DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If your personal data has been misused, leaked, or processed without a lawful basis, you have the right to lodge a formal complaint with the Data Protection Commission (DPC) of Ireland. The DPC is the national supervisory authority responsible for upholding the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. Because so many global tech giants — including Meta, Google, TikTok, Apple, Microsoft, and LinkedIn — have their European headquarters in Dublin, the DPC is one of the most influential privacy regulators in the world.

This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what evidence you need, how long the process takes, and what outcomes you can realistically expect.

What Is the DPC and What Does It Do?

The Data Protection Commission (Coimisiún um Chosaint Sonraí) is Ireland's independent regulator for data protection rights. It enforces GDPR, the ePrivacy Regulations 2011, and the Law Enforcement Directive within Ireland, and acts as the "lead supervisory authority" for many multinationals headquartered in the country.

The DPC has several core functions:

Investigating complaints from individuals ("data subjects")
Auditing organisations and issuing corrective orders
Imposing administrative fines (up to €20 million or 4% of global annual turnover)
Providing guidance on lawful processing, breach notifications, and international transfers
Cooperating with other EU data protection authorities under the GDPR's "one-stop-shop" mechanism

In 2024 alone, the DPC concluded inquiries resulting in fines exceeding €1.5 billion, making it a regulator with real teeth.

When Can You File a Complaint With the DPC?

You can file a complaint with the DPC whenever you believe an organisation has breached your data protection rights under the GDPR or Irish data protection law. Common grounds include:

An organisation refusing or ignoring a Subject Access Request (SAR)
Personal data processed without a valid lawful basis
Marketing emails, SMS, or calls sent without consent
A data breach where you were not properly notified
Refusal to erase your data ("right to be forgotten")
Inaccurate data that the controller refuses to correct
Excessive CCTV monitoring at work or in public spaces
Cookies and trackers placed without valid consent
Unlawful international transfers of your personal data

Importantly, you do not need to demonstrate financial harm. A breach of the regulation itself is enough to justify a complaint.

Try to Resolve Directly First

The DPC strongly recommends — and in practice expects — that you first contact the organisation directly. Send a written request (email is fine) to its Data Protection Officer (DPO) or privacy contact. Give them one calendar month to respond, which is the statutory deadline for handling most data subject requests.

Only if they fail to reply, refuse unreasonably, or provide an inadequate response should you escalate to the DPC. Keep copies of all correspondence — you will need them as evidence.

How to File a Privacy Complaint With the DPC: Step-by-Step

The DPC accepts complaints through an online webform, by email, or by post. Here is the full process:

Gather your evidence. Collect emails, screenshots, dates, reference numbers, copies of marketing messages, photos of CCTV signage, and any prior correspondence with the organisation.
Identify the controller. The "data controller" is the organisation that decides why and how your data is processed. Check their privacy policy for the legal entity name and registered address.
Write a clear summary. Explain in plain language what happened, when it happened, which of your rights you believe were breached, and what outcome you are seeking.
Submit via the DPC webform. Go to dataprotection.ie and use the "Raise a Concern" or "Make a Complaint" form. You will need to provide your name, contact details, the organisation's details, and upload supporting documents (PDF, JPG, PNG).
Alternative: email or post. You can also email info@dataprotection.ie or post your complaint to the DPC's Portarlington or Dublin offices. Include the same information as the webform.
Receive acknowledgement. The DPC will issue a case reference number, usually within 5–10 working days.
Engage with the case handler. You may be asked for clarification, additional evidence, or to participate in an "amicable resolution" stage where the DPC contacts the controller on your behalf.
Receive an outcome. The DPC will issue findings, which may include corrective measures, reprimands, or formal inquiries leading to fines.

What Information Should Your Complaint Include?

A well-prepared complaint dramatically increases the likelihood of a swift outcome. Use the checklist below.

Information	Why It Matters
Your full name and contact details	The DPC cannot process anonymous complaints
Name and address of the controller	Identifies the respondent organisation
Date(s) of the incident	Establishes the timeline and statute of limitations
Description of what happened	Forms the factual basis of the inquiry
Which GDPR articles or rights were breached	Helps the case officer categorise the issue
Evidence (emails, screenshots, letters)	Substantiates your claims
Steps already taken with the controller	Shows you attempted direct resolution
Your desired outcome	Erasure, correction, apology, fine, etc.

How Long Does the DPC Take to Investigate?

There is no fixed statutory deadline, but the DPC aims to handle straightforward complaints within three months. Complex cross-border cases involving large tech companies can take 18 months to several years due to the cooperation procedure with other EU regulators.

Typical timelines:

Acknowledgement: 5–10 working days
Amicable resolution stage: 1–4 months
Formal inquiry (if escalated): 6 months to 3+ years
Decision and any corrective measures: issued in writing once the inquiry concludes

You can request a status update at any time using your case reference number.

What Outcomes Can You Expect?

The DPC has a broad menu of corrective powers under Article 58 of GDPR. Possible outcomes include:

Warning or reprimand to the controller
Order to comply with your subject access, erasure, or rectification request
Order to stop processing your data or specific categories of data
Administrative fine against the organisation
Public decision that names the controller and the breach

Note: the DPC does not award compensation to individuals. If you want financial damages, you must bring a separate civil claim in the Circuit Court or High Court under Section 117 of the Data Protection Act 2018.

Pros and Cons of Filing With the DPC

Pros	Cons
Free of charge	No personal compensation awarded
No legal representation required	Complex cases can take years
Real enforcement power (fines, orders)	Limited communication during inquiries
Can trigger EU-wide changes	You cannot appeal the outcome easily
Anonymous to the public unless you consent	Controller will know your identity

Cross-Border Complaints and the One-Stop-Shop

If the organisation you are complaining about has its main EU establishment in Ireland — think Meta, Google, TikTok, X, Microsoft, LinkedIn — the DPC will act as the "lead supervisory authority" even if you live in another EU country. You can still lodge your complaint with your national regulator (for example, the CNIL in France or the Garante in Italy), and they will forward it to the DPC under Article 56 of GDPR.

This one-stop-shop process can add months to the timeline because all "concerned" supervisory authorities must agree on the draft decision. If they cannot, the European Data Protection Board (EDPB) issues a binding decision under Article 65.

Protecting Your Privacy Before You Need to Complain

The best privacy complaint is the one you never have to file. A few practical habits dramatically reduce the amount of personal data exposed in the first place:

Use a privacy-respecting browser with built-in tracker blocking (Firefox, Brave, Safari with strict mode)
Enable encrypted DNS (DNS over HTTPS or DNS over TLS) on your devices and router
Use unique email aliases for each service so you can identify who leaks or sells your data
Limit the personal data in links you share publicly — consider using a privacy-aware URL shortener like Lunyb instead of pasting raw URLs containing tracking parameters, UTM tags, or session IDs
Audit app permissions on your phone every quarter
Subscribe to breach notification services like Have I Been Pwned

If you manage marketing or analytics links on behalf of an organisation, choosing a transparent link-management platform also reduces your own GDPR risk. Our 2026 buyer's guide to URL shorteners compares privacy practices across the main providers, and you can also see our independent honest review of Lunyb for a closer look. If you're evaluating enterprise options, the Rebrandly review 2026 covers pricing and compliance considerations in detail.

Common Mistakes to Avoid

Skipping the direct contact step. The DPC will usually send you back to the controller if you haven't tried first.
Submitting vague complaints. "They have my data" is not enough — be specific about dates, articles, and harm.
Missing evidence. Verbal complaints without documentation are difficult to investigate.
Filing too late. While there is no strict GDPR deadline, complaints filed years after the event are harder to substantiate.
Expecting compensation. The DPC enforces the law; it does not act as a small claims court.

Frequently Asked Questions

Is filing a complaint with the DPC free?

Yes. The DPC charges no fees for lodging, processing, or investigating a complaint. You do not need a solicitor either, although legal advice can be useful for complex or cross-border cases.

Can I file a complaint anonymously?

No. The DPC requires your identity to verify your standing as a data subject and to communicate findings. Your name will typically be disclosed to the controller during the investigation, but the DPC will not publish your identity in any public decision without your consent.

What if I disagree with the DPC's decision?

You have the right to a judicial remedy under Article 78 of GDPR. In Ireland, this means appealing to the Circuit Court within 28 days of the decision being notified to you. You can also bring a separate civil action for compensation against the controller under Section 117 of the Data Protection Act 2018.

How long do I have to file a complaint?

There is no statutory time limit, but the DPC encourages complaints to be filed as soon as possible after the incident. Practically, evidence becomes harder to gather and verify after 12–24 months, so do not delay.

Can I complain about a company based outside Ireland?

Yes, if the company offers goods or services to people in Ireland or monitors their behaviour, GDPR applies regardless of where it is based. If the controller has its EU main establishment in another member state, the DPC will forward the complaint to the appropriate lead authority under the one-stop-shop mechanism.

Conclusion

Filing a privacy complaint with the DPC Ireland is one of the most powerful tools EU residents have to hold organisations accountable for how they handle personal data. The process is free, accessible without a lawyer, and backed by genuine enforcement powers. The key to a successful complaint is preparation: contact the controller first, gather solid evidence, identify the specific rights breached, and submit a clear, well-documented case.

Privacy is a fundamental right under the EU Charter — and the DPC exists to defend it. If you believe yours has been violated, do not hesitate to use the system that has been built precisely for that purpose.