DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If an organisation has mishandled your personal data, the Data Protection Commission (DPC) in Ireland is the statutory body that can investigate and take action. Because so many of the world's largest tech companies — Meta, Google, TikTok, LinkedIn, Microsoft and X — have their European headquarters in Dublin, the Irish DPC is also the lead supervisory authority for a huge share of EU GDPR enforcement. This guide explains exactly how to file a privacy complaint with the DPC Ireland, what evidence you need, and what happens after you submit.

What Is the DPC Ireland?

The Data Protection Commission (An Coimisiún um Chosaint Sonraí) is Ireland's independent regulator for data protection law. It enforces the General Data Protection Regulation (GDPR), the Data Protection Act 2018 and the ePrivacy Regulations 2011. Anyone — whether they live in Ireland or elsewhere in the EU — can lodge a complaint with the DPC if an Irish-established organisation (or one that targets Irish residents) has breached their privacy rights.

The DPC has three main powers relevant to complainants:

• Investigation: It can compel organisations to produce documents, interview staff, and audit systems.
• Corrective action: It can order a controller to comply with your rights (e.g. delete data, honour access requests).
• Administrative fines: Up to €20 million or 4% of global annual turnover, whichever is higher.

When Can You File a Complaint With the DPC?

You can file a complaint any time you believe an organisation has infringed your data protection rights under the GDPR or Irish law. Common grounds include:

• An organisation ignored or refused your Subject Access Request (SAR).
• Your request to erase, correct or restrict data was refused without valid reason.
• You received unsolicited marketing (emails, SMS, calls) after opting out.
• Your data was subject to a breach and you were not properly notified.
• A website set cookies or trackers without valid consent.
• An employer, landlord, hospital, school or public body misused your information.
• A company is engaged in unlawful profiling or automated decision-making.

Try to Resolve It Directly First

The DPC strongly prefers that complainants first contact the organisation directly — ideally the Data Protection Officer (DPO). Under Article 12 GDPR, the controller must respond to your request within one month. Only after that month has lapsed (or you receive an unsatisfactory reply) should you escalate to the DPC. Keep copies of every email you send — these form the backbone of your complaint file.

Step-by-Step: How to File a Complaint With the DPC Ireland

Filing a privacy complaint is free. There is no need for a solicitor, although you may use one. Here is the full process:

1. Gather your evidence. Collect emails, screenshots, letters, dates, and a clear timeline of events. Note the full legal name of the organisation and any reference numbers.
2. Contact the organisation. Send a written request citing the specific GDPR right you are invoking (e.g. Article 15 for access, Article 17 for erasure). Give them one calendar month to respond.
3. Prepare a written statement. Summarise what happened, what you asked for, how the organisation responded, and what outcome you want from the DPC.
4. Choose a submission method. You can file by webform, email or post (details below).
5. Submit your complaint. Attach all supporting documents in PDF where possible.
6. Receive acknowledgement. The DPC will send a reference number, usually within 5–10 working days.
7. Engage with the case handler. A caseworker may ask for clarification or additional evidence.
8. Await the outcome. This can be an amicable resolution, a formal decision, or in large cross-border matters, a full statutory inquiry.

Where to Submit Your Complaint

The DPC offers multiple submission channels. Choose the one that suits your situation.

Method	Details	Best For
Online webform	Available at dataprotection.ie under "Contact / Raise a Concern"	Most individuals; fastest
Email	info@dataprotection.ie	Complaints with many attachments
Post	Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28	Those without digital access or sending originals
Phone	+353 (0)761 104 800	Initial guidance (complaints must still be in writing)

What to Include in Your Written Complaint

A well-structured complaint accelerates the DPC's handling. Include:

• Your full name, postal address, email and phone number.
• The name and address of the organisation you are complaining about.
• A chronological summary of events.
• Copies of all correspondence with the organisation.
• The specific GDPR articles or Irish law provisions you believe were breached.
• The outcome you are seeking (erasure, access, compensation, enforcement).
• A signed declaration that the information is true to the best of your knowledge.

What Happens After You File?

The DPC follows a defined complaint-handling procedure set out in Section 109 of the Data Protection Act 2018. The stages are:

1. Initial Assessment

A caseworker reviews the complaint to check it is within the DPC's remit. If it concerns a non-EU company with no Irish establishment, they may transfer it to the correct supervisory authority.

2. Amicable Resolution

Under Section 109(3), the DPC will try to broker a solution between you and the organisation. This is the most common outcome and often results in the data being deleted, access being granted, or marketing being stopped. Expect this stage to take 2–6 months.

3. Formal Inquiry

If amicable resolution fails or the matter is serious, the DPC can launch a statutory inquiry. This can result in reprimands, compliance orders, bans on processing, or large administrative fines. Complex cross-border inquiries can take 18 months or longer.

4. Legally Binding Decision

At the end of an inquiry, the DPC issues a decision. Both you and the organisation have a right of appeal to the Irish Circuit Court or High Court within 28 days.

Cross-Border Complaints and the One-Stop-Shop

Because many multinationals have their EU HQ in Dublin, the DPC is often the Lead Supervisory Authority under the GDPR's "one-stop-shop" mechanism. If you live in Germany but complain about Meta, for example, your local authority (the BfDI or a Land authority) will typically forward the case to the DPC. You can also file directly with the DPC regardless of where you live in the EU.

Landmark DPC decisions under this mechanism include multi-hundred-million-euro fines against Meta, WhatsApp, TikTok and LinkedIn for issues ranging from unlawful behavioural advertising to insufficient transparency with children's data.

Common Mistakes That Delay Complaints

Caseworkers at the DPC have cited the following issues as the main causes of delay:

• No prior contact with the organisation. The DPC will usually refer you back to attempt this first.
• Vague allegations. "They have my data" is not enough — specify what data, when and how it was misused.
• No documentary evidence. Screenshots, emails and reference numbers make or break a case.
• Wrong regulator. Scam calls from abroad, for instance, may be a matter for ComReg or An Garda Síochána, not the DPC.
• Expecting compensation. The DPC cannot award damages — that is a matter for the civil courts under Article 82 GDPR.

Protecting Your Privacy Proactively

Complaints are a remedy after harm has occurred. Proactive steps are far more effective. Practical measures Irish residents can take include:

• Use encrypted DNS (DNS over HTTPS) in your browser to reduce passive tracking by your network provider.
• Prefer privacy-respecting browsers such as Firefox or Brave, and keep tracker-blocking extensions up to date.
• Avoid sharing raw URLs that embed tracking parameters — use a privacy-focused shortener like Lunyb which does not log personally identifying metadata and strips UTM-style trackers by default. If you want a deeper look at how it handles data, see our honest review of Lunyb.
• Review cookie banners carefully — under Irish ePrivacy rules, "reject all" must be as easy as "accept all".
• Request regular SARs from services you use to see what they hold.

For teams and marketers choosing link tools in the EU, our 2026 buyer's guide to URL shorteners and our Rebrandly review discuss GDPR considerations in detail.

Timelines at a Glance

Stage	Typical Duration	Who Acts
Response from organisation to your request	1 month (extendable to 3 for complex cases)	Controller / DPO
DPC acknowledgement of complaint	5–10 working days	DPC intake team
Amicable resolution attempt	2–6 months	DPC caseworker
Formal inquiry (domestic)	6–18 months	DPC investigators
Cross-border inquiry	12–36 months	DPC + EDPB
Appeal window after decision	28 days	Complainant / controller

Frequently Asked Questions

Is it free to file a complaint with the DPC Ireland?

Yes. Lodging a complaint with the DPC is entirely free of charge, and you do not need a solicitor. Only if you later pursue civil damages through the courts would legal costs typically arise.

Can I complain to the DPC if I don't live in Ireland?

Yes. Any EU resident can lodge a complaint with the DPC where the organisation concerned has its main establishment in Ireland. You can also file via your local supervisory authority, which will forward the case under the one-stop-shop mechanism.

How long does a DPC complaint take to resolve?

Straightforward complaints handled by amicable resolution typically take between two and six months. Formal statutory inquiries, particularly cross-border ones involving large tech platforms, routinely take 12 to 36 months due to the EDPB consultation process required under Article 60 GDPR.

Can the DPC order a company to pay me compensation?

No. The DPC can issue reprimands, corrective orders and administrative fines (which go to the Exchequer), but it cannot award personal compensation. To claim damages for material or non-material harm, you must bring a civil action under Article 82 GDPR in the Circuit or High Court.

What if the DPC rejects my complaint?

You have a right under Article 78 GDPR to an effective judicial remedy. In Ireland, you can appeal a DPC decision to the Circuit Court (for most matters) or the High Court (for statutory inquiries) within 28 days of receiving the decision in writing.

Final Thoughts

The DPC Ireland is one of the most consequential privacy regulators in the world, and its complaints process is deliberately accessible — you do not need legal training to use it. The keys to a successful complaint are simple: contact the organisation first, document everything, cite the specific right you are enforcing, and be patient with the process. Combined with sensible proactive privacy habits, filing a complaint when necessary is one of the most powerful tools EU residents have to hold organisations accountable.