DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If a company has mishandled your personal data, ignored a subject access request, or refused to delete your information, you have the right to complain to the Data Protection Commission (DPC) of Ireland. As the lead supervisory authority for many of the world's largest technology companies headquartered in Dublin, the DPC is one of the most consequential privacy regulators in Europe. This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what evidence you need, how long the process takes, and what outcomes you can realistically expect.

What Is the DPC Ireland?

The Data Protection Commission (DPC) is Ireland's independent supervisory authority responsible for enforcing the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the ePrivacy Regulations. Established in its current form in 2018, the DPC investigates complaints, issues fines, and provides guidance on data protection law to both individuals and organisations operating in Ireland.

Because companies like Meta, Google, TikTok, Apple, Microsoft, and LinkedIn have their EU headquarters in Ireland, the DPC acts as the lead authority for cross-border investigations involving these firms under the GDPR's one-stop-shop mechanism. This makes filing a complaint in Ireland uniquely impactful — your individual complaint can sometimes trigger investigations with EU-wide consequences.

What the DPC Can and Cannot Do

The DPC can investigate organisations, order them to comply with the law, issue reprimands, and impose administrative fines of up to €20 million or 4% of global annual turnover (whichever is higher). However, the DPC does not award personal compensation to complainants — for damages, you must pursue a separate civil claim through the Irish courts.

When Should You File a Complaint With the DPC?

You should consider filing a complaint when an organisation has breached your data protection rights and has either failed to resolve the issue or refused to engage with you. Common grounds for complaint include:

• Ignored Subject Access Request (SAR): The organisation did not respond within one month to your request for a copy of your personal data.
• Refusal to delete data: You exercised your right to erasure and the organisation refused without valid legal grounds.
• Unlawful processing: A company is using your data without a valid legal basis (consent, contract, legitimate interest, etc.).
• Data breach notification failures: You were affected by a breach but were not informed.
• Direct marketing without consent: Unsolicited emails, texts, or calls after you opted out.
• Cookie and tracking violations: Websites tracking you without proper consent under ePrivacy rules.
• CCTV and surveillance: Disproportionate or unlawful monitoring by employers, neighbours, or businesses.

Try to Resolve It Directly First

The DPC strongly recommends — and in practice often requires — that you first contact the organisation's Data Protection Officer (DPO) or privacy team to attempt resolution. Keep a written record of every communication. If the organisation does not respond within one month or refuses to act, you have a strong basis to escalate to the DPC.

Step-by-Step: How to File a Complaint With the DPC

The DPC accepts complaints through several channels, but the most efficient route is the online webform. Here is the full process from start to finish.

Step 1: Gather Your Evidence

Before you submit anything, compile a complete file containing:

1. Your full name, address, and contact details.
2. The name and contact details of the organisation you are complaining about.
3. A clear, chronological description of what happened.
4. Copies of all correspondence with the organisation (emails, letters, screenshots).
5. The date you first raised the issue with the organisation.
6. The specific data protection right you believe was infringed (e.g., right of access, right to erasure).
7. What outcome you are seeking.

Step 2: Choose Your Submission Method

The DPC offers three official ways to file a complaint:

Method	How to Use	Best For
Online Webform	Visit dataprotection.ie and use the "Raise a Concern" or formal complaint form	Most complainants — fastest acknowledgement
Email	info@dataprotection.ie	Complex cases with large attachments
Post	Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28	Those without digital access or sending certified documents

Step 3: Complete the Complaint Form

The online form will ask you to identify the type of complaint, the organisation involved, and to upload supporting documents. Be concise but complete. Use bullet points where possible and reference specific GDPR articles if you know them (for example, "Article 15 — Right of Access" or "Article 17 — Right to Erasure").

Step 4: Receive Acknowledgement

The DPC will normally acknowledge your complaint within 5 to 10 working days and assign a case reference number. Keep this number for all future correspondence.

Step 5: Engage With the Case Officer

A case officer will be assigned and may contact you for further information. They will typically also contact the organisation to seek their response. You may be asked to consent to amicable resolution, where the DPC mediates between you and the organisation.

Step 6: Outcome and Decision

The DPC will either resolve the matter informally, issue a formal decision under Section 109 of the Data Protection Act 2018, or — for systemic issues — open a statutory inquiry. You have the right to appeal a DPC decision to the Circuit Court within 28 days.

How Long Does a DPC Complaint Take?

Realistically, simple complaints are often resolved within 3 to 6 months. Cross-border complaints involving large tech companies can take 1 to 3 years due to the cooperation procedures required under Article 60 of the GDPR. The DPC has faced criticism for slow handling of high-profile cases, though recent reforms and additional staffing have shortened average timelines.

Speeding Up Your Complaint

• Submit a complete file from the outset — missing evidence is the biggest cause of delay.
• Reply promptly to any DPC requests for information.
• Be specific about which right was breached rather than making broad allegations.
• If you have suffered ongoing harm (such as continued unwanted marketing), state this clearly.

What Outcomes Can You Expect?

The DPC has a graduated range of remedies. Understanding them in advance helps you set realistic expectations.

Outcome	When It's Used	What It Means for You
Amicable Resolution	Both parties agree to a fix	Issue resolved without formal decision
Reprimand	Minor or first-time breach	Organisation warned, no fine
Compliance Order	Ongoing breach	Organisation must act (e.g., delete your data) by deadline
Administrative Fine	Serious or systemic breach	Fine paid to the State, not to you
Civil Court Referral	For compensation	You must file a separate claim under Section 117

Cross-Border Complaints and the One-Stop-Shop

If your complaint involves an organisation with its EU main establishment in Ireland (such as Meta or Google), the DPC will act as lead supervisory authority. Your complaint will be processed cooperatively with data protection authorities in any other affected EU member states. You can file with your local authority instead — for example, the CNIL in France or the BfDI in Germany — and they will forward it to the DPC. However, filing directly with the DPC often shortens the administrative chain.

Protecting Your Privacy While the Complaint Is Pending

Filing a complaint can take months. In the meantime, take practical steps to limit further exposure of your personal data:

• Use privacy-respecting browsers and enable tracker blocking by default.
• Switch to encrypted DNS resolvers to reduce the data trail your network provider sees.
• Use short, disposable links for any URLs you share publicly. A privacy-focused shortener like Lunyb lets you mask destinations and rotate links if you suspect a tracking issue. You can read our honest Lunyb review or compare options in our 2026 URL shortener guide.
• Review and tighten your account permissions on social platforms.
• Set up Google Alerts on your own name to monitor unwanted data exposure.

Common Mistakes That Get Complaints Rejected

The DPC will not pursue every complaint. Cases are often closed early when:

1. You did not contact the organisation first. The DPC expects evidence of an attempted resolution.
2. The complaint is outside DPC jurisdiction. For example, complaints about journalism, court records, or matters governed by other regulators.
3. The complaint is vexatious or repetitive. Repeated complaints on the same matter may be refused.
4. The matter is trivial. The DPC may exercise discretion not to pursue minor technical breaches with no real harm.
5. You waited too long. While there is no strict statutory deadline, very old complaints are harder to investigate.

Your Rights If You Disagree With the DPC's Decision

If you believe the DPC has wrongly closed or decided your complaint, you have two options. First, you can request an internal review by writing to the DPC and explaining why you think the decision is incorrect. Second, you can appeal the decision to the Circuit Court within 28 days of receiving it. You may also have separate rights under Section 117 of the Data Protection Act 2018 to pursue compensation directly through the courts, independently of the DPC's process.

Tips From Experienced Complainants

• Keep it factual. Emotional language weakens otherwise strong complaints.
• Cite the law. Reference specific GDPR articles where you can.
• Quantify the harm. If you have suffered financial loss, distress, or reputational damage, describe it concretely.
• Be patient but persistent. A polite follow-up email every 6 to 8 weeks is reasonable.
• Consider parallel action. Complaints to the DPC and civil claims under Section 117 can run in parallel.

Frequently Asked Questions

Is there a fee to file a complaint with the DPC?

No. Filing a complaint with the Data Protection Commission is completely free. You do not need a solicitor, although you may choose to engage one for complex cases or court appeals.

Can I file a complaint anonymously?

No. The DPC requires your identity to investigate properly and to communicate with you about the outcome. However, the DPC will not disclose your identity to the organisation unless strictly necessary, and you can ask for confidentiality where you have a legitimate concern such as employment or domestic risk.

Can I get compensation through a DPC complaint?

The DPC itself cannot award compensation. However, a DPC decision in your favour is powerful evidence in a subsequent civil claim under Section 117 of the Data Protection Act 2018, which you can bring in the Circuit Court for material or non-material damage.

How do I complain about Meta, Google, or TikTok?

Because these companies have their EU headquarters in Ireland, the DPC is the lead authority. File directly with the DPC using the online webform, or file with your national data protection authority who will forward the complaint. Cross-border cases typically take longer due to cooperation requirements with other EU regulators.

What if the organisation is based outside the EU?

The GDPR applies to any organisation processing the personal data of people in the EU, regardless of where the organisation is based. The DPC can still investigate, although enforcement against non-EU companies without an EU representative can be more difficult in practice.

Can my employer complain about me to the DPC if I file a complaint?

You are protected from retaliation for exercising your data protection rights. If you face workplace consequences for filing a legitimate complaint, this could itself give rise to separate legal claims under employment law.

Final Thoughts

Filing a privacy complaint with the DPC Ireland is one of the most powerful tools an individual has against data misuse — and it is free, accessible, and protected by EU law. The process rewards preparation: gather your evidence, attempt resolution first, cite the law clearly, and follow up patiently. Whether your complaint is about a missed subject access request or a major tech platform's data practices, the DPC's decisions carry real weight across the European Union. Done well, your single complaint can change how millions of people's data is handled.