Can I report someone to the Data Protection Commission?
Yes — any individual can raise a concern with the Data Protection Commission about how an organisation handled their personal data. This covers access requests, direct marketing and data breaches. A data controller must answer a Subject Access Request (SAR) without undue delay and within 1 month. Generally you should first raise the matter with the organisation; if you get no or an unsatisfactory response, you can complain to the DPC via its online form at forms.dataprotection.ie, attaching your access request and any reminder. The DPC must give you an update or outcome within 3 months, with periodic updates if it runs longer. The DPC first tries amicable resolution; fines arise only from a formal inquiry into serious failings. In short: yes — usually after contacting the organisation first.
📋 The rules
- Anyone can raise a concern with the DPC
- Covers access requests, marketing, breaches
- A SAR must be answered within 1 month
- First contact the organisation, then the DPC
- The DPC reports an outcome within 3 months
🔓 Exceptions
- A 'reasonable fee' can apply to excessive or repeat SARs
- The 1-month SAR deadline can extend by 2 months if complex
- Pre-2018 processing falls under the older Data Protection Acts
⚠️ Penalties & fines
The DPC can issue reprimands, enforcement notices, orders, and administrative fines of up to €20 million or 4% of global annual turnover, whichever is higher. A SAR must be answered within 1 month (extendable by 2 more for complex requests), and is free unless the request is manifestly unfounded, excessive or repetitive, when a reasonable fee may apply. The DPC must provide an update or outcome within 3 months. Beware a myth: "you can go straight to the DPC and they'll fine the company" is false — the DPC is first mandated to attempt amicable resolution; most cases are resolved that way, and fines arise only from a formal inquiry into serious or systemic failings. To complain: contact the organisation first, then submit the DPC's online concern form with your evidence.
📎 Official sources
- DPC — complaints handling, investigations and enforcement →
- DPC — raising a concern with the Commission →
- Citizens Information — your rights under GDPR →
❓ Frequently asked
How do I complain about misuse of my data?
You can raise a concern with the Data Protection Commission about how an organisation handled your personal data — for example over an access request, direct marketing, or a data breach. Generally, you should first raise the matter directly with the organisation. If they don't respond or you're unsatisfied, you can then complain to the DPC using its online form.
What is a Subject Access Request?
A Subject Access Request, or SAR, is a request to an organisation for a copy of the personal data it holds about you. The organisation must respond without undue delay and within one calendar month. SARs are generally free, though a reasonable fee can apply if a request is manifestly unfounded, excessive or repetitive.
Do I have to contact the organisation first?
Usually yes. The Data Protection Commission generally expects you to raise your concern directly with the organisation first and give them a chance to resolve it. If you get no response, or you're not satisfied with how they handled it, you can then bring the matter to the DPC, ideally with copies of your request and any reminders.
How long does the DPC take?
The Data Protection Commission is obliged to give you an update or an outcome report within three months of your concern, with periodic updates if the matter takes longer. Many issues are resolved through amicable resolution at an early stage. More serious or systemic problems may lead to a formal inquiry, which can take considerably longer.
Can the DPC fine the organisation?
Yes, but not as a first step. The DPC can impose administrative fines of up to €20 million or 4% of global annual turnover, whichever is higher, along with reprimands and enforcement notices. However, it's first required to try amicable resolution, and fines generally arise only after a formal inquiry into serious or systemic breaches.
🔎 Common searches
What people search to land here:
- “data protection complaint ireland”
- “report to dpc ireland”
- “subject access request ireland”
- “gdpr complaint ireland”
- “dpc subject access 1 month”
- “data breach complaint ireland”