DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If a company has mishandled your personal data, ignored a Subject Access Request, or refused to delete information you no longer want online, you have the right to file a complaint with Ireland's Data Protection Commission (DPC). As the lead supervisory authority for many of the world's biggest tech companies, including Meta, Google, TikTok, LinkedIn, and Apple (whose EU headquarters are based in Dublin), the DPC handles some of the most consequential privacy cases in Europe.

This guide explains exactly how to file a privacy complaint with the DPC Ireland, what evidence you need, how long the process takes, and what outcomes you can realistically expect.

What Is the DPC Ireland?

The Data Protection Commission (DPC) is Ireland's independent national authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. It enforces the General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the ePrivacy Regulations.

The DPC has a unique role in Europe because so many multinational tech firms have their EU headquarters in Ireland. Under the GDPR's "one-stop-shop" mechanism, the DPC acts as the lead supervisory authority for cross-border investigations involving these companies. This means an Irish complaint against, say, Instagram, can result in fines and enforcement action affecting users across the entire EU.

What the DPC Can and Cannot Do

• Can do: Investigate complaints, issue corrective orders, impose administrative fines (up to €20 million or 4% of global turnover), order data erasure, and suspend data transfers.
• Cannot do: Award you personal compensation. For damages, you must take a separate civil action in the Circuit Court or High Court.

When Should You File a Complaint With the DPC?

You should consider filing a complaint when a data controller (a company, public body, or organisation) has breached your GDPR rights and either failed to respond adequately or refused to fix the issue. Common grounds include:

1. Ignored Subject Access Requests (SARs): The controller didn't provide a copy of your personal data within one month.
2. Refusal to erase data: A company won't honour your right to be forgotten despite a valid request.
3. Unlawful processing: Your data is being used without a valid legal basis (consent, contract, legitimate interest, etc.).
4. Direct marketing without consent: Unsolicited emails, SMS, or calls under the ePrivacy Regulations.
5. Data breaches: A company exposed your data and failed to notify you appropriately.
6. Cookie consent violations: Websites tracking you without proper consent banners or ignoring your rejections.
7. Inaccurate data: A controller refused to rectify incorrect personal information.

Try to Resolve It Directly First

The DPC strongly encourages you to contact the organisation's Data Protection Officer (DPO) before filing a complaint. Most large companies have a DPO listed in their privacy policy. Send a clear written request, keep copies, and give them the statutory one month to respond. If they refuse or stay silent, you then have strong grounds to escalate.

How to File a Privacy Complaint With the DPC Ireland: Step by Step

The DPC accepts complaints through several channels, but the most efficient method in 2026 is the online webform. Here is the full process.

Step 1: Gather Your Evidence

Before you start the form, collect:

• Your full name, address, and contact details
• The name and contact details of the organisation you're complaining about
• Copies of any correspondence (emails, screenshots, letters) with the organisation
• The original request you made (e.g. your SAR or erasure request) and any reply you received
• Dates of all relevant events
• A clear description of how your rights have been infringed

Step 2: Choose Your Submission Method

You can submit a complaint via:

1. Online webform: Available at dataprotection.ie — the fastest route.
2. Email: info@dataprotection.ie
3. Post: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
4. Phone: +353 (0)761 104 800 (for guidance, but written submission is required).

Step 3: Complete the Complaint Form

The webform asks for:

• Your personal details (you cannot file anonymously — the DPC needs to verify you are the data subject)
• The respondent organisation's details
• A summary of the complaint (be factual, chronological, and concise)
• The specific GDPR articles or rights you believe were breached (optional but helpful)
• What outcome you're seeking
• Uploaded supporting documents (PDF or image format)

Step 4: Submit and Receive Acknowledgement

After submission, the DPC will email you an acknowledgement, usually within a few working days, containing a case reference number. Keep this number for all future correspondence.

Step 5: Engage With the DPC's Assessment

A case officer will review your complaint and may contact you for clarification. They will typically contact the respondent organisation to seek their position. You may be asked to mediate or accept an amicable resolution before formal investigation.

What Happens After You File: The DPC Process

The DPC operates a structured handling procedure. Understanding it helps set realistic expectations.

Stage	What Happens	Typical Timeframe
Acknowledgement	Receipt confirmed, case number issued	1–10 working days
Initial assessment	Case officer reviews validity and scope	2–8 weeks
Amicable resolution	DPC facilitates dialogue with controller	1–6 months
Formal inquiry	Statutory investigation if unresolved	6 months – 2+ years
Decision	Findings, corrective measures, fines	Issued at end of inquiry
Appeal window	Either party can appeal to the Circuit Court	28 days from decision

Amicable Resolution vs Formal Inquiry

The DPC prefers amicable resolution where possible. This often means the controller agrees to provide your data, delete it, or change a practice without an admission of wrongdoing. If you accept, the case closes. If you reject the outcome — or the controller refuses to cooperate — the DPC can launch a formal inquiry under Section 110 of the Data Protection Act 2018.

Possible Outcomes of a DPC Complaint

Depending on the severity of the breach, outcomes can range from a simple letter of advice to multi-million-euro fines.

• No infringement found: The DPC closes the case with reasons.
• Reprimand: A formal warning issued to the controller.
• Compliance order: The controller must take specific action (e.g. delete your data).
• Suspension of processing: A pause or ban on certain data activities.
• Administrative fines: Up to €20 million or 4% of global annual turnover.
• Referral to the European Data Protection Board (EDPB): For cross-border cases requiring EU consensus.

Recent High-Profile DPC Decisions

The DPC has issued some of the largest GDPR fines in history, including penalties against Meta exceeding €1.2 billion for unlawful data transfers, and substantial fines against TikTok concerning children's data. These cases show the DPC's enforcement teeth, though smaller individual complaints rarely result in headline fines.

Pros and Cons of Filing With the DPC

Pros

• Free to file — no legal fees required
• You don't need a solicitor
• The DPC has real enforcement powers, including significant fines
• Acts as lead authority for major tech firms based in Ireland
• Decisions create case law that benefits all EU residents

Cons

• No personal compensation — that requires separate court action
• Investigations can take years, especially cross-border cases
• The DPC has been criticised for slow handling of large tech cases
• You cannot remain anonymous
• Outcomes may feel underwhelming if you wanted a public ruling

Protecting Your Privacy While You Wait

A DPC complaint can take months or years to resolve. In the meantime, you can reduce your ongoing exposure by tightening your own data hygiene. Practical steps include using encrypted DNS (such as Cloudflare's 1.1.1.1 or NextDNS), switching to privacy-respecting browsers like Firefox or Brave, regularly auditing app permissions, and minimising the personal data you share when signing up for new services.

When sharing links — particularly on social media, forms, or marketing material — consider using a link management tool that doesn't aggressively track or sell click data. Lunyb, for example, is a URL shortener that focuses on clean analytics without invasive third-party trackers, making it a sensible choice when you want to share short links without contributing to the wider tracking ecosystem. If you're comparing options, our 2026 buyer's guide to URL shorteners covers the privacy posture of all the major players, and our Rebrandly review takes a closer look at one of the most popular paid alternatives.

What to Do If You're Unhappy With the DPC's Decision

If the DPC dismisses your complaint or you disagree with the outcome, you have several routes:

1. Appeal to the Circuit Court: Within 28 days of the decision, under Section 150 of the Data Protection Act 2018.
2. Judicial review: Challenge procedural failings in the High Court.
3. Complaint to the Ombudsman: If you believe the DPC mishandled the process itself.
4. Civil action for damages: Sue the controller directly under Article 82 GDPR for material or non-material damage.
5. EDPB intervention: In cross-border cases, the European Data Protection Board can override DPC draft decisions.

Tips for a Strong DPC Complaint

• Be specific: Cite which GDPR article you believe was breached (e.g. Article 15 for access, Article 17 for erasure).
• Stick to facts: Avoid emotional language; chronology and evidence carry more weight.
• Show you tried to resolve it: Include your prior correspondence with the company.
• Quantify harm where possible: Identity theft risk, financial loss, distress — explain real-world impact.
• Stay responsive: Reply promptly to case officer queries to avoid delays.
• Keep records: Save every email and decision letter for potential appeal.

Frequently Asked Questions

How much does it cost to file a complaint with the DPC?

Filing a complaint with the Data Protection Commission is completely free. You do not need to pay any fees, and you do not need a solicitor to submit the complaint. If you later choose to appeal a decision to the Circuit Court or pursue civil damages, legal costs may apply at that stage.

How long does the DPC take to handle a complaint?

Simple complaints involving Irish-only controllers can be resolved in 3–6 months, often through amicable resolution. Complex cross-border investigations — particularly those involving large tech platforms — can take 1–3 years or longer because they require consultation with other EU supervisory authorities under the GDPR's cooperation mechanism.

Can I file a complaint with the DPC if I don't live in Ireland?

Yes, if your complaint concerns a company whose EU main establishment is in Ireland (such as Meta, Google, TikTok, or LinkedIn), the DPC is the lead supervisory authority for your case. Alternatively, EU residents can file with their own national authority, which will forward the case to the DPC under the one-stop-shop mechanism.

Will I get compensation if the DPC rules in my favour?

No. The DPC cannot award personal compensation. It can fine the company, order them to change practices, or require them to delete or correct your data, but financial damages for distress or losses require a separate civil action in the Circuit Court or High Court under Article 82 of the GDPR.

Can I file a complaint anonymously?

No. The DPC needs to verify that you are the data subject whose rights have been infringed, so you must provide your real name and contact details. However, your identity is treated confidentially during the investigation and is not publicly disclosed in DPC decisions unless required by law.

Final Thoughts

Filing a complaint with the DPC Ireland is one of the most powerful free tools EU residents have for enforcing their privacy rights. The process rewards preparation: gather your evidence, try to resolve issues directly first, cite the specific GDPR articles you believe were breached, and be patient with the timeline. While the DPC has faced criticism for slow handling of marquee tech cases, it remains a critical line of defence against data misuse — and even modest complaints contribute to the wider pattern of enforcement that keeps controllers accountable across the EU.