DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If an organisation has mishandled your personal data, ignored your access request, or refused to delete information you have a right to erase, you can escalate the matter to the Data Protection Commission (DPC). As Ireland's independent supervisory authority under the GDPR and the Data Protection Act 2018, the DPC has real enforcement powers, including issuing multi-million-euro fines against some of the world's largest tech companies. But before you file, it helps to understand exactly how the process works, what evidence strengthens your case, and what realistic outcomes look like.

This guide walks you through the entire complaint pathway with the DPC Ireland, from your first contact with the offending organisation to the DPC's formal decision.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's national data protection authority, headquartered in Dublin. It is responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. Because so many multinational tech companies (Meta, Google, TikTok, LinkedIn, Apple) have their EU headquarters in Ireland, the DPC is often the lead supervisory authority for cross-border cases across the entire European Economic Area.

The DPC's powers include:

• Investigating complaints from individuals ("data subjects")
• Conducting own-volition inquiries into organisations
• Issuing reprimands, warnings, and enforcement notices
• Imposing administrative fines of up to €20 million or 4% of global annual turnover
• Suspending international data transfers

When Should You File a Complaint With the DPC?

You can lodge a complaint with the DPC when you believe an organisation has infringed your rights under the GDPR or the Data Protection Act 2018. Common grounds include:

• Ignored subject access requests (SARs) — the organisation failed to respond within one month or provided an incomplete response.
• Refusal to delete data — your right to erasure ("right to be forgotten") was denied without a valid legal basis.
• Unlawful marketing — you received unsolicited emails, SMS, or calls without consent (also covered by ePrivacy Regulations 2011).
• Data breach notifications — you were affected by a breach that was mishandled or not disclosed.
• Excessive data collection — an organisation collected more personal data than necessary for its stated purpose.
• Cookie consent violations — websites setting non-essential cookies without valid consent.
• CCTV misuse — inappropriate surveillance in workplaces, apartment complexes, or public areas.

Try to Resolve It Directly First

The DPC strongly encourages complainants to raise the issue with the organisation before escalating. In most cases, you must contact the organisation's Data Protection Officer (DPO) or privacy team first and give them a reasonable opportunity to respond. Only after they fail to resolve the issue, or you're unhappy with their response, should you file with the DPC.

Step-by-Step: How to File a Complaint With DPC Ireland

The DPC accepts complaints through several channels, but the online webform is the fastest and most reliable route. Here is the full process:

1. Gather your evidence. Collect copies of any emails, screenshots, letters, contracts, or privacy notices related to the issue. Note dates, names of representatives you spoke to, and reference numbers.
2. Contact the organisation directly. Send a written complaint (email is fine) to their DPO or customer service. Keep copies. Wait at least 30 days for a substantive response.
3. Visit the DPC website. Go to dataprotection.ie and select "Contact" → "Raise a Concern".
4. Complete the online webform. Provide your personal details, identify the organisation, describe the issue in clear factual language, and specify what right you believe was infringed.
5. Upload supporting documents. Attach your prior correspondence with the organisation and any evidence. PDF format is preferred.
6. Submit and record your reference number. You'll receive an acknowledgement, usually within a few working days.
7. Respond to DPC queries. The case handler may request further information. Reply promptly to avoid delays.

Alternative Ways to File

If you cannot use the online form, you can also contact the DPC by:

• Post: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28
• Email: info@dataprotection.ie
• Phone: +353 (0)761 104 800 (for guidance, not for lodging formal complaints)

What Information Should Your Complaint Include?

A well-structured complaint moves faster through the DPC's queue. Include the following details:

Section	What to Include
Your identity	Full name, address, email, phone number
The organisation	Legal name, registered address, website, DPO contact if known
Nature of complaint	Clear factual summary in chronological order
Legal basis	Which GDPR right you believe was infringed (Articles 15–22 cover access, rectification, erasure, portability, etc.)
Prior contact	Dates and copies of your correspondence with the organisation
Outcome sought	What you want to happen — deletion, correction, cessation of processing, etc.
Evidence	Emails, screenshots, letters, privacy notices

What Happens After You File?

Once your complaint is submitted, the DPC will assess whether it falls within its jurisdiction and whether there is sufficient basis to investigate. The process typically unfolds in these phases:

1. Acknowledgement and Triage

Within a few weeks, a case handler is assigned. They will confirm receipt and may ask clarifying questions.

2. Amicable Resolution

Under Section 109 of the Data Protection Act 2018, the DPC will typically first attempt to resolve the complaint amicably by mediating between you and the organisation. Many complaints are resolved at this stage without a formal decision.

3. Formal Investigation or Inquiry

If amicable resolution fails, the DPC may open a formal statutory inquiry. This involves gathering evidence from the organisation, reviewing internal documents, and, for cross-border cases, coordinating with other EU data protection authorities under the One-Stop-Shop mechanism.

4. Draft Decision and Corrective Measures

The DPC issues a draft decision. Where cross-border processing is involved, this decision is shared with concerned supervisory authorities across the EU for input under Article 60 GDPR.

5. Final Decision

The final decision may include reprimands, orders to comply, bans on processing, or administrative fines. You will receive written notification of the outcome.

How Long Does It Take?

Timelines vary significantly. Simple domestic complaints (e.g., a small Irish business ignoring a SAR) may be resolved in 2–6 months. Complex cross-border cases involving multinational tech companies can take 2–5 years, or occasionally longer, particularly when they involve novel legal questions or judicial appeals.

The DPC publishes annual reports showing average handling times and case outcomes, which is worth reviewing to set realistic expectations.

Can You Appeal a DPC Decision?

Yes. If you disagree with the DPC's final decision, you have the right to appeal to the Circuit Court within 28 days of being notified. Organisations subject to enforcement action or fines have similar appeal rights and often take matters to the High Court, or even the Court of Justice of the European Union in significant cases.

You may also complain to the Office of the Ombudsman if you believe the DPC handled your complaint improperly (as distinct from disagreeing with the outcome).

Protecting Your Privacy Proactively

Filing complaints is a reactive tool. The best defence is minimising unnecessary data exposure in the first place. A few practical habits:

• Use encrypted DNS resolvers like Cloudflare 1.1.1.1 or Quad9 to prevent your ISP from logging every domain you visit.
• Choose privacy-respecting browsers such as Firefox with strict tracking protection, or Brave.
• Audit app permissions on your phone regularly and revoke access that isn't strictly needed.
• Use privacy-first tools for common tasks. When sharing links, for example, a service like Lunyb lets you shorten URLs without extensive tracking baggage — read our honest Lunyb review or compare options in our 2026 URL shortener guide.
• Exercise your GDPR rights routinely. Send annual access requests to major services you use to see exactly what they hold.

Common Mistakes to Avoid

Skipping the Direct Contact Step

The DPC will often close complaints that were never first raised with the organisation. Always give them the chance to fix it — and document that you did.

Vague or Emotional Language

Stick to facts and dates. "On 3 March 2026 I emailed dpo@example.ie requesting deletion of my account data. On 5 April 2026 I had received no substantive response." That reads far more effectively than a lengthy narrative of frustration.

Missing Documentation

Without proof of the underlying issue and your prior attempts to resolve it, the DPC cannot progress an investigation. Screenshots, headers, and timestamped emails all matter.

Filing Against the Wrong Authority

If the organisation is not established in Ireland and does not conduct cross-border processing in the EU, the DPC may not be the correct authority. In such cases, you should file with the data protection authority in the member state where you reside or where the alleged infringement occurred.

Frequently Asked Questions

Is there a fee to file a complaint with the DPC?

No. Lodging a complaint with the Data Protection Commission is completely free. The DPC is funded through the Irish exchequer, and there are no filing or processing fees for individuals.

Can I file a complaint anonymously?

Generally no. The DPC needs to communicate with you throughout the process and, in most cases, share your identity with the organisation so they can respond. However, you can request that certain personal details be redacted where publication of the case is planned, and you can raise concerns confidentially with the DPC for general information without lodging a formal complaint.

What if the organisation is based outside Ireland?

If the organisation is established in another EU member state, you can still file with the DPC and it may be transferred to the lead supervisory authority under the One-Stop-Shop mechanism. For organisations based entirely outside the EU that target EU residents, GDPR still applies and you can file with the DPC or your local supervisory authority.

Can I claim compensation through the DPC?

No. The DPC investigates infringements and can impose regulatory sanctions, but it cannot award you personal compensation. To claim damages for material or non-material harm caused by a GDPR breach, you must bring a separate civil action in the Circuit Court or High Court under Section 117 of the Data Protection Act 2018.

How do I check the status of my complaint?

You can email your assigned case handler directly using the reference number in your acknowledgement. For general updates, you can also contact info@dataprotection.ie quoting your reference. The DPC does not currently offer a real-time online case tracker for individuals.

Final Thoughts

Filing a complaint with the DPC Ireland is one of the most powerful individual actions you can take to hold organisations accountable for how they handle your personal data. The process rewards preparation: contact the organisation first, gather your evidence, describe the issue factually, and cite the specific right you believe was infringed. While outcomes can take time — especially for cross-border cases against tech giants — every well-founded complaint contributes to shaping how data protection law is enforced across Europe.

Combined with everyday privacy hygiene like limiting data disclosure, using privacy-respecting tools, and regularly exercising your access rights, you can meaningfully reduce your exposure and, when things go wrong, know exactly how to push back.