DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If your personal data has been mishandled by a company, website, or public body operating in Ireland, you have a legal right to complain. The Data Protection Commission (DPC) is Ireland's independent authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. This guide explains exactly how to file a privacy complaint with the DPC, what evidence you need, and what happens after you submit.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's national data protection authority, established under the Data Protection Act 2018. It enforces the General Data Protection Regulation (GDPR), the ePrivacy Regulations, and the Law Enforcement Directive across Ireland.

Because Ireland hosts the European headquarters of major technology companies — including Meta, Google, TikTok, LinkedIn, Microsoft, and X — the DPC acts as the lead supervisory authority for much of the EU under the GDPR's "one-stop-shop" mechanism. This gives it outsized influence over how global tech firms handle European user data.

Key powers of the DPC

• Investigate complaints from individuals (data subjects).
• Conduct audits and inquiries into organisations.
• Issue reprimands, warnings, and corrective orders.
• Impose administrative fines of up to €20 million or 4% of global annual turnover, whichever is higher.
• Refer cases to the Circuit Court or High Court.

When Should You File a Complaint with the DPC?

You can file a complaint with the DPC Ireland if you believe an organisation has breached your data protection rights under the GDPR or the Data Protection Act 2018. Common grounds for complaint include:

• Access denied: A company refused or ignored your Subject Access Request (SAR).
• Unlawful processing: Your data was used without a valid legal basis.
• Unsolicited marketing: You received marketing emails, SMS, or calls after opting out.
• Data breach: You were affected by a security incident and were not properly notified.
• Right to erasure ignored: A company refused to delete your data when legally required.
• Cookie violations: Non-compliant cookie banners or tracking without consent.
• CCTV misuse: Workplace or public surveillance that infringes privacy.
• Automated decision-making: Algorithmic decisions that significantly affect you with no human review.

When NOT to file with the DPC

The DPC cannot help with every grievance. Avoid filing if:

• Your issue is a general consumer complaint (contact the CCPC or Competition and Consumer Protection Commission instead).
• The organisation is based outside the EU with no Irish establishment (file with your local DPA).
• You are seeking financial compensation only — the DPC cannot award damages; you must go to court.
• The matter concerns journalism in the public interest, which has special exemptions.

Step 1: Contact the Organisation First

Before escalating to the DPC, you are strongly encouraged (and in most cases expected) to raise the issue directly with the organisation. The DPC will typically ask for evidence that you attempted to resolve the matter with the data controller first.

1. Identify the data controller. This is the entity that decides how and why your data is processed. Check their privacy policy for a contact address.
2. Find the Data Protection Officer (DPO). Larger organisations must publish DPO contact details. Email them directly where possible.
3. Submit a written request. State clearly what right you are exercising (access, erasure, objection, rectification, etc.).
4. Give them one calendar month. Under Article 12 GDPR, controllers must respond within 30 days, extendable by two more months for complex requests.
5. Keep copies of everything. Save emails, screenshots, timestamps, and any reference numbers.

Step 2: Gather Your Evidence

A well-documented complaint is far more likely to progress quickly. The DPC assesses complaints on the written record, so organise your materials before submitting.

Essential documents to prepare

• Your original request to the organisation (with date).
• The organisation's response (or proof there was none).
• Screenshots of the website, app, cookie banner, or marketing message.
• Copies of unlawful marketing emails including full headers.
• Any contracts, terms of service, or privacy notices relevant to the issue.
• Your identification details (the DPC must verify you are the data subject).

If you are sharing links to evidence stored online — such as screenshots on cloud storage or archived web pages — use a trusted link management tool like Lunyb to keep your evidence URLs organised, trackable, and easy to reference in correspondence. This is particularly useful if you have multiple attachments to share with the DPC caseworker over email.

Step 3: Submit Your Complaint to the DPC

The DPC offers several channels for submitting a complaint. There is no fee to file.

Submission methods

Method	Best For	Details
Online webform	Most individuals	Available at dataprotection.ie under "Contact Us"
Email	Complex cases with attachments	info@dataprotection.ie
Postal mail	No internet access or very sensitive matters	21 Fitzwilliam Square South, Dublin 2, D02 RD28
Breach notification portal	Organisations reporting breaches	Separate from individual complaints

What to include in your complaint

1. Your full name and contact details. Anonymous complaints are generally not actionable.
2. The name of the organisation you are complaining about.
3. A clear description of the issue. Stick to facts, dates, and relevant GDPR articles.
4. The outcome you are seeking. For example: erasure of data, cessation of marketing, access to records.
5. All supporting evidence. Attach documents or provide secure links.
6. Confirmation you have contacted the organisation and the response (or lack thereof).

Step 4: What Happens After You File

Once the DPC receives your complaint, it moves through a structured handling process. Understanding each stage helps you set realistic expectations.

The DPC complaint handling stages

1. Acknowledgement (within 7 days). You will receive a reference number and a named caseworker.
2. Initial assessment. The DPC checks jurisdiction, whether you've contacted the organisation, and whether the issue falls under data protection law.
3. Amicable resolution. The DPC usually attempts to mediate between you and the organisation. Many cases close at this stage.
4. Formal investigation. If mediation fails, or the issue is serious, a formal statutory inquiry begins.
5. Decision. The DPC issues a legally binding decision, which may include reprimands, orders, or fines.
6. Appeal. Either party can appeal to the Circuit Court within 28 days.

How long does it take?

Simple complaints are often resolved in 2–6 months. Formal inquiries, particularly against large tech firms, can take 2–4 years because of the cross-border consultation process required under Article 60 GDPR.

Your Rights During the Process

As a complainant, you are entitled to:

• Regular updates on the progress of your case.
• The right to be heard before a final decision is made.
• A written, reasoned decision at the conclusion.
• The right to pursue judicial remedy under Article 78 GDPR if you disagree with the outcome.
• The right to seek compensation separately in the Irish courts under Article 82 GDPR.

Common Mistakes to Avoid

Many complaints are delayed or dismissed because of avoidable errors. Here are the most frequent pitfalls.

Pitfalls that weaken your complaint

• Skipping direct contact with the organisation. The DPC will usually redirect you.
• Submitting without evidence. Allegations without proof rarely progress.
• Being emotional rather than factual. Stick to timelines, articles of the GDPR, and documented harm.
• Filing with the wrong authority. If the organisation has no Irish presence, your local DPA is appropriate.
• Expecting compensation. The DPC does not award damages — this must come from a court claim.
• Ignoring deadlines. Respond promptly to DPC requests, or your case may be closed.

DPC Complaint vs. Court Action: Which Should You Choose?

You are not required to go through the DPC before pursuing a court claim. Each route has its merits.

Factor	DPC Complaint	Court Action
Cost	Free	Legal fees apply
Compensation	Not available	Available (material + non-material damages)
Speed	Months to years	Varies, often faster for simple claims
Enforcement power	Fines, orders, reprimands	Court judgment and damages
Public record	Decisions published anonymously	Judgments may be public
Legal representation	Not required	Usually required

Many people pursue both — a DPC complaint for regulatory action against the organisation, and a separate civil claim for compensation.

Protecting Your Privacy Going Forward

Filing a complaint addresses a specific incident, but reducing your overall data exposure is just as important. Consider:

• Using encrypted DNS services (such as DNS over HTTPS) to limit tracking at the network level.
• Switching to privacy-focused browsers that block third-party cookies and fingerprinting by default.
• Using disposable or alias email addresses when signing up for services.
• Regularly submitting Subject Access Requests to see what organisations hold about you.
• Reviewing cookie consent carefully — reject all non-essential cookies where possible.
• Shortening and tracking the links you share using services such as Lunyb, so you understand which platforms harvest click data.

If you're reviewing the tools you share links through from a privacy standpoint, our 2026 buyer's guide to URL shorteners compares the data-handling practices of leading providers.

Cross-Border Complaints: The One-Stop-Shop

If the organisation you are complaining about operates across the EU, the DPC may act as the "lead supervisory authority" under the GDPR's one-stop-shop mechanism. This means:

• You can file with your local data protection authority, who will forward the complaint to the DPC.
• The DPC consults with all other concerned authorities before issuing a draft decision.
• Objections from other EU regulators can trigger a dispute resolution mechanism through the European Data Protection Board (EDPB).

This process is why cases involving Meta, Google, or TikTok often take years — but it also ensures a single, EU-wide outcome.

Frequently Asked Questions

How much does it cost to file a complaint with the DPC Ireland?

Filing a complaint with the Data Protection Commission is completely free. There are no application fees, submission costs, or charges throughout the investigation. You only incur costs if you choose to use a solicitor or pursue a separate civil claim in court.

Can I file a DPC complaint anonymously?

No. The DPC requires your identity to verify you are the affected data subject and to communicate with you about the case. However, the DPC treats your details confidentially, and its published decisions typically anonymise the complainant.

How long do I have to file a complaint?

There is no strict statutory deadline, but you should file as soon as possible — ideally within a few months of the incident. Delays make evidence harder to gather and may weaken your case. For court-based compensation claims under the Statute of Limitations, the usual period is six years.

Can I complain about a company based outside Ireland?

Yes, if the company offers goods or services to people in Ireland or the EU. If the organisation has its main EU establishment in Ireland, the DPC is the lead authority. If it is based in another EU country, you can file with your local DPA or the DPC — they will route it appropriately.

What if I disagree with the DPC's decision?

You have the right to appeal the DPC's decision to the Circuit Court within 28 days of being notified. You can also pursue a judicial review in the High Court, or make a separate civil claim for compensation under Article 82 GDPR.

Final Thoughts

Filing a privacy complaint with the DPC Ireland is a powerful way to hold organisations accountable for how they handle your personal data. The process is free, structured, and backed by some of the strongest enforcement powers in the world. By contacting the organisation first, gathering strong evidence, and clearly stating what outcome you seek, you give your complaint the best chance of success.

Even if your individual case takes time, remember that every complaint contributes to the DPC's enforcement priorities and shapes the privacy landscape across Europe. Your voice matters — use it.