GDPR Complaint Against Your Business in Ireland: How the DPC Process Works and How to Respond
Last updated November 2026. General information only, not legal advice.
A GDPR complaint in Ireland usually starts with a letter from a customer or employee saying you mishandled their personal data, or an email from the Data Protection Commission (DPC) saying it has received a complaint about your business. Most are resolved by correspondence and amicable resolution, and the businesses that come out well respond on time and keep records. This guide explains how a complaint is lodged, how the DPC handles it under the Data Protection Act 2018, and the possible outcomes.
GDPR complaint Ireland: how a complaint reaches the DPC
Article 77 GDPR gives every individual the right to complain to a supervisory authority if they believe the processing of their data infringes the Regulation. In Ireland that is the DPC, which recommends that the individual first raises the concern with the organisation in writing and asks for a written response; many issues are settled at that stage. If not satisfied, they complete the DPC’s webform or email the DPC, attaching the correspondence exchanged with you. See the DPC’s guidance on what to do before complaining. Your first reply will end up in front of the DPC, so write it with that in mind.
How the DPC complaint process works
Acknowledgement and assessment
Under section 108 of the 2018 Act the DPC must promptly acknowledge the complaint in writing and inform the complainant of its progress or outcome within three months. Its Customer Charter aims to acknowledge within three working days and complete an initial assessment within 20 working days, checking first that your business actually processes the complainant’s data and that a GDPR infringement is alleged.
Amicable resolution
Section 109(2) lets the DPC facilitate an amicable resolution where one is reasonably likely within a reasonable time. The DPC calls it voluntary but “often the quickest way of getting to the root of the issue”. If a resolution is reached, the complaint is treated as withdrawn (section 109(3)).
Formal handling, reprimands and inquiries
If no resolution is possible, section 109(5) lists the DPC’s options: reject or dismiss the complaint, advise the complainant, serve an enforcement notice requiring you to comply with a rights request or rectify, erase or restrict data, issue a reprimand, cause an inquiry to be conducted, or take other appropriate action. Complaints are handled on principles of natural justice: you are told what is alleged and can respond.
Section 110 allows an inquiry, of the DPC’s own volition or following a complaint, which can end in a binding decision and fines. The DPC can serve an information notice under section 132, normally with at least 28 days to comply (seven if urgent); non-compliance without reasonable excuse is an offence. If you are established in more than one Member State, or your processing substantially affects people in several, the “one-stop-shop” applies and the authority of your main establishment leads.
Your obligations when the individual writes to you
If the complaint concerns a rights request such as access or erasure, Article 12(3) GDPR requires you to act without undue delay and within one month of receipt. You may extend by two further months for complex or numerous requests, but must tell the individual why within the first month. If you refuse, Article 12(4) requires you to say why within one month and to tell them they can complain to the DPC. See our guide to a data subject access request in Ireland. Keep a dated record of the request, what you provided or withheld and why, and your reply.
What to prepare when the DPC writes
Gather:
- A chronology of your dealings with the complainant, with all correspondence.
- Your privacy notice as it stood at the time and the lawful basis relied on.
- Your record of processing activities (ROPA) under Article 30. The under-250-employee exemption does not cover regular HR or payroll processing or special category data, and the DPC’s guidance says you should be able to produce the record within ten days.
- Your data protection policy, retention schedule, subject rights procedure, any breach log entry, and evidence of corrective steps taken.
Possible outcomes, including fines
Most complaints end in rejection, dismissal, withdrawal or amicable resolution. Where an infringement is found the DPC may reprimand, serve an enforcement notice or, after an inquiry, impose a fine. Under Article 83 GDPR the maximum is €10 million or 2% of worldwide annual turnover for lower-tier infringements and €20 million or 4% for breaches of the core principles, individuals’ rights and transfer rules. Section 141 caps fines on public authorities and bodies at €1 million; a confirmed fine is payable within 28 days of notice, and a controller can appeal a decision or notice to the Circuit Court or High Court within 28 days under section 150.
Recent decisions show the range: in 2025 the DPC fined TikTok €530 million over data transfers to China and the Department of Social Protection €550,000 over biometric processing; in September 2026 it fined the HSE €645,000, with a reprimand and corrective orders, over paper records in storage, and Google €403 million over location data. The DPC cannot award compensation to a complainant. See our guide to GDPR fines in Ireland.
Compensation claims by the individual
Separately, Article 82 GDPR and section 117 of the 2018 Act let an individual bring a “data protection action” for compensation for material or non-material damage, without complaining to the DPC first. Since 11 January 2024 the District Court has jurisdiction alongside the Circuit and High Courts, subject to each court’s monetary limit. In Dillon v Irish Life Assurance [2025] IESC 37 (24 July 2025) the Supreme Court held that claims for distress short of a psychiatric injury are not personal injury claims and need no Injuries Resolution Board authorisation, while noting they can expect only very modest awards.
When you need a solicitor
A simple complaint about a late access request can often be handled in-house. You should find a solicitor through the Law Society if the DPC opens an inquiry, serves an information or enforcement notice, signals a fine or reprimand, or if the individual issues court proceedings.
What changed in the last 12 months
No amendment to the complaint-handling provisions of the 2018 Act was found in the last 12 months. The DPC’s 2025 Annual Report, published on 30 June 2026, recorded 16,160 new cases, up 45%, with 11,734 concluded, and linked the rise partly to complainants using AI tools.
What the template can and cannot do
The GDPR Complaint Defence Pack gives you a structured reply to the individual, a response framework for a DPC query, a chronology and evidence checklist and a record-keeping log. It cannot judge whether your lawful basis was correct, decide whether a breach occurred, represent you in an inquiry or court, or replace a solicitor where a fine or proceedings are in prospect. More templates: breaches and subject rights category.
Frequently asked questions
What happens if someone complains to the Data Protection Commission about my business?
The DPC acknowledges the complaint, checks it is valid and usually contacts you for your side, often trying amicable resolution first. If that fails, under section 109 of the Data Protection Act 2018 it can reject or dismiss the complaint, serve an enforcement notice, issue a reprimand or open an inquiry.
How to respond to a DPC complaint: what should my first reply contain?
Answer the specific allegation factually, give a dated chronology, attach your correspondence with the individual, state the lawful basis and describe any corrective steps taken. Meet the DPC’s deadline and keep a copy.
Is there a GDPR complaint time limit in Ireland?
The deadlines that matter most to a business are one month under Article 12(3) GDPR to respond to a rights request (extendable by two months with notice), at least 28 days to answer an information notice under section 132 of the 2018 Act, 28 days to appeal a DPC decision or notice under section 150, and 28 days to pay a confirmed fine.
Can a data protection complaint against a business in Ireland be settled without the DPC?
Yes. The DPC recommends that individuals raise the issue with the organisation first, and many are resolved there. Even after a complaint is lodged, an amicable resolution facilitated by the DPC ends it, as it is treated as withdrawn under section 109(3).
How long does the DPC complaint process take?
The DPC aims to acknowledge within three working days and complete an initial assessment within 20 working days, and must report progress or outcome within three months. Full resolution can take several months, longer if an inquiry is opened.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. For advice on your own situation, speak to a solicitor.
Sources: DPC: making a complaint, Data Protection Act 2018, s.109, Data Protection Act 2018, s.117 (revised), Data Protection Act 2018, s.141, DPC Annual Report 2025
