← FFCheckWho do I contact?EN
Privacy · Ireland
Updated September 2026

🔐 A company leaked or misuses my data — who do I report it to?

Direct answer

Under the GDPR you can demand from any company what it holds on you, correction and deletion, and it must answer within a month. Write to the company's data protection officer first. If it ignores you, misuses your data or lost it in a breach, complain to Data Protection Commission (DPC) (01 765 0100) — the data protection authority in Ireland; it investigates and fines, free of charge. Identity misuse after a leak: also the police, An Garda Síochána (garda.ie), and your bank.

Call firstData Protection Commission (DPC)
Report toAn Garda Síochána
If that failsCCPC

🗣️ What to say

"Under Article 15 GDPR I request a copy of all personal data you hold on me, its sources and recipients, within one month. Under Article 17 I request deletion of [what]. Please confirm in writing."

🪜 Step by step

  1. Write to the companyAccess request (Art. 15), deletion (Art. 17) or objection (Art. 21). One month to answer; keep the date.
  2. Collect proofThe e-mails, the breach notification, screenshots of the misuse, unsolicited calls or mails that show your data was passed on.
  3. Complain to Data Protection Commission (DPC)Online form. Attach your request and the non-answer. The authority contacts the company and can order and fine.
  4. Identity misuse: An Garda SíochánaIf someone opened accounts or bought in your name after a leak, report it to the police and tell your bank.
  5. DamagesGDPR gives a right to compensation for material and non-material damage; consumer organisations run collective claims after large breaches.

📇 All contacts

Data Protection Commission (DPC)Complaints against companies, investigations, finesWhen the company does not answer within a month or misuses data📞 01 765 0100🔗 www.dataprotection.ie
An Garda SíochánaReport identity misuseWhen accounts or orders were made in your name🔗 www.garda.ie/en/crime/fraud
CCPCConsumer rights after a breachFor refunds and cancellations linked to the breach📞 01 402 5555🔗 www.ccpc.ie

❓ Frequently asked

The company says it needs my data for "legitimate interest"

You can object (Art. 21); for direct marketing the objection is absolute — they must stop.

How long does the authority take?

Months, sometimes longer; but a complaint on file is what forces the company to answer, and fines follow patterns of complaints.

I keep getting spam calls

Register on the national do-not-call list where it exists, object to the caller in writing, and report the number to Data Protection Commission (DPC).

📎 Sources

Last checked: 2026-09-26

🔎 Common searches

Recognise your own search? The answer above covers all of these.

  • “report data breach Ireland”
  • “data protection authority Ireland”
  • “GDPR complaint company”
  • “company won't delete my data”
  • “identity theft after data leak”

🧭 Is this still correct?

We check this information carefully, but phone numbers, websites and rules change — and sometimes we get something wrong. Spotted a mistake or a change? Let us know below.

🔗 Related questions

💳Scammed online→🆔Identity theft→

Your tools for Ireland

Before it goes wrongCan I?What is allowed, what is not, which permit you need — with the official source.Energy · IrelandElectricity & gasThe rules that protect you as an electricity and gas customer in Ireland, and who to contact. Every fact is checked on an official source.Recognise it firstIs dit veilig?Check a phone number, website or message against 47,000 scam dossiers.