DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If your personal data has been mishandled by a company, website, or public body operating in Ireland or the EU, you have the right to lodge a complaint with Ireland's Data Protection Commission (DPC). As the lead supervisory authority for many of the world's largest technology platforms, including Meta, Google, TikTok, LinkedIn, and X, the DPC plays an outsized role in enforcing the General Data Protection Regulation (GDPR) across Europe.

This guide walks you through everything you need to know about filing a privacy complaint with the DPC Ireland in 2026, from gathering evidence to what happens after you submit.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's independent regulatory authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. Established under the Data Protection Act 2018, the DPC enforces the GDPR, the Law Enforcement Directive, and the ePrivacy Regulations within Ireland.

Because so many multinational tech companies have their European headquarters in Dublin, the DPC often acts as the "lead supervisory authority" for cross-border cases under the GDPR's one-stop-shop mechanism. This means a complaint filed in Ireland can have Europe-wide consequences.

Key Responsibilities of the DPC

Investigating complaints from individuals (data subjects)
Conducting audits and inquiries into organisations
Issuing fines and corrective measures for GDPR violations
Providing guidance to businesses and the public
Cooperating with other EU data protection authorities

When Should You File a Complaint with the DPC?

You should consider filing a complaint with the DPC when an organisation has violated your data protection rights under GDPR and either refused to resolve the issue or failed to respond adequately. The DPC generally expects you to contact the organisation first before escalating.

Common Grounds for a DPC Complaint

Unlawful processing of personal data — your data was collected or used without a valid legal basis.
Refusal of a Subject Access Request (SAR) — the organisation ignored or wrongly denied your request for a copy of your data.
Failure to delete data — your "right to erasure" (right to be forgotten) was not honoured.
Unlawful direct marketing — you received emails, SMS, or calls without consent.
Data breaches — your data was exposed or stolen and you weren't properly notified.
Excessive CCTV or surveillance — monitoring in workplaces, estates, or public areas beyond what's lawful.
Cookie and tracking violations — websites tracking you without valid consent.

Before You File: Preliminary Steps

The DPC will usually ask whether you've first attempted to resolve the matter directly with the organisation. Skipping this step can delay or weaken your complaint.

Step 1: Contact the Data Controller

Write directly to the organisation's Data Protection Officer (DPO) or privacy contact. Most companies list this in their privacy policy. Clearly state:

Your identity and contact details
The specific right you are exercising (access, erasure, rectification, etc.)
A reasonable deadline — the GDPR requires a response within one month

Step 2: Keep Written Records

Save every email, letter, screenshot, and timestamp. The DPC relies heavily on documentary evidence. If you're sharing sensitive URLs or supporting documents, consider using a privacy-respecting link management tool like Lunyb to track, protect, and expire shared evidence links — especially useful if you need to send material to a solicitor or the DPC itself.

Step 3: Wait for the One-Month Response Window

Under Article 12 GDPR, the controller has one calendar month to respond. They may extend this by two months for complex requests, but must inform you of the extension within the first month.

How to File a Complaint with DPC Ireland: Step-by-Step

The DPC accepts complaints through several channels, with the online webform being the most efficient. Here's exactly how to file one.

Step 1: Gather Your Documentation

Before starting the form, collect:

Proof of your identity (not usually submitted upfront but keep ready)
The name and contact details of the organisation
Copies of your correspondence with them
Dates and timeline of events
A clear description of the alleged breach
Any screenshots, emails, or documents that support your case

Step 2: Choose Your Submission Method

The DPC offers three main ways to lodge a complaint:

Method	Best For	Response Speed
Online webform (dataprotection.ie)	Most complaints	Fastest acknowledgement
Email to info@dataprotection.ie	Attaching large evidence files	Moderate
Postal letter to Fitzwilliam Square, Dublin 2	Formal, documented submissions	Slowest

Step 3: Complete the Online Complaint Form

Go to dataprotection.ie and navigate to "Contact / Raise a Concern." The webform asks you to:

Provide your full name and contact details
Identify the organisation you're complaining about
Specify the nature of the complaint (access, erasure, marketing, etc.)
Describe the facts in your own words
Upload supporting documents (PDF, Word, screenshots)
Confirm you've already contacted the organisation

Step 4: Submit and Note Your Reference Number

Once submitted, you'll receive an automated acknowledgement with a case reference. Keep this safe — you'll need it for all future correspondence.

What Happens After You File?

The DPC's handling of complaints is governed by Section 109 of the Data Protection Act 2018. Here's the typical journey.

1. Initial Assessment

A caseworker reviews your complaint to confirm it falls within the DPC's remit. If it doesn't (e.g., it should go to another EU authority), they'll transfer or redirect it.

2. Amicable Resolution

The DPC will often attempt to broker an "amicable resolution" between you and the organisation. This is a facilitated dialogue where the controller is asked to remedy the issue — delete your data, provide the access response, stop marketing, and so on. Many cases are resolved at this stage.

3. Formal Investigation or Inquiry

If amicable resolution fails or the matter is serious, the DPC can open a formal statutory inquiry. This may result in:

A finding of infringement
Administrative fines (up to €20 million or 4% of global turnover)
Orders to bring processing into compliance
Bans on data processing or transfers

4. Decision and Appeal

You'll receive a written decision. If you're dissatisfied, you can appeal to the Irish Circuit Court or High Court within 28 days.

How Long Does a DPC Complaint Take?

Realistically, timelines vary enormously depending on complexity.

Complaint Type	Typical Timeline
Simple access request issue	2–6 months
Direct marketing complaint	3–9 months
Data breach notification issue	6–12 months
Cross-border Big Tech inquiry	2–5+ years

High-profile cases involving multinationals (Meta, Google, TikTok) have historically taken years due to the GDPR's cross-border cooperation process. For individual Irish-only complaints, outcomes are typically much faster.

Tips to Strengthen Your Complaint

A well-prepared complaint is more likely to be taken seriously and resolved quickly. Follow these best practices.

Be Specific and Factual

Avoid emotional language. Stick to dates, actions, and the specific GDPR articles you believe were breached (e.g., "Article 15 — right of access" or "Article 17 — right to erasure").

Provide a Clear Timeline

List events chronologically: when you contacted the organisation, when they responded (or didn't), and when the issue occurred.

Attach Only Relevant Evidence

Don't dump every email. Curate the correspondence that proves the breach. Redact unrelated personal information of third parties.

State the Outcome You Want

Make it clear whether you want erasure, access, a stop to marketing, or an investigation. This helps the DPC frame the resolution.

Can You File Anonymously?

No. The DPC cannot formally investigate anonymous complaints, because it must be able to verify you are a data subject with standing. However, you can submit general "concerns" or tip-offs anonymously, which may inform the DPC's broader supervisory activity without opening a formal case.

What If the Company Isn't Based in Ireland?

If the organisation's EU headquarters is in another member state, the DPC will usually transfer your complaint to the relevant lead supervisory authority (for example, CNIL in France or the BfDI in Germany) under the GDPR's one-stop-shop mechanism. You can also file directly with your local authority if you prefer — Irish residents are entitled to use the DPC regardless.

Protecting Your Privacy Going Forward

Filing a complaint is reactive. Being proactive about privacy prevents many of these issues in the first place. Consider:

Reviewing privacy settings on all major platforms annually
Using encrypted DNS resolvers to limit tracking at the network level
Opting out of data broker lists where available
Using privacy-respecting browsers with tracker blocking enabled
Shortening and controlling the links you share with services like Lunyb, which lets you expire or revoke shared URLs
Comparing tools before signing up — our best URL shorteners guide for 2026 covers privacy differences across providers

FAQ: Filing a Privacy Complaint with DPC Ireland

Is there a fee to file a complaint with the DPC?

No. Lodging a complaint with the Data Protection Commission is completely free of charge for individuals. There are also no fees for appeals during the DPC's own process, though court appeals carry standard legal costs.

Do I need a solicitor to file a DPC complaint?

No. The complaint process is designed for individuals to use without legal representation. However, for complex cases — such as significant financial loss, employment disputes, or appeals to court — a solicitor with GDPR expertise can be valuable.

Can I complain about a public body or government agency?

Yes. The GDPR and Irish Data Protection Act apply to public sector bodies including Revenue, HSE, local councils, Tusla, and An Garda Síochána (with some specific exemptions for law enforcement processing under the Law Enforcement Directive). The DPC handles complaints about public bodies in the same way as private companies.

What if the DPC rejects or doesn't uphold my complaint?

You have the right to appeal the DPC's decision to the Circuit Court or, for larger matters, the High Court within 28 days of receiving the decision. You can also lodge a judicial review in certain circumstances. Seeking legal advice before appealing is strongly recommended.

Can I claim compensation through the DPC?

The DPC itself does not award compensation. However, if the DPC finds a breach, you can use that decision as evidence to bring a civil claim for compensation under Article 82 GDPR and Section 117 of the Data Protection Act 2018 in the Irish courts. Material and non-material damage (including distress) can be claimed.

Conclusion

Filing a privacy complaint with the Data Protection Commission is one of the most powerful tools available to Irish and EU residents. The process is free, structured, and genuinely effective — the DPC has issued some of the largest GDPR fines in history. By documenting your case thoroughly, contacting the organisation first, and submitting a focused, evidence-backed complaint via dataprotection.ie, you give yourself the best chance of a timely and favourable outcome.

Privacy is a fundamental right, and the DPC exists to help you enforce it. Don't hesitate to use it.