DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If a company has mishandled your personal data, ignored your data subject access request, or sent you unwanted marketing, you have the right to complain to the Data Protection Commission (DPC) of Ireland. As the lead supervisory authority for many of the world's largest tech firms — including Meta, Google, TikTok, and Microsoft — the DPC is one of the most influential privacy regulators in Europe.

This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what evidence you need, how long the process takes, and what remedies you can realistically expect in 2026.

What Is the DPC Ireland?

The Data Protection Commission (An Coimisiún um Chosaint Sonraí) is Ireland's national independent authority responsible for upholding the fundamental right of individuals to have their personal data protected. It enforces the EU General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the ePrivacy Regulations.

Because so many multinational tech companies have their EU headquarters in Dublin, the DPC often acts as the "lead supervisory authority" under GDPR's one-stop-shop mechanism, handling cross-border complaints on behalf of citizens across the entire European Economic Area (EEA).

Key Powers of the DPC

• Investigate complaints from individuals (data subjects)
• Conduct own-volition inquiries into organisations
• Issue reprimands, compliance orders, and processing bans
• Impose administrative fines up to €20 million or 4% of global annual turnover
• Refer disputes to the European Data Protection Board (EDPB)

When You Should File a Complaint with the DPC

A complaint to the DPC is appropriate when an organisation has failed to comply with data protection law and has not resolved the issue after you raised it directly. Common valid grounds include:

1. Ignored or refused subject access requests — the controller did not respond within one month.
2. Unlawful processing — no valid legal basis for using your data.
3. Unwanted direct marketing — emails, SMS, or calls sent without consent or after opt-out.
4. Data breaches — your data was exposed and you were not properly notified.
5. Refusal to delete data — the right to erasure was denied without lawful justification.
6. Inaccurate data — the organisation refused to correct false information about you.
7. Excessive CCTV or workplace monitoring — surveillance without proportionality or notice.
8. International data transfers — your data was sent outside the EEA without safeguards.

Before You File: Contact the Organisation First

The DPC strongly recommends — and in most cases expects — that you first attempt to resolve the issue directly with the organisation's Data Protection Officer (DPO) or privacy team. This is not merely a formality; skipping this step is a common reason complaints get delayed or bounced back.

How to Raise the Issue Directly

1. Find the DPO's contact details in the organisation's privacy policy.
2. Send a written request (email is fine) clearly stating what you want: access, deletion, correction, or an explanation.
3. Give the organisation one calendar month to respond, as required by Article 12 GDPR.
4. Keep copies of all correspondence — you will need these as evidence.

If the organisation refuses, ignores you, or gives an unsatisfactory response, you can then escalate to the DPC.

How to File a Privacy Complaint with the DPC: Step-by-Step

Filing a complaint with the DPC Ireland is free of charge and can be done in three main ways: online via webform, by post, or by email. The online route is fastest and provides an automatic acknowledgement.

Step 1: Prepare Your Evidence

Before opening the form, gather the following:

• Your full name, address, and contact details
• The name and address of the organisation you are complaining about
• A clear timeline of events (dates matter)
• Copies of any correspondence with the organisation
• Any relevant screenshots, emails, contracts, or marketing messages
• A description of the outcome you are seeking

Step 2: Complete the DPC Webform

Go to dataprotection.ie and navigate to "Contact / Raise a Concern." The form is broken into sections:

1. Your details — the DPC does not accept anonymous complaints.
2. Details of the organisation — controller name, sector, and location.
3. Nature of the complaint — select the GDPR right that has been infringed.
4. Description of events — a factual narrative, ideally under 1,000 words.
5. Supporting documents — upload PDFs, images, or email exports (max ~10 MB total).
6. Declaration — you confirm the information is truthful.

Step 3: Submit and Await Acknowledgement

You should receive an automatic email acknowledgement immediately, and a case reference number within 5–10 working days. Keep this reference for all future correspondence.

Step 4: Cooperate with the Handling Officer

A case officer will be assigned and may contact you for clarification or additional evidence. They will also formally notify the organisation and invite a response.

What Happens After You Submit

Under Section 109 of the Data Protection Act 2018, the DPC must take "such action as it considers appropriate" in response to a complaint. In practice, most complaints go through the following phases:

1. Assessment Phase

The DPC checks that your complaint is within its remit, that you are the data subject (or authorised to act for one), and that the issue concerns a controller established in the EEA. This typically takes 2–8 weeks.

2. Amicable Resolution

The DPC is legally obliged under the 2018 Act to attempt an amicable resolution first for most complaints. The case officer acts as an intermediary between you and the organisation to find a mutually acceptable outcome — such as deleting your data, providing the access request, or issuing an apology.

3. Formal Inquiry

If amicable resolution fails, or if the issue is systemic, the DPC may open a formal statutory inquiry. This can result in binding decisions, corrective powers, and administrative fines.

4. Decision and Appeal

You will receive a written decision. If you are dissatisfied, you can appeal to the Circuit Court within 28 days.

Complaint Routes at a Glance

Route	Best For	Typical Timeline	Cost
DPC Webform	Most individuals; standard complaints	3–18 months	Free
Email to info@dataprotection.ie	When you already have detailed documents	3–18 months	Free
Postal Letter	Sensitive matters, no digital access	4–20 months	Postage only
Civil Court Action (Section 117)	Claiming material or non-material damages	12–36 months	Legal fees
Cross-border via home DPA	Non-Irish EEA residents	Varies	Free

Realistic Expectations: Timelines and Outcomes

The DPC has historically faced criticism for slow handling of major cross-border cases against Big Tech, some of which have taken over five years. However, individual complaints — particularly those resolved amicably — are typically closed within 3 to 12 months.

Pros of Filing with the DPC

• Free and accessible process
• Legally binding outcomes possible
• Can trigger EU-wide investigations for large controllers
• Strong statutory powers, including significant fines
• No need for legal representation

Cons and Limitations

• The DPC cannot award you compensation — you must go to court for damages
• Cross-border cases can be slow
• Anonymous complaints are not accepted
• You must have tried to resolve directly first in most cases
• Outcomes for small complaints may be limited to a reprimand

Practical Privacy Tips While You Wait

Regulatory complaints take time. In the meantime, tighten your own digital footprint to reduce further exposure:

1. Audit your accounts — delete dormant profiles and revoke third-party app permissions.
2. Use a privacy-respecting browser such as Firefox or Brave, with tracking protection enabled.
3. Switch to encrypted DNS (DoH or DoT) to prevent your ISP from logging every domain you visit.
4. Use privacy-first link tools. When sharing URLs on social media or in campaigns, choose a shortener that doesn't harvest excessive analytics. Services like Lunyb offer clean short links without invasive third-party trackers — a small but meaningful step for both you and the people who click your links. You can read more in our honest review of Lunyb.
5. Enable two-factor authentication everywhere, ideally with an authenticator app rather than SMS.
6. Regularly exercise your GDPR rights — submit access requests annually to see what companies hold on you.

Filing a Complaint from Outside Ireland

Under the GDPR one-stop-shop mechanism, if you live in another EEA country but your complaint concerns a company with its EU main establishment in Ireland (e.g. Meta, TikTok, LinkedIn), you have two options:

1. Complain directly to the DPC Ireland using the same webform.
2. Complain to your local data protection authority, which will forward the case to the DPC as lead supervisory authority.

Route 2 is often easier if you prefer to communicate in your national language. Your home DPA will remain your point of contact throughout.

Contact Details for the DPC

• Website: www.dataprotection.ie
• Email: info@dataprotection.ie
• Phone: +353 (0)761 104 800 or 0818 252 231
• Dublin Office: 6 Pembroke Row, Dublin 2, D02 X963
• Portarlington Office: 21 Fitzwilliam Square South, Dublin 2 / Canal House, Station Road, Portarlington, Co. Laois

Frequently Asked Questions

How long does the DPC take to handle a complaint?

Straightforward complaints resolved through the amicable resolution process are typically closed within 3–6 months. Formal statutory inquiries, especially those involving large multinational controllers, can take 12 months to several years. You can request a case update from your assigned officer at any time.

Can I get compensation through the DPC?

No. The DPC cannot award financial compensation. To claim material or non-material damages under Article 82 GDPR (or Section 117 of the Data Protection Act 2018), you must bring a civil action in the Circuit Court or High Court. A DPC decision in your favour is, however, powerful evidence in such proceedings.

Do I need a solicitor to file a DPC complaint?

No. The complaint process is designed to be accessible to ordinary members of the public. You do not need legal representation to submit or pursue a complaint. Legal advice becomes useful only if you plan to appeal a DPC decision or pursue civil damages in court.

What if my complaint is about a company outside the EU?

The DPC can only act against organisations that fall within the territorial scope of the GDPR — either established in the EEA or offering goods/services to, or monitoring the behaviour of, individuals in the EEA. If the company has no EU presence and doesn't target EU users, the DPC will typically not have jurisdiction, though you may still complain to a consumer protection body.

Will the organisation know it was me who complained?

Yes, generally. To investigate meaningfully, the DPC needs to share the details of your complaint with the organisation. Anonymous complaints are not accepted for formal handling, although you can raise general concerns anonymously that may feed into own-volition inquiries. If you fear retaliation (e.g. from an employer), tell the case officer — additional safeguards can sometimes be applied.

Final Thoughts

Filing a complaint with the DPC Ireland is one of the most powerful tools EU citizens have to hold organisations accountable for how they handle personal data. The process is free, does not require a lawyer, and can lead to real consequences for non-compliant controllers — from mandatory changes to multi-million euro fines.

The key to a successful complaint is preparation: try to resolve the issue directly first, keep meticulous records, and be specific about the GDPR right you believe has been infringed. Combined with sensible personal privacy habits — encrypted DNS, minimal data sharing, and privacy-respecting tools — you can meaningfully reduce your exposure while the regulator does its work.