DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If a company has mishandled your personal data, the Data Protection Commission (DPC) of Ireland is the statutory body that can investigate your complaint. Because Ireland hosts the European headquarters of Meta, Google, TikTok, Microsoft, LinkedIn, and X, the DPC acts as the lead supervisory authority for much of Europe under the GDPR's one-stop-shop mechanism. This guide walks you through exactly how to file a privacy complaint with the DPC, what evidence you need, and how long the process takes.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's independent national authority responsible for upholding the fundamental right of individuals to have their personal data protected. Established under the Data Protection Act 2018, the DPC enforces both the General Data Protection Regulation (GDPR) and the Irish Data Protection Act.

The DPC's headquarters are located at 21 Fitzwilliam Square South, Dublin 2, with a second office in Portarlington, County Laois. The current Commissioners are Dr. Des Hogan and Dale Sunderland, who jointly lead the organisation following the three-commissioner model introduced in 2024.

Why the DPC Matters Beyond Ireland

Under the GDPR's "one-stop-shop" rule, individuals across the EU can lodge complaints against Ireland-based tech giants either with their local data protection authority or directly with the DPC. The DPC has issued some of the largest GDPR fines to date, including a €1.2 billion penalty against Meta in 2023 for unlawful data transfers.

When You Can File a Complaint With the DPC

You can lodge a complaint with the DPC when you believe an organisation has breached your rights under the GDPR or the Data Protection Act 2018. Common grounds include:

• Unauthorised processing of your personal data without a lawful basis.
• Refusal or delay in responding to a Subject Access Request (SAR).
• Failure to delete your data after a valid erasure request.
• Unsolicited marketing emails, texts, or phone calls.
• Data breaches that exposed your information.
• Excessive CCTV surveillance or workplace monitoring.
• Cross-border data transfers without adequate safeguards.

Who Can File a Complaint?

Any individual (data subject) whose personal data is processed by an organisation subject to Irish or EU data protection law can file. You do not need to be an Irish citizen or resident. Complaints can also be submitted by authorised representatives, including solicitors or recognised not-for-profit bodies such as noyb (None of Your Business).

Before You File: Contact the Organisation First

The DPC strongly encourages complainants to first raise concerns directly with the organisation in question. In most cases, you must contact the controller and give them a reasonable chance to respond before the DPC will accept your complaint.

Step 1: Identify the Data Protection Officer (DPO)

Larger organisations are legally required to appoint a Data Protection Officer. Their contact details are typically listed in the privacy policy on the company's website. Write to the DPO clearly stating:

1. Your name and a reliable contact method.
2. The specific issue or right being invoked (access, erasure, objection, etc.).
3. A reasonable deadline for response (one month is the GDPR default).

Step 2: Keep Records of Everything

Save copies of every email, letter, or screenshot. If you communicate by phone, follow up in writing to create a paper trail. These records become the foundation of any DPC complaint.

How to File a Complaint With the DPC: Step by Step

The DPC accepts complaints through four main channels: an online webform, email, post, and in person. The online webform is the fastest and most efficient route.

Step 1: Visit the Official DPC Website

Go to dataprotection.ie and navigate to "Contact / Raise a Concern." Be cautious of look-alike domains; always type the URL directly or use a trusted bookmark. If you're sharing links to DPC resources with others, consider using a reputable shortener like Lunyb so recipients can see link previews and avoid phishing clones.

Step 2: Choose the Correct Form

The DPC offers several specialised forms:

• General complaint form — for most GDPR issues.
• Electronic direct marketing form — for spam calls, texts, or emails.
• Data breach notification form — used by organisations, not individuals.
• Access request complaint — if a company failed to respond to a SAR.

Step 3: Complete the Required Information

Prepare the following before you begin:

1. Your full name, postal address, email, and phone number.
2. The name and address of the organisation you are complaining about.
3. A clear, factual description of what happened and when.
4. Copies of your correspondence with the organisation.
5. Any supporting evidence (screenshots, emails, letters, phone logs).
6. A statement of what outcome you are seeking.

Step 4: Submit and Receive Acknowledgment

After submission, the DPC will send an acknowledgment, usually within 10 working days, confirming receipt and assigning a case reference number. Keep this reference for all future correspondence.

DPC Complaint Channels Compared

Channel	Best For	Response Time	Evidence Upload
Online webform	Most complaints	~10 working days	Yes (file attachments)
Email (info@dataprotection.ie)	Follow-ups, documents	~10 working days	Yes
Postal mail	Those without internet access	2–4 weeks	Yes (physical copies)
Phone (076 110 4800)	General queries, not formal filing	Immediate	No

What Happens After You File

Once your complaint is accepted, the DPC follows a structured process defined by Section 109 of the Data Protection Act 2018 and GDPR Article 77.

Stage 1: Examination and Amicable Resolution

The DPC first assesses whether your complaint is admissible. If it is, a case officer will typically contact the organisation and attempt to resolve the matter amicably. Many complaints are closed at this stage with the controller agreeing to delete data, update records, or stop marketing.

Stage 2: Formal Inquiry

If amicable resolution fails or the complaint raises serious concerns, the DPC may launch a formal inquiry. This is a quasi-judicial process involving written submissions, document review, and sometimes oral hearings. Inquiries can last months or, in complex cross-border cases, years.

Stage 3: Draft and Final Decision

The DPC issues a draft decision. For cross-border cases, this is shared with other EU supervisory authorities through the European Data Protection Board (EDPB) consultation process. A final decision can include:

• Reprimands or formal warnings.
• Orders to comply (e.g., delete data, respond to SAR).
• Administrative fines up to €20 million or 4% of global turnover.
• Bans on specific processing activities.

Stage 4: Appeal Rights

Both complainants and the organisation can appeal DPC decisions to the Circuit Court or High Court within 28 days. Judicial review is also available on points of law.

How Long Does a DPC Complaint Take?

Timelines vary enormously depending on complexity:

Complaint Type	Typical Timeframe
Unsolicited marketing (clear-cut)	2–6 months
Subject access request failure	3–9 months
Standard GDPR complaint	6–18 months
Cross-border Big Tech inquiry	1–4 years

The DPC has faced criticism from EU counterparts for slow handling of complaints against large platforms. Reforms in 2024, including the appointment of three commissioners, aim to accelerate case throughput.

Tips to Strengthen Your Complaint

1. Be factual, not emotional. Case officers deal with hundreds of files; a clear, chronological account helps your case stand out.
2. Cite the specific GDPR article you believe was breached (e.g., Article 15 for access, Article 17 for erasure).
3. Attach evidence as PDFs rather than loose screenshots where possible.
4. State the harm. Explain how the breach affected you, financially, emotionally, or reputationally.
5. Follow up politely if you hear nothing after six weeks.

Protecting Your Privacy While You Wait

A complaint can take months to resolve, so take practical steps to limit further exposure in the meantime. Use strong, unique passwords stored in a reputable password manager, enable two-factor authentication, and consider using privacy-respecting browsers and encrypted DNS resolvers. When sharing links related to your complaint, especially on social media or forums, use a trusted link management service such as Lunyb to track clicks without exposing personal URLs. For more on choosing safe tools, see our 2026 buyer's guide to URL shorteners.

Common Mistakes to Avoid

• Skipping the controller contact step. The DPC may reject complaints where you haven't given the organisation a chance to respond.
• Filing against the wrong entity. For example, complaining to the DPC about a UK-only service that should go to the ICO instead.
• Missing deadlines. The DPC generally expects complaints within a reasonable time of the issue arising.
• Submitting incomplete evidence. This slows the process significantly.
• Expecting compensation. The DPC cannot award damages; you must pursue the Circuit Court separately for compensation under Section 117.

Alternatives and Complementary Routes

Filing with the DPC is not your only option. You can also:

• Sue for damages in the Circuit Court under Section 117 of the Data Protection Act 2018.
• Join a representative action brought by organisations like noyb or Digital Rights Ireland.
• File with another EU authority if the controller's main establishment is elsewhere.
• Report scams to An Garda Síochána if the data misuse involves fraud.

Frequently Asked Questions

Is there a fee for filing a DPC complaint?

No. Filing a complaint with the Data Protection Commission is completely free. The DPC is a statutory body funded by the Irish Exchequer, and access to it is a fundamental right under Article 77 of the GDPR.

Can I file a DPC complaint anonymously?

No, formal complaints require your identity so the DPC can communicate with you and verify the facts. However, your identity is generally not disclosed to the organisation without your consent during initial engagement, and you can report concerns anonymously via the DPC's confidential channels if you only want to flag an issue without pursuing a case.

What if the company is based outside Ireland?

Under the GDPR's one-stop-shop mechanism, you can file with your local EU data protection authority, which will coordinate with the lead supervisory authority. If the organisation's EU main establishment is in Ireland, as with most Big Tech firms, the DPC becomes the lead regulator regardless of where you live in the EU.

Can I get compensation through the DPC?

No. The DPC can order corrective measures and impose administrative fines on organisations, but those fines go to the state, not to you. To claim personal damages, you must bring a separate civil action in the Circuit Court under Section 117 of the Data Protection Act 2018.

What if the DPC rejects or ignores my complaint?

If the DPC fails to act within three months or you disagree with its decision, you have the right to an effective judicial remedy under Article 78 GDPR. This means you can seek judicial review in the Irish High Court. You may also escalate concerns to the European Data Protection Board or, in cross-border cases, your local authority.

Final Thoughts

Filing a complaint with the DPC Ireland is a powerful way to enforce your data protection rights, but it requires preparation, patience, and clear documentation. Start by engaging the organisation directly, gather every piece of correspondence, and submit a focused, evidence-backed complaint through the DPC's online portal. While the process can be slow, especially for cases involving major platforms, it remains one of the most consequential privacy enforcement routes in Europe. Combined with everyday privacy habits, like using strong authentication, reputable link tools, and privacy-first browsers, filing a complaint helps hold organisations accountable and shapes a safer digital landscape for everyone.