DPC Ireland: How to File a Privacy Complaint (2026 Guide)

If an organisation has mishandled your personal data, you have the right to make a formal complaint to the Data Protection Commission (DPC), Ireland's national supervisory authority for data protection. Because many of the world's largest technology companies are headquartered in Dublin, the DPC plays a role that extends far beyond Ireland's borders — but its core mission is protecting the rights of individuals under the GDPR and the Irish Data Protection Act 2018.

This guide explains exactly how to file a privacy complaint with the DPC, what information you need to include, what happens after you submit, and realistic expectations around timelines and outcomes.

What Is the Data Protection Commission (DPC)?

The Data Protection Commission is Ireland's independent authority responsible for upholding the fundamental right of individuals in the EU to have their personal data protected. Established under the Data Protection Act 2018, the DPC enforces the EU General Data Protection Regulation (GDPR), the Law Enforcement Directive, and the ePrivacy Regulations.

Because major platforms such as Meta, Google, TikTok, LinkedIn, X and Apple have their European headquarters in Ireland, the DPC acts as the lead supervisory authority for a large share of cross-border data protection cases in the EU under the "one-stop-shop" mechanism.

When You Can Complain to the DPC

You can lodge a complaint with the DPC if you believe an organisation has:

• Processed your personal data unlawfully or unfairly
• Refused or ignored a valid Subject Access Request (SAR)
• Refused to erase, correct or restrict your data when you had a right to request it
• Sent unsolicited marketing emails, SMS or calls without consent
• Shared your data with third parties without a lawful basis
• Suffered a data breach that was not properly handled
• Failed to respond to a data protection query within one month

Before You File: Try to Resolve It Directly First

The DPC strongly encourages — and in most cases expects — that you first raise the issue directly with the organisation (the "data controller") before escalating. This isn't just a formality; it often leads to a faster resolution and strengthens your eventual complaint if the matter escalates.

Step 1: Identify the Data Controller

The data controller is the organisation that decides how and why your data is processed. Their contact details should be in the company's privacy policy, usually under a heading like "Contact Us" or "Data Protection Officer".

Step 2: Contact Their Data Protection Officer (DPO)

Larger organisations must appoint a DPO. Write to them explicitly stating:

1. Your full name and the account/reference that identifies you
2. The right you are exercising (e.g., Article 15 access, Article 17 erasure)
3. A clear description of the issue
4. The outcome you want
5. A deadline (one month is the legal maximum for most GDPR requests)

Step 3: Wait for the Statutory Response Period

Under GDPR Article 12(3), controllers must respond within one calendar month. They may extend this by two further months for complex requests, but they must tell you within the first month.

If they fail to respond, respond inadequately, or refuse your request without lawful justification — that is when you escalate to the DPC.

How to File a Complaint with the DPC: Step by Step

The DPC accepts complaints through several channels. The fastest and most organised route is the official webform, but postal and email submissions are also valid.

Option 1: Online Webform (Recommended)

1. Go to dataprotection.ie and navigate to "Contact Us" → "Raise a Concern".
2. Select the category that best describes your issue (access request, erasure, marketing, breach, etc.).
3. Fill in your personal details so the DPC can verify your identity and contact you.
4. Describe the organisation and issue clearly in plain language.
5. Upload supporting evidence (see the checklist below).
6. Submit and keep the reference number the DPC sends you by email.

Option 2: Email

Send your complaint to info@dataprotection.ie. Attach the same documentation you would upload via the webform. Use a clear subject line such as "Formal Complaint under GDPR Article 77 — [Organisation Name]".

Option 3: Post

Write to the DPC at:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland

The DPC also has an office in Portarlington for certain functions, but Dublin is the main complaints address.

What to Include in Your Complaint

A well-prepared complaint is more likely to be investigated quickly and effectively. Include all of the following:

Item	Why It Matters
Your full name, address and contact details	DPC must verify your identity
Name and address of the organisation	Identifies the data controller
Dates of relevant events	Establishes timeline and whether it is in time
Clear description of what happened	Allows the DPC to assess the issue
Which GDPR right you believe was breached	Frames the legal basis
Copies of correspondence with the organisation	Shows you tried to resolve it directly
Supporting evidence (screenshots, emails, letters)	Backs up your claims
Outcome you are seeking	Guides what resolution looks like

What Happens After You File

The DPC follows a defined process once a complaint is received. Understanding this process helps set realistic expectations.

Stage 1: Acknowledgement and Triage

You should receive an acknowledgement within a few working days, with a case reference. A case officer reviews whether the complaint is within the DPC's remit and whether more information is needed.

Stage 2: Amicable Resolution

For most straightforward complaints, the DPC will contact the organisation and attempt to resolve the matter without a formal inquiry. This is often successful — especially for access requests and marketing issues — and can conclude in weeks rather than years.

Stage 3: Statutory Inquiry

If amicable resolution fails or the matter is serious (large-scale breach, systemic issue, cross-border case), the DPC may open a statutory inquiry under Section 110 of the Data Protection Act 2018. These are formal investigations that can take many months or, for complex cross-border cases, several years.

Stage 4: Decision

The outcome can range from a reprimand, to an enforcement order requiring the organisation to change its practices, to an administrative fine of up to €20 million or 4% of global annual turnover under GDPR Article 83.

Realistic Timelines and Expectations

The DPC handles tens of thousands of queries and thousands of formal complaints each year. Based on their annual reports:

• Simple complaints (e.g., marketing emails, basic access requests): often resolved in 2–6 months.
• Complex national complaints: 6–18 months.
• Cross-border inquiries involving Big Tech: 1–5+ years, due to the Article 60 cooperation mechanism with other EU supervisory authorities.

You will not necessarily receive updates at every stage, but you are entitled to be informed of the progress and outcome.

Your Rights During the Process

As a complainant, you have specific rights under GDPR Article 77 and 78:

• The right to be informed of the progress and outcome of your complaint
• The right to an effective judicial remedy if the DPC does not handle your complaint or inform you within three months
• The right to appeal a DPC decision to the Circuit Court or High Court
• The right to seek compensation from the organisation under Article 82

Common Types of Complaints the DPC Handles

Subject Access Request (SAR) Refusals

This is the single most common complaint. If a company ignores or inadequately responds to your request for a copy of your personal data, the DPC will almost always intervene.

Unsolicited Marketing

Under the ePrivacy Regulations 2011 (S.I. 336/2011), unsolicited electronic marketing is a criminal offence in Ireland. The DPC has prosecuted dozens of companies for repeated breaches.

CCTV and Workplace Surveillance

Complaints about disproportionate CCTV coverage, covert recording, or employee monitoring are regularly investigated.

Data Breaches

If you were affected by a breach and the organisation failed to notify you, or failed to protect your data adequately, this falls squarely within the DPC's remit.

Reducing Your Exposure in the First Place

Filing a complaint is a reactive step. Taking a more privacy-conscious approach to the tools you use day-to-day can reduce how often you need to invoke your GDPR rights at all.

For example, when you share links — whether on social media, in email signatures, or on business cards — the shortener you choose can expose your click data, IP addresses and referrer information to third parties. Privacy-respecting tools such as Lunyb minimise the data collected and retained when you share shortened URLs, which is a simple way to reduce the trail of personal data you leave behind. You can read more in our honest review of Lunyb or compare alternatives in our Rebrandly review.

Similarly, using encrypted DNS resolvers, privacy-respecting browsers, and reviewing app permissions regularly will all cut down on the volume of personal data circulating about you — and therefore the number of situations where a complaint becomes necessary.

When the DPC Isn't the Right Body

Not every privacy issue falls within the DPC's remit. Consider other avenues when:

• The organisation is based in another EU country — you may still file with the DPC, but the lead supervisory authority will be in that country.
• The issue relates to defamation or harmful content — Coimisiún na Meán may be more appropriate for online safety matters.
• The matter is a consumer rights issue rather than a data protection one — the Competition and Consumer Protection Commission (CCPC) handles those.
• Criminal activity is involved (e.g., identity theft) — report to An Garda Síochána in parallel.

FAQ

Is there a fee to file a complaint with the DPC?

No. Filing a complaint with the Data Protection Commission is completely free of charge, whether you submit online, by email or by post. You do not need a solicitor, although for complex or high-value matters legal advice can be helpful.

How long do I have to file a complaint?

There is no strict statutory time limit, but the DPC generally expects complaints to be made within a reasonable period after the issue — typically within 12 months of the event or of becoming aware of it. The sooner you file after exhausting direct contact with the organisation, the better.

Can I complain anonymously?

Formal complaints require your identity so the DPC can investigate and respond to you. However, you can share general concerns or tip-offs anonymously, which the DPC may use as intelligence to open its own-volition inquiry, especially for systemic issues.

Can I complain to the DPC about an organisation outside Ireland?

Yes, if the organisation has its main EU establishment in Ireland (as many large tech firms do), the DPC is the lead authority. For organisations based elsewhere in the EU, you can still file with the DPC, which will coordinate with the relevant supervisory authority under GDPR's one-stop-shop mechanism. For non-EU organisations targeting EU residents, the DPC can still investigate.

What if I'm unhappy with the DPC's decision?

You have the right to appeal a legally binding DPC decision to the Circuit Court within 28 days of being notified. For more significant cases you may appeal to the High Court. You can also complain to the Office of the Ombudsman if you believe the DPC itself handled your case improperly from a procedural standpoint.