DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If your personal data has been mishandled by a company, app, or public body operating in Ireland or the EU, you have the right to file a complaint with the Data Protection Commission (DPC), Ireland's independent regulator for data protection. Because Ireland hosts the European headquarters of major tech firms including Meta, Google, TikTok, Apple, and X, the DPC plays a uniquely powerful role in enforcing the General Data Protection Regulation (GDPR) across the EU.

This guide walks you through exactly how to file a privacy complaint with the DPC Ireland in 2026 — including what counts as a valid complaint, the documents you need, what to expect after submission, and how to escalate if you're unhappy with the outcome.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is the national independent authority responsible for upholding the fundamental right of individuals in the European Union to have their personal data protected. Established under the Data Protection Act 2018, the DPC enforces both the GDPR and Ireland's domestic data protection law.

The DPC has the power to:

• Investigate complaints from individuals ("data subjects").
• Conduct own-volition inquiries into organisations.
• Issue reprimands, corrective orders, and administrative fines of up to €20 million or 4% of global annual turnover.
• Act as lead supervisory authority for cross-border cases involving Big Tech companies headquartered in Ireland.

When Can You File a Complaint With the DPC?

You can file a complaint with the DPC if you believe an organisation has breached your data protection rights under the GDPR or the Data Protection Act 2018. Common grounds include:

• Unlawful processing — a company using your data without a valid legal basis (e.g., no consent, no legitimate interest).
• Failure to respond to a subject access request (SAR) — the organisation didn't reply within one month.
• Refusal to delete your data when you exercised your right to erasure.
• Direct marketing without consent — unsolicited emails, calls, or SMS messages.
• Data breaches that exposed your personal information.
• Excessive CCTV monitoring or workplace surveillance.
• Inaccurate data the organisation refused to correct.

Try to Resolve It Directly First

Before contacting the DPC, the regulator strongly encourages you to first raise the issue directly with the organisation's Data Protection Officer (DPO) or customer service team. Most companies operating in the EU have a published DPO contact (look for "Privacy Policy" or "Contact DPO" on their website). Give them at least one month to respond.

Step-by-Step: How to File a Complaint With DPC Ireland

Step 1: Gather Your Evidence

Before submitting, collect everything that supports your case:

1. Copies of emails or letters you sent to the organisation.
2. The organisation's response (or proof they didn't reply).
3. Screenshots of the privacy issue (e.g., marketing emails, app permissions).
4. Dates and timeline of events.
5. Any reference numbers from the company.

Step 2: Choose Your Submission Method

The DPC accepts complaints through three channels:

• Online webform — available at dataprotection.ie under "Contact / Raise a Concern".
• Email — info@dataprotection.ie
• Post — Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland. (A second office is located at Fitzwilliam Square, Dublin.)

Step 3: Complete the Complaint Form

The online form will ask for:

1. Your full name and contact details.
2. The name and contact details of the organisation you're complaining about.
3. A clear description of what happened.
4. The specific data protection right you believe has been infringed.
5. What outcome you are seeking (e.g., deletion, apology, compensation).
6. Confirmation that you've tried to resolve the matter directly.

Step 4: Submit and Receive an Acknowledgement

After submission, the DPC will send you an acknowledgement, typically within 5–10 working days, with a case reference number. Keep this number for all future correspondence.

Step 5: Engage With the Investigation

A case officer will be assigned. They may contact you for further information, attempt amicable resolution, or open a formal inquiry. You should respond promptly to any requests — delays on your side can stall the process.

What Happens After You File?

The DPC typically follows a tiered process depending on the complexity of the case.

Stage	What Happens	Typical Timeline
Acknowledgement	You receive a case reference number.	5–10 working days
Initial Assessment	DPC checks jurisdiction and validity.	1–3 months
Amicable Resolution	DPC liaises between you and the organisation.	3–6 months
Formal Inquiry	Statutory inquiry opened if no resolution.	6 months – 2+ years
Decision	Final decision, possibly with fines or orders.	Varies

For cross-border cases involving Meta, Google, TikTok, or similar firms, the process can take significantly longer because the DPC must coordinate with other EU supervisory authorities under the "one-stop-shop" mechanism.

Cross-Border Complaints: The One-Stop-Shop

Because Ireland hosts the EU headquarters of many global tech companies, the DPC often acts as the "lead supervisory authority" for cross-border GDPR cases. This means that even if you live in Germany, France, or Spain, your complaint about a Dublin-headquartered company may end up being handled by the DPC.

You can file your complaint with your local supervisory authority — they will forward it to the DPC if Ireland is the lead. However, filing directly with the DPC can sometimes speed things up.

What the DPC Can — and Can't — Do for You

What It Can Do

• Order organisations to comply with GDPR (e.g., delete your data, fulfil your access request).
• Issue reprimands and corrective measures.
• Impose significant administrative fines.
• Refer cases to the courts.

What It Can't Do

• Award you financial compensation (this requires a separate civil case in the Circuit Court).
• Resolve purely contractual disputes unrelated to data protection.
• Provide legal advice on your individual case.

Notable DPC Enforcement Actions

To show the DPC's reach, here are some headline fines the regulator has handed down in recent years:

Company	Fine	Reason
Meta (Facebook)	€1.2 billion	Illegal EU–US data transfers
TikTok	€345 million	Children's data processing failures
Instagram	€405 million	Minors' data exposure
WhatsApp	€225 million	Transparency violations
LinkedIn	€310 million	Behavioural advertising consent

These figures demonstrate that individual complaints can — and do — lead to landmark enforcement decisions across the EU.

Tips for Writing a Strong Complaint

1. Be concise and factual. Stick to dates, actions, and direct quotes from correspondence.
2. Cite the specific GDPR right you believe was infringed (e.g., Article 15 — right of access, Article 17 — right to erasure).
3. Attach evidence rather than describing it.
4. Explain the impact — what harm or distress did the issue cause?
5. State the outcome you want clearly.

Protecting Your Privacy Day-to-Day

Filing a complaint is a reactive step — but the best privacy strategy is proactive. Simple habits go a long way: review app permissions monthly, use unique passwords with a password manager, and avoid sharing raw tracking-laden links. Tools like Lunyb, a privacy-respecting URL shortener, can help you share links without exposing referral data or long tracking parameters to recipients. For a deeper look at how it handles user data, see our honest Lunyb review or compare options in our 2026 URL shortener buyer's guide.

What If You're Unhappy With the DPC's Decision?

If you disagree with the outcome, you have several options:

1. Request a review from the DPC, providing new evidence or argument.
2. Appeal to the Circuit Court within 28 days of the decision.
3. Seek judicial review in the High Court if you believe the DPC acted unlawfully.
4. Complain to the European Data Protection Board (EDPB) for cross-border cases.
5. Pursue civil action for compensation in the Irish courts.

FAQ

Is it free to file a complaint with the DPC Ireland?

Yes. Filing a complaint with the Data Protection Commission is completely free. There are no submission fees, and you do not need a solicitor — though legal advice can be helpful for complex cases.

How long does the DPC take to resolve a complaint?

Simple cases may be resolved through amicable resolution within 3–6 months. Formal statutory inquiries, especially cross-border cases against large tech companies, can take 1–3 years or longer. The DPC publishes annual reports detailing average handling times.

Can I file a complaint anonymously?

No. The DPC requires your identity to investigate properly and to communicate the outcome to you. However, your details are kept confidential and are not shared with the organisation unless necessary for the investigation.

Can I claim compensation through the DPC?

No. The DPC cannot award monetary compensation. If you've suffered financial loss or non-material damage (e.g., distress), you must bring a separate civil claim in the Circuit Court under Section 117 of the Data Protection Act 2018.

What if the company is based outside Ireland?

If the company has its EU main establishment in Ireland (like Meta or Google), the DPC is the lead authority. If it's based in another EU country, you can still file with the DPC and they will forward it — but it may be quicker to contact your local data protection authority directly.

Do I need a lawyer to file a complaint?

No. The DPC's process is designed to be accessible to individuals without legal representation. That said, for complex cases involving significant harm or potential civil claims, consulting a solicitor specialising in data protection is worthwhile.

Disclaimer: This article provides general information about the DPC complaint process and does not constitute legal advice. For advice on your specific situation, consult a qualified Irish solicitor.