DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If you believe your personal data has been mishandled by a company, public body, or online service, you have the right under the GDPR and the Irish Data Protection Act 2018 to lodge a complaint with the Data Protection Commission (DPC) of Ireland. As the lead supervisory authority for many of the world's largest technology companies headquartered in Dublin, the DPC plays an outsized role in European privacy enforcement. This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what evidence you need, and what to realistically expect.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's independent national authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. Established under the Data Protection Act 2018, it enforces the General Data Protection Regulation (GDPR), the ePrivacy Regulations, and the Law Enforcement Directive within Ireland.

Because companies such as Meta, Google, TikTok, Apple, and LinkedIn have their European headquarters in Ireland, the DPC acts as the lead supervisory authority for cross-border processing by these organisations under the GDPR's "one-stop-shop" mechanism. This means a complaint lodged in Dublin can affect the privacy rights of hundreds of millions of EU citizens.

Key Responsibilities of the DPC

• Investigating complaints from individuals (data subjects)
• Conducting own-volition inquiries into organisations
• Issuing fines and corrective measures for GDPR breaches
• Providing guidance to businesses and the public
• Cooperating with other EU data protection authorities

When Can You File a Complaint With the DPC?

You can file a complaint with the DPC Ireland any time you believe an organisation has infringed your data protection rights. The GDPR gives you a broad set of rights, and a violation of any of them can be grounds for a complaint.

Common Reasons People File DPC Complaints

1. Unanswered Subject Access Requests (SARs): The company failed to provide a copy of your personal data within one month.
2. Refusal to delete data: You exercised your right to erasure ("right to be forgotten") and were ignored or refused.
3. Unlawful marketing: Spam emails, SMS, or cold calls without valid consent.
4. Data breaches: Your data was leaked, lost, or stolen and the organisation failed to notify you.
5. Excessive data collection: A service collects more information than is necessary for its stated purpose.
6. Unlawful CCTV or workplace monitoring: Employers or neighbours surveilling you without a lawful basis.
7. Cookie and tracking violations: Websites dropping tracking cookies before you give consent.
8. Inaccurate data: A company refuses to correct wrong personal information about you.

Before You File: Contact the Organisation First

The DPC strongly encourages — and in practice expects — complainants to first try to resolve the matter directly with the organisation involved. This is sometimes called "amicable resolution." If you skip this step, the DPC may bounce your complaint back and ask you to try again.

Step-by-Step: Contacting the Controller

1. Find the organisation's Data Protection Officer (DPO) or privacy contact (usually in the privacy policy).
2. Send a clear, written request by email or letter — keep a copy.
3. State what right you are exercising (access, erasure, objection, etc.) and the legal basis (GDPR Article 15, 17, 21, etc.).
4. Give them a reasonable deadline — the GDPR allows them one month to respond.
5. If they refuse, delay, or ignore you, save all correspondence as evidence.

How to File a Complaint With the DPC Ireland: Step by Step

Filing a complaint with the DPC is free of charge and can be done entirely online. Here is the full process from start to finish.

Step 1: Gather Your Evidence

Before you start the form, collect:

• Your identification details (name, address, email, phone).
• The name and contact details of the organisation complained against.
• A clear timeline of what happened and when.
• Copies of all correspondence with the organisation.
• Screenshots, emails, letters, or any supporting documents.
• A clear statement of what outcome you want (e.g. deletion, correction, apology, enforcement action).

Step 2: Use the DPC's Online Webform or Email

Go to dataprotection.ie and navigate to "Contact / Raise a Concern." The DPC offers:

• Online webform — the fastest and recommended method.
• Email: info@dataprotection.ie
• Post: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
• Phone: +353 (0)761 104 800 — useful for guidance, but complaints must be in writing.

Step 3: Complete the Complaint Form

The DPC's complaint form will ask you to explain:

1. Who you are complaining about.
2. What rights you believe have been breached.
3. What steps you have already taken.
4. What resolution you are seeking.
5. Whether you consent to your identity being disclosed to the organisation (usually required for them to respond).

Step 4: Submit and Await Acknowledgement

The DPC typically acknowledges receipt within a few working days and assigns a case reference number. Keep this number for all future correspondence.

What Happens After You Submit a Complaint?

The DPC follows a defined handling process, though timelines vary widely depending on complexity and whether the case is cross-border.

Stage	What Happens	Typical Timeframe
Acknowledgement	DPC confirms receipt and assigns case officer	1–2 weeks
Assessment	DPC reviews whether it has jurisdiction and if the complaint is well-founded	1–3 months
Amicable Resolution	DPC contacts the organisation to seek a solution	2–6 months
Formal Investigation	If unresolved, a statutory inquiry is opened	6 months – 2+ years
Decision	Binding decision, possible fines or corrective orders	Variable
Appeal	Either party can appeal to the Circuit Court or High Court	Additional 6–18 months

Cross-Border Complaints and the One-Stop-Shop

If your complaint concerns a company whose EU headquarters is in Ireland (e.g. Meta, Google, TikTok), the DPC acts as the lead supervisory authority for the entire EU. You can still file your complaint with your local data protection authority, which will transmit it to the DPC. However, filing directly with the DPC can sometimes shortcut this process.

The DPC coordinates with other EU authorities through the European Data Protection Board (EDPB). If a dispute arises between regulators, the EDPB can issue a binding decision — this is how several high-profile fines against Meta and TikTok were finalised.

Possible Outcomes of a DPC Complaint

Not every complaint ends in a dramatic fine. The DPC has a range of enforcement tools and often resolves matters informally. Possible outcomes include:

• Amicable resolution: The organisation complies with your request (e.g. deletes data, corrects records).
• Reprimand: A formal warning issued to the organisation.
• Compliance order: The organisation is required to change its practices.
• Administrative fine: Up to €20 million or 4% of annual global turnover under GDPR.
• Processing ban: The organisation must stop certain data processing activities.
• Dismissal: If the complaint is unfounded or outside the DPC's remit.

Protecting Your Privacy Day-to-Day

Filing a complaint is a powerful last-resort tool, but prevention is always better. There are many steps you can take to reduce the amount of personal data you expose online in the first place.

Practical Privacy Habits

• Use a privacy-respecting browser with tracker blocking enabled.
• Enable encrypted DNS (DNS-over-HTTPS) in your browser or router.
• Review app permissions on your phone every few months.
• Use unique email aliases for sign-ups so you can trace leaks.
• When sharing links on social media, consider using a trustworthy shortener that doesn't aggressively profile clickers. Tools like Lunyb are designed with privacy-minded users in mind, and you can compare options in our 2026 buyer's guide.
• Read privacy policies — at least the "what we collect" and "who we share with" sections.

Tips for a Stronger Complaint

Case officers at the DPC handle hundreds of complaints each year. A well-prepared submission is more likely to be taken seriously and progressed quickly.

1. Be concise and factual. State dates, actions, and responses. Avoid emotional language.
2. Reference the specific GDPR article. For example, "The controller failed to respond to my Article 15 request within one month."
3. Attach evidence as PDFs. Screenshots, email threads, and receipts.
4. Be realistic about remedies. The DPC cannot award financial compensation — for that, you must sue the organisation in court.
5. Follow up politely. If you have had no update for 3+ months, send a short email quoting your case reference.

Can You Claim Compensation?

The DPC itself does not award damages. However, under Article 82 GDPR and Section 117 of the Data Protection Act 2018, you have the right to sue a data controller or processor directly in the Irish Circuit Court for material or non-material damage (including distress). A finding by the DPC in your favour can be strong supporting evidence in such a civil claim.

FAQ

How long does it take the DPC to resolve a complaint?

Simple complaints that can be resolved amicably often conclude within 3–6 months. Formal statutory inquiries — especially cross-border cases involving major tech companies — can take 1 to 3 years or more. The DPC publishes annual reports with current statistics.

Does it cost anything to file a complaint with the DPC Ireland?

No. Lodging a complaint with the Data Protection Commission is completely free. You do not need a solicitor, although legal advice can be helpful for complex or high-value cases.

Can I file a complaint anonymously?

You can raise concerns anonymously, but for a formal complaint to be investigated, the DPC generally needs to know your identity and share it with the organisation you are complaining about. Anonymous tip-offs may trigger an own-volition inquiry but will not result in a direct resolution for you.

What if the DPC rejects my complaint?

You have the right to an effective judicial remedy. Under Article 78 GDPR, you can appeal the DPC's decision to the Circuit Court or High Court of Ireland within 28 days of the decision being notified to you.

Can I complain about a company based outside the EU?

Yes, if the company offers goods or services to people in the EU or monitors their behaviour, GDPR applies. The DPC can investigate, though enforcement against non-EU entities with no European presence can be practically difficult.

Final Thoughts

Ireland's Data Protection Commission is one of the most important privacy regulators in the world, and filing a complaint is a right every individual in the EU should feel empowered to use. Prepare your evidence, contact the organisation first, submit a clear and factual complaint, and be patient with the process. Combined with good day-to-day privacy habits — strong passwords, minimal data sharing, and privacy-respecting tools — you can take real control of how your personal information is handled online.