DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If a company has mishandled your personal data, ignored your access request, or continued marketing to you after you asked them to stop, you have the right to complain to Ireland's Data Protection Commission (DPC). As the lead supervisory authority for many of the world's largest tech firms — including Meta, Google, TikTok, and Microsoft — the DPC enforces the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what to expect, and how to strengthen your case.

What Is the DPC Ireland?

The Data Protection Commission (DPC) is Ireland's independent national authority responsible for upholding the fundamental right of individuals in the European Union to have their personal data protected. Established under the Data Protection Act 2018, the DPC investigates complaints, conducts inquiries, and issues fines against organisations that break data protection law.

Because many multinational technology companies have their EU headquarters in Dublin, the DPC often acts as the "lead supervisory authority" for cross-border cases affecting hundreds of millions of Europeans. In 2023 alone, the DPC issued more than €1.5 billion in fines, and complaint volumes continue to grow each year.

When You Can Complain to the DPC

You can file a complaint if you believe an organisation has:

• Processed your personal data without a lawful basis
• Refused or ignored a Subject Access Request (SAR)
• Refused to delete your data (right to erasure)
• Sent you unsolicited marketing after you objected
• Suffered a data breach that affected you
• Shared your data with third parties without consent
• Used cookies or tracking technologies unlawfully
• Failed to correct inaccurate personal data

Before You File: Contact the Organisation First

The DPC strongly encourages complainants to first raise the issue directly with the organisation (the "data controller"). Under GDPR, controllers have one month to respond to your request — with a possible two-month extension for complex cases.

How to Contact the Data Controller

1. Find their Data Protection Officer (DPO) — usually listed in the privacy policy on their website.
2. Write a clear, dated request stating exactly what right you are exercising (access, erasure, objection, etc.).
3. Send it in writing — email is fine, but keep a copy. Registered post gives you proof of delivery.
4. Wait one month for a substantive response.
5. Document everything — screenshots, timestamps, and email threads all become evidence.

If the organisation refuses, gives an inadequate response, or ignores you entirely, you can then escalate to the DPC.

How to File a Privacy Complaint With the DPC Ireland

Filing a complaint with the DPC is free and can be done entirely online, by post, or by email. There is no requirement to use a solicitor, though legal advice can help in complex matters.

Step-by-Step: Filing Your DPC Complaint

1. Gather your evidence. Collect all correspondence with the organisation, screenshots of the offending data processing, dates, reference numbers, and any responses (or non-responses) you received.
2. Visit the DPC website. Go to dataprotection.ie and locate the "Contact / Raise a Concern" section. The online webform is the fastest route.
3. Provide your details. You must include your full name, postal address, and contact details. Anonymous complaints are generally not investigated.
4. Identify the organisation. Give the exact legal name, address, and any reference numbers or account IDs you have with them.
5. Describe the issue clearly. Set out the facts chronologically: what happened, when, what right you exercised, and how the organisation responded.
6. Attach supporting documents. Upload PDFs or screenshots. Redact any third-party personal data before sending.
7. State the outcome you want. Deletion, correction, compensation acknowledgement, or a formal ruling — be specific.
8. Submit and save your reference number. The DPC will send an acknowledgement, usually within a few working days.

DPC Contact Channels

Channel	Details	Best For
Online webform	dataprotection.ie/en/contact	Most individual complaints
Email	info@dataprotection.ie	General queries, follow-ups
Post	21 Fitzwilliam Square South, Dublin 2, D02 RD28	Formal written submissions
Phone	+353 (0)761 104 800	Initial guidance only — not for filing

What Happens After You Submit

The DPC follows a structured process once your complaint is received. Understanding the stages helps you set realistic expectations.

The DPC Complaint Process

1. Acknowledgement (within ~5 working days). You receive a reference number and confirmation.
2. Initial assessment. A case officer reviews whether the complaint falls within the DPC's remit and whether you've tried to resolve it directly with the controller.
3. Amicable resolution (recommended first). Under Section 109(2) of the Data Protection Act 2018, the DPC will typically attempt informal resolution. This can settle many cases in weeks rather than years.
4. Formal inquiry. If amicable resolution fails, the DPC may open a statutory inquiry. This is a formal legal investigation and can take months or years for complex cases.
5. Decision and enforcement. The DPC can order the organisation to comply, issue reprimands, impose administrative fines (up to €20 million or 4% of global turnover), or refer matters to court.
6. Appeal. Both you and the organisation can appeal a DPC decision to the Circuit Court or High Court.

How Long Does It Take?

Simple complaints (like an ignored access request) can be resolved amicably in 2–6 months. Complex cross-border cases involving major tech companies can take several years due to the GDPR's One-Stop-Shop mechanism and consultations with other EU data protection authorities.

Strengthening Your Complaint: Practical Tips

A well-prepared complaint is far more likely to be resolved quickly and in your favour. Here are the things experienced complainants — and privacy lawyers — recommend.

Do

• Be specific about the GDPR article breached. For example: "Article 15 (right of access)" or "Article 17 (right to erasure)."
• Provide a clear timeline. Dates matter enormously in enforcement.
• Include exact URLs, account IDs, and email addresses. These help the DPC identify the exact processing at issue.
• Redact irrelevant third-party data. Only include what proves your case.
• Keep your language factual. Avoid emotional or accusatory tone — stick to what happened.

Don't

• Submit without first contacting the organisation (unless it's a data breach or safety issue).
• Send unrelated grievances — the DPC only handles data protection, not consumer complaints or defamation.
• Expect financial compensation — the DPC does not award damages. For compensation, you must sue in the Circuit or High Court.
• Withhold your identity — the DPC cannot process anonymous complaints.

Common Types of DPC Complaints in 2026

Looking at recent DPC annual reports, certain categories dominate the caseload. Knowing where your issue fits can help you frame it correctly.

Complaint Type	Share of Cases	Typical Outcome
Access requests (Art. 15)	~30%	Amicable resolution — data provided
Direct marketing / spam	~20%	Warning or fine to sender
Right to erasure (Art. 17)	~15%	Data deleted or justified retention explained
Disclosure to third parties	~12%	Formal inquiry, potential fine
CCTV and workplace surveillance	~10%	Guidance or reprimand
Cookies and online tracking	~8%	Enforcement notice
Other	~5%	Varies

Protecting Yourself Going Forward

Filing a complaint is a reactive step. Being proactive about your privacy prevents most issues from happening in the first place. A few practical habits go a long way.

Reduce Your Data Footprint

• Use encrypted DNS services like Cloudflare 1.1.1.1 or NextDNS to reduce ISP-level tracking.
• Choose privacy-respecting browsers such as Firefox or Brave, and enable strict tracking protection.
• Use email aliases (like SimpleLogin or Apple's Hide My Email) when signing up to new services.
• Shorten and control the links you share. A trusted shortener like Lunyb lets you share URLs without exposing analytics data to third-party trackers — useful for creators, journalists, and small businesses handling sensitive audiences. See our honest Lunyb review for details.
• Review app permissions monthly on iOS and Android.
• Regularly submit access and erasure requests to companies you no longer use.

Know Your Rights Under GDPR

Every Irish resident has eight core data protection rights: the right to information, access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making. Bookmark the DPC's plain-English guides — they're among the best in Europe.

Alternatives and Escalation

The DPC isn't the only route. If your complaint concerns another EU country's controller, you can complain either to the DPC or to the supervisory authority where you live. The One-Stop-Shop mechanism ensures cases are handled coherently across the EU.

You may also:

• Sue directly in the Irish Circuit Court under Section 117 of the Data Protection Act 2018 for compensation.
• Contact ComReg for electronic communications and unsolicited calls or texts.
• Contact the Financial Services and Pensions Ombudsman if your data issue involves a regulated financial firm.
• Escalate to the European Data Protection Board (EDPB) if you feel the DPC has mishandled a cross-border case.

Frequently Asked Questions

Is filing a complaint with the DPC free?

Yes. The DPC does not charge any fee for submitting or investigating a complaint. You also do not need a solicitor, though legal advice may help in complex or high-value cases.

Can I file a complaint on behalf of someone else?

Yes, but only with their written authorisation. Parents or legal guardians can file on behalf of children under 18. Not-for-profit bodies like Digital Rights Ireland or NOYB can also represent complainants under Article 80 GDPR.

Will the DPC award me compensation?

No. The DPC can order compliance, issue reprimands, and impose fines on organisations, but it cannot award damages to individuals. To seek compensation, you must bring a civil claim in the Circuit Court or High Court under Section 117 of the Data Protection Act 2018.

How long do I have to file a complaint?

There is no strict statutory deadline for lodging a complaint with the DPC, but you should act promptly — ideally within a few months of the incident. Delay can make evidence harder to gather and may affect the DPC's willingness to open a formal inquiry.

Can I remain anonymous?

Generally, no. The DPC needs your identity to investigate and to communicate with you. However, your identity is not usually shared with the organisation being complained about beyond what is necessary to resolve the case, and the DPC handles all personal information under strict confidentiality obligations.

What if the DPC dismisses my complaint?

You have the right to appeal a DPC decision to the Circuit Court within 28 days of being notified. For cross-border matters, you may also raise concerns with the European Data Protection Board or seek judicial review in the High Court.

Final Thoughts

Ireland's Data Protection Commission is one of the most influential privacy regulators in the world, and filing a complaint is a genuinely effective way to enforce your rights under GDPR. The process is free, accessible, and designed for ordinary citizens — you don't need to be a lawyer. Prepare your evidence, contact the organisation first, be specific about which right has been breached, and follow up. Whether your complaint ends in a quick amicable resolution or a landmark fine, exercising your rights strengthens data protection for everyone in Ireland and across the EU.