DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If your personal data has been mishandled by a company, public body, or website operating in Ireland, you have the right to lodge a formal complaint with the Data Protection Commission (DPC). As Ireland's national supervisory authority under the GDPR and the Data Protection Act 2018, the DPC investigates breaches, issues binding decisions, and can levy substantial administrative fines. This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what to expect, and how to strengthen your case.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's independent authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. Because many of the world's largest technology companies — including Meta, Google, TikTok, LinkedIn, and Apple — have their EU headquarters in Dublin, the DPC also acts as the lead supervisory authority for cross-border cases affecting hundreds of millions of Europeans.

The DPC enforces the General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, the ePrivacy Regulations 2011, and the Law Enforcement Directive. It has the power to investigate, audit, issue reprimands, order corrective action, and impose fines of up to €20 million or 4% of a company's global annual turnover — whichever is higher.

When Should You File a Complaint With the DPC?

You should consider filing a complaint with the DPC when you believe an organisation has failed to meet its obligations under Irish or EU data protection law. Common scenarios include:

• Data subject rights ignored — the organisation refused, delayed, or inadequately responded to your access, erasure, rectification, or portability request.
• Unlawful marketing — you received unsolicited emails, texts, or calls without valid consent.
• Data breaches — your information was exposed, leaked, or stolen and the controller failed to notify you.
• Excessive data collection — a service is collecting more personal data than is necessary for the stated purpose.
• Cookies and tracking — a website deployed tracking cookies without valid consent.
• CCTV misuse — a business or neighbour is recording you without a lawful basis or clear signage.
• Cross-border transfers — your data was transferred outside the EEA without appropriate safeguards.

Step 1: Try to Resolve the Issue Directly First

The DPC strongly recommends — and in most cases expects — that you first raise the issue directly with the organisation. This is not a legal precondition, but it is a practical one: the DPC will often ask what steps you took before escalating.

1. Identify the Data Protection Officer (DPO) or privacy contact. This information is usually in the organisation's privacy policy.
2. Send a written request (email is fine) clearly stating what you want: a copy of your data, deletion, correction, or an explanation.
3. Reference the GDPR article where possible (e.g., "I am exercising my right of erasure under Article 17 GDPR").
4. Give them one month. Under Article 12(3) GDPR, controllers must respond within one calendar month, extendable by two further months for complex requests.
5. Keep every reply. Save emails, screenshots, and delivery receipts — these become your evidence.

If the organisation refuses, ignores you, or provides an unsatisfactory response, you're ready to escalate.

Step 2: Gather Your Evidence

A well-documented complaint is far more likely to be actioned quickly. Before you submit, assemble the following:

• Your full name, address, and contact details.
• The name and contact details of the organisation (the "data controller").
• A clear, chronological summary of what happened.
• Copies of your correspondence with the organisation.
• Screenshots of the offending website, email, cookie banner, or app screen.
• Dates, times, and reference numbers where relevant.
• The specific outcome you want (deletion, compensation is not something the DPC awards — that requires a civil court).

If your evidence includes long URLs from tracking emails or screenshots hosted online, consider using a privacy-respecting link management tool like Lunyb to create clean, shareable references you can include in your submission without exposing tracking parameters.

Step 3: Submit the Complaint to the DPC

The DPC accepts complaints through several channels. There is no fee to file a complaint.

Online Webform (Recommended)

The fastest route is the DPC's online complaint form at forms.dataprotection.ie. You'll create a short account, complete the guided form, and upload supporting documents (PDF, JPG, PNG accepted, typically up to 10MB per file).

By Email

Send your complaint and attachments to info@dataprotection.ie. Use a clear subject line such as "Formal Complaint — [Organisation Name] — [Your Surname]".

By Post

Write to: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Include copies (never originals) of your evidence.

Complaint Channel Comparison

Channel	Speed	Tracking	Best For
Online webform	Fastest — acknowledged within days	Reference number issued automatically	Most individual complaints
Email	Fast — usually acknowledged within 1–2 weeks	Manual reference issued in reply	Complaints with unusual file types
Post	Slowest — 2–4 weeks to acknowledge	Reference issued in written reply	Individuals without reliable digital access

Step 4: What Happens After You Submit

Once the DPC receives your complaint, it moves through a defined process. Understanding the stages helps you set realistic expectations.

1. Acknowledgement — you receive a case reference number, typically within 5–10 working days.
2. Assessment — a case officer reviews whether the complaint falls within the DPC's remit and whether you tried to resolve it directly.
3. Amicable resolution — under Section 109(2) of the Data Protection Act 2018, the DPC will usually attempt to broker a resolution between you and the organisation. Many complaints end here.
4. Formal inquiry — if no resolution is possible, or if the matter is serious, the DPC may open a statutory inquiry with formal powers to compel information.
5. Decision — the DPC issues a binding decision, which may include reprimands, corrective orders, or administrative fines.
6. Appeal — either party may appeal a DPC decision to the Circuit Court or the High Court within 28 days.

Timelines vary enormously. A simple direct marketing complaint can be resolved in weeks. A cross-border inquiry involving a major tech platform can take several years.

What the DPC Can — and Cannot — Do

What the DPC Can Do

• Order an organisation to comply with your rights (e.g., delete your data, provide access).
• Issue reprimands and public findings of infringement.
• Impose administrative fines up to €20 million or 4% of global turnover.
• Ban specific processing operations or data transfers.
• Refer criminal matters to the Director of Public Prosecutions.

What the DPC Cannot Do

• Award you personal compensation — you must pursue this through the Circuit Court under Section 117 of the 2018 Act.
• Handle complaints that fall outside data protection law (e.g., defamation, general consumer disputes).
• Act as a mediator in employment disputes not centred on personal data.
• Investigate journalism, artistic, or academic expression protected under Section 43 of the Act, in most cases.

Cross-Border Complaints and the One-Stop-Shop

If your complaint concerns an organisation whose main EU establishment is in Ireland — such as Meta, Google, TikTok, or X — the DPC acts as the Lead Supervisory Authority under the GDPR's one-stop-shop mechanism. You can still lodge your complaint with your local data protection authority in your home country, which will forward it to the DPC. The final decision is coordinated with other EU authorities through the European Data Protection Board (EDPB).

This is why the DPC handles some of the highest-profile privacy cases in Europe. Recent multi-hundred-million-euro fines against Meta, TikTok, and LinkedIn all originated as individual complaints.

Strengthening Your Complaint: Practical Tips

1. Be specific and factual. Avoid emotional language. State dates, actions, and consequences.
2. Cite the law. Reference specific GDPR articles (Article 6 for lawful basis, Article 15 for access, Article 17 for erasure, Article 21 for objection).
3. Explain the harm. Distress, financial loss, reputational damage, or loss of control over your data all matter.
4. Keep it concise. A focused three-page complaint is more effective than a 30-page narrative.
5. Number your evidence. Refer to attachments as "Exhibit 1, Exhibit 2" and reference them in your narrative.
6. Follow up politely. If you haven't heard back in three months, send a brief status request with your reference number.

Alternative and Complementary Routes

Depending on your situation, other bodies may also be relevant:

• ComReg — for issues with telecoms providers or nuisance calls.
• Competition and Consumer Protection Commission (CCPC) — for general consumer issues.
• Financial Services and Pensions Ombudsman — for privacy issues involving financial institutions.
• Circuit Court — for compensation claims under Section 117 of the Data Protection Act 2018.

Protecting Your Privacy Going Forward

Filing a complaint addresses past harm, but proactive habits reduce future risk. Consider using encrypted DNS resolvers, privacy-focused browsers like Brave or Firefox with strict tracking protection, unique email aliases for sign-ups, and password managers with breach alerts. When sharing links — especially in complaint documentation, on social media, or in email newsletters — a clean shortener such as Lunyb can strip tracking parameters and give you analytics without embedding third-party trackers on your recipients. For broader guidance on choosing tools, see our 2026 buyer's guide to URL shorteners.

Frequently Asked Questions

How long does the DPC take to resolve a complaint?

Simple complaints — such as unwanted marketing or a delayed subject access request — are typically resolved amicably within three to six months. Complex cross-border inquiries involving large technology companies can take two to four years, particularly if they involve coordination with other EU regulators or appeals to the courts.

Is there a deadline for filing a complaint with the DPC?

There is no strict statutory time limit for lodging a complaint, but the DPC recommends filing as soon as possible after the incident. Delays can weaken your evidence, and organisations are only required to retain some records for a limited period. For court-based compensation claims, the general six-year limitation period under the Statute of Limitations applies.

Can I remain anonymous when filing a complaint?

No. The DPC requires your identity to investigate a complaint effectively and to communicate with you about the outcome. However, your personal details are not shared with the organisation unless necessary for the investigation, and the DPC treats your information confidentially under its own data protection obligations.

Will filing a complaint cost me anything?

No. Filing a complaint with the DPC is completely free, and you do not need a solicitor. Legal representation only becomes relevant if you appeal a DPC decision to court or pursue a separate compensation claim under Section 117 of the Data Protection Act 2018.

What if the organisation is based outside Ireland or the EU?

If the organisation offers goods or services to people in the EU or monitors their behaviour, the GDPR still applies. The DPC can accept your complaint if you are in Ireland, and it will coordinate with the relevant supervisory authority — either as lead authority if the company has an EU base in Ireland, or through the EDPB cooperation mechanism if the lead is elsewhere.

Final Thoughts

Filing a privacy complaint with the DPC is one of the most powerful tools EU residents have to hold organisations accountable. The process is free, accessible, and — when supported by clear evidence and a well-structured narrative — genuinely effective. Whether you're dealing with an ignored access request, a nuisance marketing campaign, or a large-scale data breach, the DPC exists precisely to give ordinary people a route to redress. Take the time to prepare properly, document everything, and don't be discouraged by timelines: every enforced decision strengthens the privacy landscape for everyone in Ireland and across Europe.