DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If a company has mishandled your personal data, ignored your access request, or refused to delete your information, you have the right to complain to Ireland's Data Protection Commission (DPC). As the lead supervisory authority for many of the world's largest tech firms — including Meta, Google, TikTok, and Microsoft — the DPC plays an outsized role in enforcing the General Data Protection Regulation (GDPR) across the European Union.

This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what evidence you need, how long the process takes, and what outcomes you can realistically expect.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's independent supervisory authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. Established under the Data Protection Act 2018, the DPC enforces both the GDPR and Ireland's national data protection law.

Because so many multinational technology companies have their European headquarters in Dublin, the DPC often acts as the "lead supervisory authority" under the GDPR's one-stop-shop mechanism. That means complaints from residents in France, Germany, Spain, or anywhere else in the EU about companies like Meta or Google frequently end up being investigated in Ireland.

The DPC's Core Responsibilities

Investigating complaints from data subjects
Conducting audits and inquiries into organisations
Issuing administrative fines and reprimands
Providing guidance to controllers and processors
Cooperating with other EU supervisory authorities

When Can You File a Complaint with the DPC?

You can file a complaint with the DPC Ireland whenever you believe an organisation has infringed your data protection rights under the GDPR or the Data Protection Act 2018. The organisation must be established in Ireland, or the complaint must fall within the DPC's jurisdiction as lead supervisory authority.

Common Grounds for Complaint

Access denied: A company failed to respond to your Subject Access Request (SAR) within one month.
Deletion refused: You asked for your data to be erased and the request was ignored or rejected without a valid reason.
Unlawful processing: An organisation collected or used your data without a legal basis.
Marketing without consent: You are receiving unsolicited emails, SMS, or calls despite not opting in.
Data breach: Your personal data was exposed or leaked and you were not properly notified.
Excessive data collection: A service is asking for far more information than it needs.
CCTV and surveillance issues: Employers, landlords, or neighbours misusing camera footage.

Before You File: Contact the Organisation First

The DPC strongly recommends — and in most cases requires — that you first attempt to resolve the issue directly with the organisation before escalating. This is called "exhausting internal remedies".

Step 1: Send a Formal Request in Writing

Contact the organisation's Data Protection Officer (DPO) or privacy team. Most large companies list a dedicated privacy email such as privacy@company.com or dpo@company.com. Send a clear, dated, written request outlining:

Who you are (with enough detail for them to identify your records)
What right you are exercising (access, erasure, rectification, objection, portability)
What specific outcome you want
A deadline referencing the one-month GDPR response window

Step 2: Wait One Month

Under Article 12 of the GDPR, controllers have one calendar month to respond. This can be extended by two further months for complex requests, but they must tell you within the first month.

Step 3: Document Everything

Keep copies of every email, letter, screenshot, and response. This paper trail is critical evidence when you later approach the DPC.

How to File a Complaint with the DPC Ireland: Step-by-Step

Filing a complaint with the DPC is free and can be done entirely online. Here is the exact process.

Step 1: Visit the DPC Website

Go to dataprotection.ie and navigate to the "Contact / Raise a Concern" section. The DPC offers a dedicated online webform for lodging complaints.

Step 2: Choose the Right Complaint Type

You will typically be asked to categorise your complaint — for example, electronic direct marketing, access request issues, CCTV, or general GDPR infringement. Choosing the correct category speeds up routing.

Step 3: Provide Your Personal Details

The DPC does not accept anonymous complaints. You must provide:

Full name
Postal address in Ireland or the EU
Email address and phone number

Step 4: Identify the Organisation

Give the full legal name of the organisation, its address, and any reference numbers (e.g. your customer ID). If you know the DPO's contact details, include them.

Step 5: Describe the Issue Clearly

Write a factual, chronological summary. Stick to what happened, when, and why you believe it breaches the GDPR. Avoid emotional language — investigators respond to evidence, not indignation.

Step 6: Attach Supporting Evidence

Upload:

Copies of your original request to the organisation
Their response (or proof they did not respond)
Screenshots of unlawful processing (e.g. marketing emails, cookie banners)
Any relevant contracts, terms of service, or privacy notices

Step 7: Submit and Save the Reference Number

After submission, you'll receive an acknowledgement email with a case reference. Use this reference in all future correspondence.

What Happens After You File?

Once your complaint is received, the DPC follows a structured handling process. Understanding the stages helps set realistic expectations.

Stage 1: Initial Assessment (2–8 weeks)

A case officer reviews your complaint to check jurisdiction, admissibility, and whether you tried to resolve it directly with the organisation first. If information is missing, they will contact you.

Stage 2: Amicable Resolution

The DPC will often try to broker a resolution between you and the organisation. This can involve the company finally answering your access request, deleting the data, or offering an apology. Many complaints are closed at this stage.

Stage 3: Formal Investigation

If amicable resolution fails, or the case involves systemic issues, the DPC may open a statutory inquiry. This is a formal process that can result in fines, reprimands, corrective orders, or bans on data processing.

Stage 4: Decision and Appeal

The DPC issues a binding decision. Both you and the organisation have the right to appeal to the Irish Circuit Court or High Court within 28 days.

DPC Complaint Timelines and Outcomes

Complaint Type	Typical Timeline	Likely Outcome
Unanswered access request	2–6 months	Company forced to respond; possible reprimand
Unwanted marketing	3–9 months	Warning, fine, or prosecution
CCTV misuse	4–12 months	Removal order, guidance issued
Cross-border big tech inquiry	1–4 years	Major fine, corrective measures
Data breach complaint	3–12 months	Reprimand, security improvements ordered

Your Rights Under the GDPR

Before complaining, it helps to know exactly which right has been breached. The GDPR provides eight core rights to individuals.

The Eight Data Subject Rights

Right to be informed — clear information about how your data is used
Right of access — a copy of the data held about you
Right to rectification — correction of inaccurate data
Right to erasure — the "right to be forgotten"
Right to restrict processing — pausing use of your data
Right to data portability — receiving your data in a machine-readable format
Right to object — opposing certain processing, including direct marketing
Rights related to automated decision-making — including profiling

Common Mistakes That Weaken Your Complaint

Even valid complaints can be dismissed if they are poorly framed. Avoid these common pitfalls.

Skipping the direct contact stage. The DPC will usually redirect you to contact the organisation first.
Vague accusations. "They stole my data" is not enough. Specify which right, which data, and which action.
Missing evidence. Screenshots, timestamps, and copies of correspondence are essential.
Multiple unrelated issues. File separate complaints for separate matters — combining them slows investigation.
Ignoring deadlines. Complaints about older incidents may fall outside admissibility criteria.

Protecting Your Privacy Before Problems Arise

Filing a complaint is a last resort. The best defence is minimising how much personal data you expose in the first place. A few practical habits go a long way:

Use email aliases when signing up for services you don't fully trust.
Enable encrypted DNS (such as DNS-over-HTTPS) in your browser.
Use privacy-respecting browsers and block third-party trackers.
Read privacy notices before ticking consent boxes.
Shorten and mask links you share publicly so they cannot be scraped for tracking data. Tools like Lunyb let you create clean, privacy-friendly short URLs without exposing analytics identifiers to third parties.

If you frequently share links in newsletters, social media, or QR codes, choosing a shortener that respects your audience's privacy is part of being a good data controller yourself. For a broader comparison, see our 2026 buyer's guide to URL shorteners.

When the DPC Isn't the Right Route

Not every privacy grievance is a matter for the DPC. If your complaint concerns:

Defamation or reputation: Consult a solicitor about defamation law.
Consumer disputes: Contact the Competition and Consumer Protection Commission (CCPC).
Financial fraud: Report to An Garda Síochána and your bank.
Media coverage: The Press Council of Ireland or the Broadcasting Authority handles editorial complaints.

Frequently Asked Questions

How much does it cost to file a complaint with the DPC Ireland?

Filing a complaint with the Data Protection Commission is completely free of charge. There are no fees at any stage of the investigation, and you do not need a solicitor to lodge or pursue a complaint — although legal advice may help with complex cases or appeals.

How long does the DPC take to resolve a complaint?

Simple complaints, such as unanswered access requests, are often resolved within 2–6 months. More complex cross-border investigations involving large tech companies can take several years. The DPC provides periodic updates on progress and will notify you of the final decision.

Can I file a complaint anonymously?

No. The DPC requires your full name and contact details to investigate. However, your identity is treated confidentially and is only shared with the organisation being complained about where necessary to progress the case. Anonymous tips can be submitted separately but are not treated as formal complaints.

What can I do if I'm unhappy with the DPC's decision?

You have the right to appeal the DPC's decision to the Irish Circuit Court within 28 days of being notified. For complex or high-value cases, appeals may go to the High Court. You can also seek judicial review if you believe the DPC failed to properly investigate your complaint.

Can non-Irish residents file complaints with the DPC?

Yes. Because the DPC acts as lead supervisory authority for many multinational companies with EU headquarters in Ireland, residents from any EU or EEA country can file complaints about those organisations directly with the DPC. Alternatively, you can complain to your local supervisory authority, who will coordinate with the DPC through the one-stop-shop mechanism.

Final Thoughts

Filing a complaint with the Data Protection Commission is one of the most powerful rights you have as an EU resident. The process is free, transparent, and — when documented properly — genuinely effective at holding organisations accountable. Whether you are dealing with a stubborn marketer who won't stop emailing you, a company that refuses your access request, or a large platform that has misused your data, the DPC provides a clear pathway to enforcement.

Take the time to prepare your evidence, exhaust internal remedies first, and describe your issue in factual terms. A well-prepared complaint dramatically increases the chances of a swift and satisfactory outcome — and contributes to a stronger privacy culture for everyone in Ireland and across the EU.