DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If your personal data has been mishandled by a company, charity, or public body operating in Ireland, you have the right to complain to the Data Protection Commission (DPC). The DPC is Ireland's independent supervisory authority for data protection, and it handles complaints under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018. This guide walks you through exactly how to file a complaint, what to expect, and how to maximise your chances of a successful outcome.

What is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's national data protection authority, established under the Data Protection Act 2018. It is responsible for upholding the fundamental right of individuals in the EU to have their personal data protected, and for enforcing the GDPR within Ireland.

Because many of the world's largest technology companies — including Meta, Google, Apple, TikTok, Microsoft, and LinkedIn — have their European headquarters in Dublin, the DPC acts as the lead supervisory authority for a huge proportion of cross-border data protection cases in the EU. This gives decisions from the DPC particular weight across the entire European Economic Area (EEA).

What the DPC can and cannot do

The DPC can:

Investigate complaints about how your personal data is handled.
Issue reprimands, warnings, and binding orders against controllers.
Impose administrative fines of up to €20 million or 4% of global annual turnover.
Order an organisation to stop processing your data or to erase it.

The DPC cannot:

Award you financial compensation (you must pursue that through the courts).
Deal with complaints that fall outside data protection law (e.g., general consumer disputes).
Act as a legal representative for you.

When Should You File a Complaint with the DPC?

You can file a complaint with the DPC whenever you believe an organisation has infringed your data protection rights under the GDPR or Irish law. Common grounds include situations where a controller has failed to respond, processed data unlawfully, or ignored a formal request.

Common reasons to complain

Unanswered subject access request (SAR): You asked for a copy of your personal data and received nothing within one month.
Refusal to delete data: You exercised your right to erasure and were ignored or refused without valid reason.
Unlawful marketing: You received unsolicited emails, SMS, or calls after withdrawing consent.
Data breach: An organisation exposed your personal information and failed to notify you.
Excessive data collection: A service is collecting more data than it needs for its stated purpose.
Cookies and tracking: A website is placing non-essential cookies without valid consent.
CCTV misuse: A neighbour, employer, or business is recording you inappropriately.

Try to resolve it directly first

The DPC strongly encourages complainants to raise the issue with the organisation before escalating. Under GDPR, every controller must respond to a data subject request within one calendar month (extendable by two further months for complex requests). If you skip this step, the DPC may ask you to go back and try again before opening a formal investigation.

Step-by-Step: How to File a Complaint with the DPC

Filing a complaint is free, and you do not need a solicitor. Follow these steps carefully to give your case the best chance of being investigated.

Contact the organisation directly. Write to the company's Data Protection Officer (DPO) or privacy contact. Clearly state what you want (access, deletion, correction, etc.) and give them the full statutory period of one month to respond.
Keep records of everything. Save emails, letters, screenshots, timestamps, and any reference numbers. These will become evidence in your DPC complaint.
Wait for the deadline to pass. If the organisation misses the one-month deadline or gives an inadequate response, you have grounds to escalate.
Prepare your complaint documents. Gather a clear written description of what happened, copies of your correspondence, and any evidence (screenshots, emails, letters).
Submit your complaint to the DPC. Use the official complaint form on dataprotection.ie, or send a detailed letter or email. Include your full name, contact details, the organisation's name, and what remedy you are seeking.
Acknowledge and engage. The DPC will acknowledge your complaint, usually within a few working days, and may request additional information. Respond promptly.
Follow the investigation. The DPC may offer amicable resolution, conduct a formal inquiry, or make a binding decision. This can take anywhere from a few weeks to several years for complex cross-border cases.

How to Submit Your Complaint: Channels and Contact Details

The DPC accepts complaints through several channels. Choose the one that best suits your situation, but written submissions are strongly preferred because they create a clear paper trail.

Channel	Best For	Details
Online webform	Most complaints	Available at dataprotection.ie — guided questions, file uploads supported.
Email	Detailed complaints with attachments	info@dataprotection.ie
Postal mail	Formal or sensitive complaints	Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28
Phone	General questions only	+353 (0)761 104 800 — not for formal complaint submission

What to include in your written complaint

Your full name, postal address, email, and phone number.
The name and address of the organisation you are complaining about.
A clear, chronological description of the issue.
Copies of any requests you made (SAR, erasure, etc.) and the organisation's responses.
Specific GDPR articles you believe were breached (optional but helpful — e.g., Article 15 for access, Article 17 for erasure).
What outcome you would like (deletion, correction, cessation of processing, formal reprimand).

What Happens After You File?

Once your complaint is submitted, the DPC follows a structured handling process. Understanding each stage helps set realistic expectations.

Stage 1: Assessment and acknowledgement

The DPC confirms receipt, usually within 5–10 working days, and assigns a case reference. A case officer reviews whether the complaint falls within the DPC's remit and whether you have attempted direct resolution.

Stage 2: Amicable resolution

For most complaints, the DPC first attempts amicable resolution. This means the case officer contacts the organisation on your behalf and seeks a practical outcome — typically disclosure of data, deletion, or an apology. Many cases close at this stage without needing a formal inquiry.

Stage 3: Statutory inquiry

If amicable resolution fails or the matter is serious, the DPC may open a formal inquiry under Section 110 of the Data Protection Act 2018. This can result in:

A legally binding decision.
Corrective orders (stop processing, erase data, bring processing into compliance).
Administrative fines.
Referral to the European Data Protection Board (EDPB) for cross-border cases.

Stage 4: Appeal

If you disagree with the DPC's final decision, you have the right to appeal to the Circuit Court or, in some cases, the High Court within 28 days of the decision.

Realistic Timelines: How Long Does It Take?

DPC complaint timelines vary enormously depending on complexity. Straightforward complaints against Irish businesses may be resolved in weeks, while large cross-border inquiries against global tech firms can take years.

Complaint Type	Typical Timeline
Simple access request dispute (local business)	1–3 months
Marketing / cookie complaint	3–6 months
CCTV or workplace monitoring	4–9 months
Data breach investigation	6–18 months
Cross-border Big Tech inquiry	2–5+ years

Tips to Strengthen Your Complaint

A well-prepared complaint is far more likely to progress quickly. Case officers at the DPC handle thousands of files per year, so clarity matters.

Do

Be concise and factual — stick to a timeline of events.
Attach primary evidence (emails, screenshots, letters) rather than paraphrasing.
Cite the specific GDPR right that was breached if you can.
State clearly what remedy you want.
Respond quickly when the case officer requests more information.

Don't

Submit an emotional or accusatory narrative without evidence.
File before giving the organisation its one-month response period.
Expect financial compensation from the DPC — pursue that separately in court.
Submit duplicate complaints across multiple channels.

Protecting Your Privacy Going Forward

Filing a complaint is a reactive step. Reducing how much personal data you expose in the first place is just as important. A few practical habits:

Use privacy-focused tools that do not log more than they need. For example, when sharing links, a privacy-respecting shortener like Lunyb avoids building detailed profiles of who clicks what.
Use encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) to reduce passive tracking by your network provider.
Review app permissions regularly on iOS and Android.
Submit annual access requests to services you use heavily — it tells you what they actually hold.
Keep a personal "data diary" of where you've signed up, so you know who to contact when things go wrong.

If you're researching link-sharing tools with better transparency, our honest review of Lunyb and our breakdown of alternatives in the Rebrandly 2026 review may be useful starting points.

Special Cases: Cross-Border and Children's Data

Cross-border complaints

If your complaint involves a company whose European headquarters is in Ireland (such as Meta, TikTok, or Google), the DPC acts as lead supervisory authority under the GDPR's one-stop-shop mechanism. You can either file directly with the DPC or file with your own national data protection authority, which will then transfer the case to Dublin.

Complaints involving children

The DPC has published the Fundamentals for a Child-Oriented Approach to Data Processing, which sets a high bar for any service used by under-18s. Parents and guardians can file complaints on behalf of children, and the DPC treats these cases as a priority area.

Frequently Asked Questions

Is it free to file a complaint with the DPC?

Yes. Filing a data protection complaint with the DPC is completely free of charge. You do not need a solicitor, although legal advice may be useful for complex or high-value cases that you may want to pursue through the courts later.

Can I file a DPC complaint if I don't live in Ireland?

Yes. Because many multinational companies have their European headquarters in Dublin, anyone in the EU or EEA can complain to the DPC about those companies. You can also submit the complaint through your local data protection authority, which will forward it under the one-stop-shop mechanism.

How long does the DPC take to investigate a complaint?

Simple domestic complaints are usually resolved within one to six months. Larger cross-border inquiries, especially against major technology platforms, can take several years due to the statutory procedures, consultations with other EU authorities, and potential appeals.

Can the DPC award me compensation?

No. The DPC can order organisations to change their behaviour, impose fines, and issue reprimands, but it cannot award you personal compensation. For damages, you would need to bring a separate action in the Irish courts under Section 117 of the Data Protection Act 2018.

What if I'm unhappy with the DPC's decision?

You have the right to appeal the DPC's final decision to the Circuit Court (for decisions below a certain threshold) or the High Court within 28 days. You can also complain to the Office of the Ombudsman if you believe the DPC handled your case improperly from an administrative standpoint.