DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If a company has mishandled your personal data, ignored your access request, or refused to delete your information, you have the right to complain to Ireland's Data Protection Commission (DPC). As Ireland's national data protection authority, the DPC enforces the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, and it also acts as the lead supervisory authority for many of the world's largest technology companies whose European headquarters are based in Dublin.

This guide explains, step by step, how to file a privacy complaint with the DPC in Ireland, what evidence to gather beforehand, how long the process takes, and what remedies you can realistically expect. Whether the offending organisation is a small Irish business or a global platform like Meta, Google, or TikTok, the same core procedure applies.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is the independent public authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. Established under the Data Protection Act 2018, it replaced the older Office of the Data Protection Commissioner and operates from offices in Dublin and Portarlington.

Because so many multinational tech firms have their EU headquarters in Ireland, the DPC often serves as the "lead supervisory authority" under the GDPR's one-stop-shop mechanism. That means an Irish resident, or indeed a resident anywhere in the EU, can lodge a complaint through the DPC against companies such as Meta (Facebook, Instagram, WhatsApp), Google, Apple, Microsoft, TikTok, LinkedIn, X, and Airbnb.

What the DPC Can and Cannot Do

The DPC has significant enforcement powers, including the ability to issue reprimands, order changes to data processing, ban transfers of personal data, and impose administrative fines of up to €20 million or 4% of a company's global annual turnover, whichever is higher.

However, the DPC cannot award you personal compensation. If you are seeking damages for distress or financial loss, you must bring a separate civil claim in the Circuit Court or High Court under Section 117 of the Data Protection Act 2018.

When Should You File a Complaint with the DPC?

You can file a complaint with the DPC when you believe an organisation has infringed your data protection rights under the GDPR or the Data Protection Act 2018. Common grounds include:

Unlawful processing: An organisation is using your personal data without a valid legal basis.
Ignored subject access request (SAR): You asked for a copy of your data and received no response within one month.
Refusal to erase data: A company denied your right to be forgotten without adequate justification.
Data breach: Your data was exposed and the controller failed to notify you when required.
Excessive marketing: You continue to receive unsolicited emails, texts, or calls after unsubscribing.
Cookie and tracking violations: A website drops tracking cookies without valid consent.
Unlawful CCTV or workplace monitoring: Surveillance without proper notice or legal basis.
Inaccurate data: Refusal to rectify information you have shown to be incorrect.

Try to Resolve It Directly First

The DPC strongly encourages you to contact the organisation directly before escalating. In practice, this means writing to the company's Data Protection Officer (DPO) or privacy contact, setting out your concern clearly, and giving them a reasonable opportunity to respond, typically 30 days. Not only is this good practice, it also strengthens your complaint file if the matter does progress to the DPC.

How to File a Privacy Complaint with the DPC: Step by Step

The DPC accepts complaints through several channels, but the most efficient route is its online webform. Here is the full process:

Gather your evidence. Collect all relevant correspondence, screenshots, dates, reference numbers, copies of any subject access request you sent, and the organisation's response (or lack of one).
Identify the controller. Determine the exact legal name of the company or public body you are complaining about. For multinationals, this is usually the Irish-registered entity (e.g., "Meta Platforms Ireland Limited").
Visit the DPC website. Go to dataprotection.ie and navigate to the "Contact / Raise a Concern" section.
Choose the correct form. The DPC distinguishes between general "concerns" (informal queries) and formal "complaints" under Section 108 of the Data Protection Act 2018. For a binding investigation, submit a formal complaint.
Complete the webform. Provide your contact details, the name of the organisation, a chronological summary of what happened, the specific right you believe was breached, and the outcome you are seeking.
Attach supporting documents. Upload emails, screenshots, letters, and any prior responses from the controller. PDFs and standard image formats are accepted.
Submit and record your reference number. The DPC will issue an acknowledgement, usually by email, with a case reference. Keep this safe for all future correspondence.

Alternative Ways to Submit

If you cannot use the online form, you can also submit a complaint by:

Post: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
Post (Portarlington office): Data Protection Commission, Canal House, Station Road, Portarlington, R32 AP23, Co. Laois.
Email: info@dataprotection.ie (for general queries; the webform is preferred for formal complaints).
Phone: +353 (0)761 104 800 for guidance, though complaints must ultimately be submitted in writing.

What Information to Include in Your Complaint

A well-prepared complaint is faster to investigate and more likely to succeed. Include the following:

Section	What to Provide
Your identity	Full name, address, email, and phone number.
Controller details	Legal name and address of the organisation, plus any DPO contact you dealt with.
Facts of the complaint	Clear chronological account: dates, what happened, who said what.
Legal basis cited	Which GDPR article or right you believe was breached (e.g., Art. 15 access, Art. 17 erasure).
Prior contact	Copy of the letter or email you sent the controller and their reply.
Desired outcome	What resolution you want: erasure, rectification, cessation of processing, etc.
Evidence	Attachments proving each fact you assert.

What Happens After You File?

Once the DPC receives your complaint, it moves through several defined stages under Section 109 of the Data Protection Act 2018.

Stage 1: Acknowledgement and Assessment

Within a few weeks, a case officer will confirm receipt and review whether the DPC has jurisdiction. If the matter falls outside data protection law, or if you have not yet approached the controller, the case may be paused or closed with guidance.

Stage 2: Amicable Resolution

The DPC will usually attempt to resolve the complaint amicably, acting as a facilitator between you and the controller. Many cases settle at this stage, with the organisation providing the data, deleting the record, or stopping the disputed processing.

Stage 3: Formal Inquiry

If amicable resolution fails, the DPC may launch a formal statutory inquiry. This can result in a legally binding decision, corrective orders, and administrative fines. For cross-border cases involving other EU users, the DPC coordinates with peer regulators through the European Data Protection Board's cooperation and consistency mechanism.

Stage 4: Decision and Appeal

The final decision is issued in writing. Either party (you or the controller) can appeal the decision to the Circuit Court within 28 days, or to the High Court on a point of law.

How Long Does the Process Take?

Timelines vary enormously depending on complexity:

Simple amicable cases: 2 to 6 months.
Formal domestic inquiries: 12 to 24 months.
Cross-border "big tech" cases: Frequently 2 to 5 years due to the one-stop-shop coordination process.

You should not expect quick answers from the DPC on complex cases, but the office has significantly increased staffing and case throughput in recent years.

Common Types of Complaints and How to Frame Them

Subject Access Request (SAR) Refusals

If you asked for a copy of your data and received nothing within one month (or an inadequate response), your complaint should cite Article 15 GDPR. Attach the SAR you sent, proof of delivery, and any reply. Ask the DPC to order full compliance.

Right to Erasure Disputes

For "right to be forgotten" cases (Article 17), explain why one of the erasure grounds applies: the data is no longer necessary, you withdrew consent, or the processing was unlawful. Search-engine delisting requests against Google are common and follow the same route.

Unsolicited Marketing

Under the ePrivacy Regulations 2011 and GDPR, marketing without consent (or after you unsubscribed) is unlawful. Keep the offending messages, note dates, and show that you opted out. The DPC regularly prosecutes Irish businesses for repeat marketing offences.

Data Breaches

If a company suffered a breach affecting your data and did not notify you when required, or handled it negligently, include any breach notification you received, evidence of harm (e.g., phishing attempts, identity theft), and details of any remediation offered.

Protecting Your Privacy Going Forward

Filing a complaint addresses the past, but prevention matters equally. Practical steps every Irish resident can take include:

Use encrypted DNS (such as DNS over HTTPS) in your browser and operating system to reduce network-level tracking.
Choose privacy-respecting browsers like Firefox or Brave and enable strict tracking protection.
Audit the permissions you grant to mobile apps every few months.
Use unique passwords with a reputable password manager and enable two-factor authentication.
When sharing links publicly, use a privacy-conscious link shortener like Lunyb, which lets you shorten and share URLs without embedding heavy third-party trackers. You can read more in our honest review of Lunyb or compare it against alternatives in our 2026 buyer's guide.
Regularly submit subject access requests to major platforms to see what they hold about you.

For businesses evaluating enterprise link tools, our Rebrandly review for 2026 covers how commercial shorteners approach data handling and pricing.

Costs, Legal Aid, and Support

Filing a complaint with the DPC is completely free. You do not need a solicitor, and the DPC's forms are designed for members of the public. However, if you decide to pursue civil compensation in court, or appeal a DPC decision, you may wish to seek legal advice. Free assistance is available from:

Citizens Information: General guidance on your rights.
FLAC (Free Legal Advice Centres): Free legal information and advice clinics.
Digital Rights Ireland: Advocacy group that occasionally supports strategic cases.
noyb (None of Your Business): European privacy NGO founded by Max Schrems, which files strategic complaints against major platforms.

Frequently Asked Questions

Can I file a DPC complaint if I live outside Ireland?

Yes. Because the DPC is the lead supervisory authority for many multinationals headquartered in Dublin, EU residents frequently complain to the DPC about companies like Meta, Google, and TikTok. You can also lodge the complaint with your local data protection authority, which will forward it to the DPC under the one-stop-shop mechanism.

Will the company I complain about know my identity?

Yes, in most cases. To investigate a complaint fairly, the DPC must share your identity and the nature of your complaint with the controller so they can respond. Anonymous complaints are generally treated as "concerns" and rarely result in a formal investigation.

Can I get compensation through the DPC?

No. The DPC can order changes and issue fines paid to the state, but it cannot award you personal damages. To claim compensation for distress or financial loss, you must file a separate civil action under Section 117 of the Data Protection Act 2018 in the Circuit Court or High Court.

What if the DPC dismisses my complaint?

You have the right to appeal a formal DPC decision to the Circuit Court within 28 days of receiving it. For dismissals on preliminary grounds, you can ask the DPC to reconsider with additional evidence, or challenge the decision by judicial review in the High Court.

How long do I have to file a complaint?

There is no strict statutory deadline for lodging a complaint with the DPC, but you should act as promptly as possible. Delay can make evidence harder to gather and may lead the DPC to conclude that no useful investigation is possible. For civil compensation claims, the standard six-year limitation period under Irish tort law generally applies.

Final Thoughts

Ireland's Data Protection Commission is one of Europe's most consequential privacy regulators, and its complaints process is genuinely accessible to ordinary members of the public. By preparing your evidence carefully, contacting the controller first, and using the DPC's online complaint form, you give yourself the best chance of a swift and satisfactory outcome. Even when investigations take years, the process contributes to broader accountability, and every well-documented complaint helps shape how personal data is handled across Ireland and the wider EU.