DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If an organisation has mishandled your personal data, the Data Protection Commission (DPC) is the Irish regulator responsible for investigating and enforcing your rights under the GDPR and the Data Protection Act 2018. This guide walks you through exactly how to file a privacy complaint with the DPC Ireland, what to prepare, how long it takes, and what outcomes you can realistically expect.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's national independent authority for upholding the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. Headquartered in Dublin, the DPC is also the lead supervisory authority for many of the world's largest tech companies because their European headquarters are based in Ireland — including Meta, Google, TikTok, Microsoft, Apple and LinkedIn.

The DPC has the power to investigate complaints, audit organisations, issue reprimands, order corrective action, and impose administrative fines of up to €20 million or 4% of global annual turnover, whichever is higher.

When You Can Complain to the DPC

You can lodge a complaint with the DPC if you believe an organisation (a "data controller" or "data processor") has infringed your data protection rights. Common examples include:

• An organisation refused or ignored your access request (subject access request, or SAR).
• A company continues to send you marketing emails or SMS after you unsubscribed.
• Your personal data was exposed in a breach and you were not properly informed.
• CCTV footage is being used disproportionately by an employer, landlord or neighbour.
• An organisation refuses to delete or correct inaccurate information about you.
• Cookies or trackers were placed on your device without valid consent.

Before You File: Try to Resolve It Directly

The DPC strongly recommends — and in most cases expects — that you contact the organisation first before escalating. This is often the fastest route to a resolution and gives the DPC evidence that you attempted to resolve the matter.

Step 1: Contact the Organisation's DPO

Most medium and large organisations must appoint a Data Protection Officer (DPO). You can usually find their contact details in the organisation's privacy policy. Send a clear, dated email explaining:

1. Who you are and how the organisation holds your data.
2. What right you are exercising (access, erasure, rectification, objection, etc.).
3. What outcome you want.
4. A reasonable deadline (the GDPR gives them one month to respond, extendable by two months for complex cases).

Step 2: Keep Records

Save every email, letter, screenshot, and reference number. The DPC will ask for this correspondence when you file. If you share evidence links, keep them private and secure — a tool like Lunyb lets you create short, trackable links with optional password protection when you need to send supporting documents to the DPC or a solicitor.

How to File a Complaint with the DPC Ireland

Once you've given the organisation a reasonable chance to respond (or if they've refused outright), you can formally lodge a complaint. The DPC provides multiple channels, and filing is completely free.

Step 1: Choose Your Filing Channel

Channel	Best For	Typical Response Time
Online webform (dataprotection.ie)	Most individuals; fastest intake	Acknowledgement within 5–10 working days
Email (info@dataprotection.ie)	Complaints with many attachments	Similar to webform
Postal mail (21 Fitzwilliam Square South, Dublin 2, D02 RD28)	Those who prefer paper records	Slower; allow 2–3 weeks
Phone (+353 578 684 800)	Guidance only — not for lodging formal complaints	Immediate guidance

Step 2: Complete the Complaint Form

The DPC webform asks for specific information. Have the following ready before you start:

1. Your personal details — full name, address, email and phone number. Anonymous complaints are generally not investigated.
2. The organisation you are complaining about — legal name, address, and (where possible) DPO contact.
3. A clear description of the issue — dates, what happened, which right you believe was infringed.
4. What you have already done — summary of your correspondence with the organisation and their response (or lack of one).
5. Supporting evidence — emails, screenshots, letters, reference numbers, policy excerpts.
6. The outcome you are seeking — e.g., erasure of data, an apology, cessation of marketing, a formal finding.

Step 3: Submit and Receive Acknowledgement

Once submitted, you'll receive an automated acknowledgement, followed by a case reference number (usually within 5–10 working days). Keep this reference for all future correspondence.

What Happens After You File

The DPC follows a structured handling process. Understanding each stage helps you set realistic expectations.

Stage 1: Assessment and Amicable Resolution

A case officer reviews your complaint to confirm it falls within the DPC's remit. In many cases, the DPC first attempts an "amicable resolution" — essentially mediation between you and the organisation. A large share of complaints are resolved at this stage within a few weeks to a few months.

Stage 2: Formal Statutory Inquiry

If amicable resolution fails or the matter is serious (a large breach, systemic non-compliance, cross-border issues), the DPC opens a formal inquiry under Section 110 of the Data Protection Act 2018. This can involve:

• Requests for detailed information from the organisation.
• On-site audits or inspections.
• Analysis of the organisation's lawful basis, consent records and technical safeguards.
• A draft decision shared with both parties for comment.

Stage 3: Decision and Enforcement

The DPC issues a legally binding decision which may include:

• A reprimand or warning.
• An order to comply (e.g., erase data, stop processing, change practices).
• An administrative fine.
• Referral to the European Data Protection Board (EDPB) for cross-border cases.

How Long Does It Take?

Timelines vary enormously. Simple complaints resolved amicably often close in 2–4 months. Full statutory inquiries — especially against Big Tech — can take 1–3 years or longer because of cross-border consultation under the GDPR's "one-stop-shop" mechanism.

Complaint Type	Typical Timeframe
Unsolicited marketing (email/SMS)	1–3 months
Access or erasure request refused	2–6 months
CCTV / workplace monitoring	3–9 months
Data breach by Irish SME	6–12 months
Cross-border Big Tech inquiry	12–36+ months

Your Rights During the Process

Under Article 77 GDPR and Irish law you have the right to:

• Lodge a complaint free of charge.
• Be kept informed of the progress and outcome of your complaint.
• Receive a reasoned written decision.
• Appeal the DPC's decision to the Circuit Court or High Court within 28 days.
• Seek a judicial remedy and compensation directly through the Irish courts under Section 117 of the Data Protection Act 2018 — independently of the DPC process.

Common Mistakes That Weaken a Complaint

1. Not contacting the organisation first. The DPC may ask you to do this before accepting the complaint.
2. Vague allegations. "They misused my data" is not enough — specify dates, data categories and the right infringed.
3. Missing evidence. No screenshots, no email trail — the DPC cannot act on assertion alone.
4. Lodging with the wrong regulator. If the organisation is outside the EEA and has no Irish presence, another authority may be competent.
5. Delaying too long. While there's no strict statutory deadline, stale complaints (over 12 months old) are harder to investigate.

Special Cases

Data Breaches

If you were personally affected by a breach, you can complain even if the organisation already notified the DPC. Reference any breach notification number if you have it.

Cross-Border Complaints

Under the GDPR's one-stop-shop, if the organisation's main EU establishment is in Ireland, the DPC becomes the lead authority for all EU complaints. You may, however, lodge with your home country's regulator, who will transfer it to the DPC.

Employment-Related Complaints

Workplace surveillance, excessive monitoring, or employer access to personal communications are all valid grounds. Be aware that your employer will usually be notified of the complaint.

Practical Privacy Steps While You Wait

DPC investigations are slow. In the meantime, protect yourself:

• Use encrypted DNS (e.g., Cloudflare 1.1.1.1 or Quad9) to limit third-party tracking.
• Switch to privacy-respecting browsers such as Firefox or Brave with strict tracking protection.
• Audit app permissions on your phone — revoke access you don't recognise.
• Use a password manager and enable two-factor authentication everywhere.
• When sharing links to evidence or personal content, use a service like Lunyb that supports expiring links and click analytics, so you keep control over who accesses your documents.

Further Reading

• Is Lunyb Legit? An Honest Review of the URL Shortener in 2026
• Best URL Shorteners Reviewed and Compared: 2026 Buyer's Guide
• Rebrandly Review 2026: Is It Worth the Price?

Frequently Asked Questions

Is it free to file a complaint with the DPC Ireland?

Yes. Lodging a complaint with the Data Protection Commission is completely free, whether you file online, by email, or by post. You are not required to use a solicitor, although you may choose to do so for complex matters.

Can I file a DPC complaint anonymously?

Generally no. The DPC requires your identity so they can correspond with you, verify the facts, and investigate. However, your identity is treated confidentially during the process and is only shared with the organisation to the extent necessary to investigate the complaint.

Will I receive compensation if the DPC finds in my favour?

Not directly. The DPC can order corrective measures and impose fines (payable to the State), but it cannot award you personal compensation. To claim compensation for material or non-material damage, you must bring a separate civil action in the Circuit or High Court under Section 117 of the Data Protection Act 2018.

What if the organisation is based outside Ireland?

If the organisation has its main EU establishment in Ireland, the DPC acts as lead supervisory authority under the GDPR's one-stop-shop. If the organisation is based in another EU country, you can lodge your complaint with your local regulator (or the DPC), and it will be routed to the competent authority. For organisations outside the EEA with no EU presence, enforcement is more limited.

Can I appeal a DPC decision I disagree with?

Yes. You have 28 days from the date of the decision to appeal to the Circuit Court, or to the High Court for decisions involving administrative fines. You can also seek judicial review of procedural issues. Legal advice is strongly recommended before appealing.