Short answer
If a company ignores or refuses your GDPR request — a copy of your data, deletion, a breach it won’t explain — you can complain free of charge to a data protection authority under Article 77, normally the one in the country where you live or work. You don’t have to go to Ireland for Meta, Google or TikTok: your own authority takes the complaint and works with the lead authority where the company has its EU main establishment, under the GDPR’s one-stop-shop. First give the company a chance: it must answer within one month, extendable by two for complex requests, and Ireland’s Data Protection Commission requires you to have raised the matter with the organisation. If an authority doesn’t tell you how your complaint is progressing within three months, you can go to court.
Before you complain: ask the company first
Data protection authorities expect you to have tried the company. Ireland’s Data Protection Commission (DPC) requires that you raised the matter directly with the organisation; the UK’s ICO recommends it in most cases. Under Article 12, the company must act on your request within one month. For complex or numerous requests it may extend by two further months, but it has to tell you within the first month and explain why.
Send the request in writing, through the privacy contact named in the company’s privacy policy, and keep proof: the date, a copy of what you sent and any reference number. If you are asking for your data, see how to make a GDPR access request; for deletion, the right to erasure.
Which authority: your own, even for Meta, Google or TikTok
You can complain to the authority in the country where you live, work or where the infringement happened. For cross-border cases, the GDPR’s one-stop-shop makes the authority of the company’s EU main establishment the lead authority; Meta, Google and TikTok, among others, have theirs in Ireland, so the DPC leads. You still deal with your own authority, in your own language, and it cooperates with the lead. The European Data Protection Board publishes the members list:
| Country | Authority | Website |
|---|---|---|
| Ireland | Data Protection Commission (DPC) | dataprotection.ie |
| Germany | The data protection authority of your federal state; the federal BfDI lists them | bfdi.bund.de |
| Austria | Datenschutzbehörde (DSB) | dsb.gv.at |
| France | CNIL | cnil.fr |
| Belgium | Data Protection Authority (APD/GBA) | autoriteprotectiondonnees.be |
| Netherlands | Autoriteit Persoonsgegevens | autoriteitpersoonsgegevens.nl |
| Luxembourg | CNPD | cnpd.lu |
| Italy | Garante per la protezione dei dati personali | garanteprivacy.it |
| Spain | AEPD | aepd.es |
| Portugal | CNPD | cnpd.pt |
| Poland | UODO | uodo.gov.pl |
| Sweden | IMY | imy.se |
| Norway (EEA) | Datatilsynet | datatilsynet.no |
| United Kingdom | Information Commissioner’s Office (ICO), under the UK GDPR | ico.org.uk · 0303 123 1113 |
| Switzerland | Federal Data Protection and Information Commissioner (FDPIC), under the Swiss FADP | edoeb.admin.ch |
How to file a strong complaint
- Use the authority’s online form; the DPC’s is at forms.dataprotection.ie/contact. No lawyer is needed and there is no fee.
- Say what you asked for and when: “an access request under Article 15, sent on 2 September”.
- Show what came back: no answer, a refusal, an incomplete file, a template.
- Name the right at stake: access (Article 15), erasure (Article 17), objection, security of processing after a breach.
- Attach the evidence the DPC asks for: your request, the replies, screenshots, reference numbers.
- Say what you want: the data, the deletion, an explanation. Don’t send ID documents unless the authority asks.
What happens next — and the deadlines
| Step | Deadline |
|---|---|
| The company answers your request | One month; up to two more for complex requests, if it tells you within the first month (Article 12) |
| The authority updates you on your complaint | Within three months; if it doesn’t, you can go to court against the authority (Article 78) |
| The DPC’s own commitment | An update or outcome report within three months, then periodic updates |
| Court action against the company | Possible at any time, including for compensation (Articles 79 and 82) |
The DPC first checks that the matter is within its remit, then seeks an amicable resolution where that is likely to work. If it doesn’t, the authority may reject or dismiss the complaint, give advice, serve an enforcement notice or open an inquiry; inquiries are generally kept for serious or systemic failings. Cross-border cases take longer because the authorities have to cooperate.
Typical complaints after a hacked or banned account
- No answer to an access request for your login history, devices and IP addresses after a takeover.
- Refusal to delete the data of an account you closed, or that was created in your name.
- A data breach the company won’t explain; see what to do after a breach.
- Personal data in search results that a site or search engine won’t remove; see removing personal information.
A data protection authority can’t restore a suspended account: that is a moderation decision, challenged through the platform and the DSA routes. It can make a company hand over or delete your data. We combine both tracks in our result removal and privacy work.
Frequently asked questions
Do I have to complain to the Irish authority about Meta or TikTok?
No. Complain to your own authority, in your language. Under the one-stop-shop it cooperates with Ireland’s Data Protection Commission, which leads cases about companies whose EU main establishment is in Ireland.
Does a GDPR complaint cost anything?
No. Complaints to data protection authorities are free, and you don’t need a lawyer.
How long will it take?
The authority must tell you how your complaint is progressing within three months. Simple cases can end sooner; cross-border cases often take longer.
Can the authority get my banned account back?
No. It enforces data protection, not content rules. It can make the company give you a copy of your data or delete it; account suspensions go through the platform’s appeal and the DSA routes.
Sources: General Data Protection Regulation — Regulation (EU) 2016/679, Articles 12, 15, 17, 56 and 77–82, European Data Protection Board — members (national authorities), Data Protection Commission (Ireland) — complaints handling for individuals, ICO — data protection complaints (UK)