grounds — and evidence — for a formal DPC complaint.

Step 2: Gather Your Evidence

A well-documented complaint is far more likely to be investigated efficiently. Before filing, collect the following:

• The full legal name of the organisation and, if known, its registered address.
• Copies of all correspondence between you and the organisation (emails, letters, screenshots).
• Dates on which you submitted requests and any responses received.
• Screenshots of the offending processing (e.g., a marketing email, a cookie banner, a webpage displaying your data).
• A short chronological summary of events.
• The specific GDPR articles or rights you believe have been breached (optional but helpful).

When sharing evidence links with the DPC or your solicitor, keep URLs tidy and trackable. A privacy-friendly link shortener like Lunyb lets you package multiple screenshots or archived pages under one clean, auditable link without exposing tracking parameters.

Step 3: How to Submit a Complaint to the DPC

The DPC offers three official ways to file a complaint. You do not need a solicitor, and the service is completely free.

Option 1: The Online Webform (Recommended)

The fastest and most reliable method is the electronic complaint form on dataprotection.ie. Navigate to "Contact Us" → "Raise a Concern" and select the category that best fits your issue (e.g., access request, direct marketing, CCTV, data breach).

Option 2: Email

You can email a detailed complaint to info@dataprotection.ie. Include your full name, contact details, the name of the organisation, and a clear description of what happened.

Option 3: Post

Written complaints can be posted to:
Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

Step 4: What Information Must Your Complaint Contain?

Under Section 108 of the Data Protection Act 2018, the DPC needs enough information to identify the parties and the alleged infringement. Include at minimum:

1. Your full name, postal address, email, and phone number.
2. The name and contact details of the organisation you are complaining about.
3. A clear description of the alleged breach of data protection law.
4. The date(s) the events occurred.
5. What steps you have already taken to resolve the matter.
6. What outcome you are seeking (e.g., erasure, apology, corrective action).
7. Supporting documents as attachments.

Step 5: What Happens After You File?

Once the DPC receives your complaint, it follows a standardised handling process. Here is the typical journey:

Stage	What Happens	Typical Timeframe
1. Acknowledgement	The DPC confirms receipt and assigns a case reference number.	1–4 weeks
2. Assessment	A case officer reviews whether the complaint falls within the DPC's remit.	1–3 months
3. Amicable resolution	The DPC contacts the organisation and attempts to resolve the issue informally.	3–6 months
4. Formal inquiry	If unresolved, a statutory inquiry is opened under Section 110 of the 2018 Act.	6–24 months
5. Decision	The Commissioner issues a legally binding decision, which may include fines or corrective orders.	Varies (large cases can take years)

You have a legal right to be kept informed of progress and, under Article 78 GDPR, to challenge the DPC's final decision before the Irish Circuit Court or High Court within 28 days.

Cross-Border Complaints and the One-Stop-Shop

Because so many tech giants are headquartered in Dublin, the DPC frequently handles complaints from residents of other EU member states. If you live in, say, Germany or France and want to complain about Meta, TikTok, or Google, you can file with your local supervisory authority — they will forward it to the DPC as the "lead supervisory authority" under Article 56 GDPR.

This system has been criticised as slow, but recent structural reforms in 2024–2025 have reduced average handling times for cross-border cases, and multi-million-euro fines against Meta, TikTok, and LinkedIn have set important precedents.

What the DPC Cannot Do

Setting realistic expectations is important. The DPC cannot:

• Award you financial compensation. For damages, you must sue the controller in the Circuit Court under Section 117 of the 2018 Act.
• Force an organisation to apologise (though it can order corrective action).
• Investigate matters that fall outside data protection law (e.g., pure defamation, consumer disputes).
• Act on anonymous complaints in most cases.

Protecting Your Privacy While the Complaint Is Ongoing

Filing a complaint can take months. In the meantime, take practical steps to reduce further exposure:

• Change passwords and enable two-factor authentication on affected accounts.
• Use encrypted DNS services (like Cloudflare 1.1.1.1 or NextDNS) to limit tracking at the network level.
• Switch to privacy-respecting browsers such as Brave, Firefox, or Safari with strict tracking protection.
• Use disposable email addresses for signups.
• When sharing evidence links publicly or with journalists, avoid raw URLs that leak referrers — a shortener such as Lunyb can strip tracking parameters and give you click analytics without exposing your identity.
• Review your subject access rights with other controllers to see who else holds your data.

Tips for a Strong Complaint

1. Be concise and factual. Case officers read hundreds of complaints. A one-page timeline beats a 20-page rant.
2. Cite the specific right. Mention "Article 15 access request" or "Article 17 erasure" — it signals you understand the framework.
3. Attach evidence, don't describe it. Screenshots and email threads carry more weight than paraphrasing.
4. State your desired outcome. Do you want data deleted, marketing stopped, or a policy corrected?
5. Follow up politely. If you have not heard back in three months, email the DPC quoting your case reference number.

Recent High-Profile DPC Decisions

The DPC has issued some of the largest GDPR fines in Europe, showing that individual complaints can trigger enormous enforcement actions:

• Meta (2023): €1.2 billion for unlawful EU-US data transfers.
• TikTok (2023): €345 million for children's data processing failures.
• Instagram (2022): €405 million relating to children's account settings.
• LinkedIn (2024): €310 million for behavioural analytics without a valid legal basis.

Many of these inquiries began with complaints from ordinary individuals or advocacy groups like NOYB.

Related Reading

• Is Lunyb Legit? An Honest Review of the URL Shortener in 2026
• Best URL Shorteners Reviewed and Compared: 2026 Buyer's Guide
• Rebrandly Review 2026: Is It Worth the Price?

Frequently Asked Questions

Is filing a complaint with the DPC free?

Yes. The DPC provides its complaint-handling service completely free of charge. You do not need a solicitor, and there are no filing fees. However, if you later wish to seek damages in court, legal costs will apply.

How long does a DPC investigation take?

Simple complaints resolved amicably can close within 3–6 months. Formal statutory inquiries, particularly cross-border cases involving large tech companies, routinely take 12–36 months and sometimes longer. You are entitled to updates during the process.

Can I complain anonymously?

Generally no. The DPC needs to identify you as the data subject to investigate meaningfully and to protect you from retaliation. However, your identity is not usually disclosed to the organisation without your consent, and you can request confidentiality in sensitive cases.

What if I disagree with the DPC's final decision?

Under Article 78 GDPR and Section 150 of the Data Protection Act 2018, you can appeal the decision to the Irish Circuit Court within 28 days of being notified. For very significant cases, judicial review in the High Court may also be available.

Can I claim compensation through the DPC?

No. The DPC cannot award financial compensation. To recover damages for material or non-material harm caused by a GDPR breach, you must bring a separate civil action against the controller under Section 117 of the Data Protection Act 2018, typically in the Circuit Court.

Do I have to be an Irish resident to complain to the DPC?

No. Any individual — regardless of nationality or residence — can complain to the DPC if the controller is based in Ireland or if Ireland is the lead supervisory authority for that controller under the one-stop-shop mechanism.

Final Thoughts

Filing a privacy complaint with Ireland's Data Protection Commission is one of the most powerful tools EU residents have to hold organisations accountable. The process is free, does not require a lawyer, and — while it can be slow — has produced some of the largest privacy enforcement actions in world history. If you have exhausted direct communication with an organisation and your data protection rights remain unresolved, do not hesitate to escalate. Your complaint might be the one that changes how a major company treats millions of users.