Complaints to the Data Protection Commission

What the DPC can do for you, what it cannot, and how to complain in a way that gets somewhere.

The Data Protection Commission is Ireland's supervisory authority for data protection — and because so many global platforms have their EU base here, one of the most consequential regulators in Europe. For individuals it is the free, accessible route when an organisation infringes your rights: ignores your access request, mishandles a breach, refuses erasure, points a camera where it should not.

One fact should frame every complaint decision: the DPC cannot award you compensation. It can investigate, direct organisations to comply, and impose sanctions including substantial fines — but money for your damage comes only from a court action. Complaint and claim are different tools, and the strategy is choosing the right one, or both.

What the DPC can actually do

On a complaint, the DPC can examine the organisation's conduct, require answers, seek amicable resolution (a large share of individual complaints resolve this way — the organisation suddenly finds your access request answerable), issue directions and decisions on infringement, and in enforcement contexts impose corrective measures and administrative fines that scale to the seriousness of the breach.

For the individual complainant, the realistic wins are: your rights finally honoured, a finding that the organisation infringed, and systemic correction so it stops happening. Those are genuine outcomes — they are simply not damages.

Complaining effectively

Complain to the organisation first and keep the correspondence: the DPC expects to see that you raised the issue and what came back. Then complain through the DPC's channels with a tight chronology — dates, what right was engaged, what was asked, what was refused or ignored — and the documents attached in order.

Precision beats volume. A complaint that says 'my access request of 3 March received no response within one month and no extension notice' hands the DPC an open-and-shut infringement; ten pages of grievance without dates hands it a filing problem. Frame the outcome you want: compliance, a finding, correction.

Timelines and expectations

Set expectations honestly: the DPC handles a very large volume of complaints, simple matters channelled to amicable resolution can conclude in months, and contested or complex matters run far longer. The process is free, and you can be legally represented within it — often worth it where the complaint underpins a planned compensation claim and the finding needs to be built properly.

If you are dissatisfied with how the DPC handles or concludes a complaint, review mechanisms exist through the courts — a specialised area where advice is essential before deadlines pass.

Complaint, claim, or both

Run a complaint alone where what you want is compliance and correction, and the damage to you is limited. Run a court claim where real damage — financial or genuine distress — needs compensating. Run both where the case is serious: the complaint disciplines the organisation and can yield findings that support the claim, while the claim secures the remedy the DPC cannot give. Sequencing and limitation periods interact, so take advice early rather than letting the complaint run for a year before considering the claim.

Frequently asked questions

Does complaining to the DPC cost anything?

No — the complaint process is free. Legal representation is optional; it earns its place where the complaint is complex or is being built to support a compensation claim.

Can the DPC get me compensation?

No. The DPC can direct compliance, make findings and impose sanctions on the organisation, but compensation for your damage is available only through a court action under the Data Protection Act 2018.

Do I have to complain to the organisation before the DPC?

As a matter of practice, yes — raise it with the organisation first and keep the exchange. The DPC expects to see that step, and the organisation's response (or silence) becomes part of your complaint.

How long does a DPC complaint take?

Honestly: simple complaints resolved amicably can conclude in months; contested or complex matters take considerably longer. Build that timeline into your strategy, particularly if a court claim may follow.

Can I go to court without complaining to the DPC first?

Yes — a DPC complaint is not a precondition to a data protection action. Whether to run one, the other or both is a strategic choice based on what you need: correction, compensation, or both.

Talk to a GDPR solicitor

Mary Molloy Solicitors acts for individuals and organisations across Ireland on data protection matters — access requests, breaches, compensation claims, complaints and compliance. All enquiries are handled through our Dublin office.

This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.