Ireland DPC GDPR Complaint Response Navigator for SMBs

The situation

Niamh, 41, runs a small letting agency in Cork with 12 staff managing 400 residential properties. In February 2026 she receives a DPC complaint notification: a former tenant (Ciarán) is complaining that (1) she failed to respond to his Subject Access Request within one month, and (2) she retained his financial references and credit check data for 5 years after he vacated the property.

Niamh is aware of GDPR generally but has no formal data protection training. She's never had a DPC complaint before. A Dublin data protection solicitor quotes €4,500 for "initial review and DPC response." Her insurance's legal helpline says they don't cover data protection advice.

(a) The SAR failure may be excusable. If Ciarán's SAR was ambiguous or improperly addressed (sent to a generic email not designated for data protection requests), the GDPR one-month clock may not have started. If Niamh responded within 3 months after clarifying the scope of the request, she may have complied with Art. 15(3).

(b) The retention period may be defensible. Under Irish tenancy law (Residential Tenancies Act 2004), landlords and letting agents have a legitimate legal obligation to retain certain tenancy records for the duration of any potential dispute, PRTB/RTB proceedings can be brought up to 4 years after the tenancy ends. Retaining financial references for 4 years (not 5) under a legitimate interest (legal claim defense) may be lawful under Art. 6(1)(f).

(c) The DPC amicable resolution response is the most important document. If Niamh demonstrates in her DPC response that (i) the SAR was adequately responded to (or that a valid clarification was sought), (ii) the retention period was covered by a legitimate legal obligation or legitimate interest, and (iii) she has now implemented a formal Data Retention Policy, the DPC may close the complaint at the amicable resolution stage.

Who receives this

Irish SMBs receiving DPC complaint notifications. Primary segments: (1) Letting agents and property managers (SAR requests + data retention complaints are common in the landlord-tenant context); (2) Retailers and hospitality businesses (direct marketing consent failures, customer data breaches); (3) Healthcare practices and wellness businesses (health data processing under GDPR Art. 9 special category, higher stakes); (4) Employers receiving employee data complaints (subject access requests, monitoring consent).

Why the agency will not advise you

The DPC cannot advise respondent businesses on how to structure their compliance response, the DPC is simultaneously the investigator and (at the formal stage) the adjudicator. The DPC's guidance is explicitly complainant-facing. The amicable resolution stage, the determinative moment, has no DPC guidance for the respondent business. Irish data protection solicitors (€3,000–€10,000) are the only alternative for substantive guidance.

Key facts, with sources

• The Data Protection Commission (DPC) is Ireland's data protection supervisory authority under the GDPR (Regulation 2016/679) and the Data Protection Act 2018 (Ireland). When an individual lodges a complaint with the DPC, the DPC notifies the respondent business (the data controller) and provides it with an opportunity to respond as part of the DPC's mandatory amicable resolution process. Under Irish law implementing Art. 77 GDPR, the DPC must attempt amicable resolution before exercising its corrective powers. The amicable resolution stage is where the business's written response is determinative: if the response demonstrates that the business complied with the GDPR right asserted (or that a lawful exemption applied), the DPC may close the complaint without escalating to a formal investigation. If the response is inadequate or demonstrates ongoing non-compliance, the DPC opens a formal investigation under Section 137 of the Data Protection Act 2018. Formal DPC investigations carry significant consequences: orders to comply, orders to cease processing, and administrative fines up to €20M or 4% of worldwide annual turnover. Source: Complaints Handling, Investigations and Enforcement — DPC · Making a Complaint with the DPC — DPC · Data Protection Laws and Regulations Ireland 2025-2026 — ICLG
• Ireland serves as the EU lead supervisory authority (LSA) for most major tech companies with EU headquarters in Dublin (Meta, Google, Apple, LinkedIn, TikTok EU, Airbnb), making the DPC the highest-volume EU DPA for cross-border complaints. However, the DPC also processes large numbers of domestic complaints from Irish individuals against Irish businesses of all sizes, including SMBs. Common DPC complaint categories for SMBs include: (1) Subject Access Request (SAR) failures, businesses that fail to respond to Art. 15 access requests within one month; (2) unlawful direct marketing, GDPR and ePrivacy Regulations (SI 336/2011) direct marketing without consent; (3) data breach notification failures, businesses that suffer a data breach and fail to notify the DPC within 72 hours; (4) excessive data retention, businesses that retain personal data beyond their stated retention period; (5) landlord-tenant disputes, landlords collecting excessive personal data from tenants. The DPC's complaints backlog has been a public issue, but DPC enforcement activity and fines have accelerated significantly from 2022-2026. Source: GDPR Fines Ireland 2026: DPC Enforcement Guide — Online Legal Services Ireland · Understanding Ireland's DPC — ComplianceHub.Wiki

When to bring in a professional

Self-serve responses fit routine cases: clear facts, amounts a business can absorb, and a deadline still ahead of you. Bring in a licensed professional when the amount at stake is large relative to their fee, the facts are genuinely disputed, criminal exposure is possible, or the deadline has already passed. A short paid consultation to sanity-check your plan is often worth it even when you handle the filing yourself.

All sources for this guide

1. Complaints Handling, Investigations and Enforcement — DPC
2. Making a Complaint with the DPC — DPC
3. Data Protection Laws and Regulations Ireland 2025-2026 — ICLG
4. GDPR Fines Ireland 2026: DPC Enforcement Guide — Online Legal Services Ireland
5. Understanding Ireland's DPC — ComplianceHub.Wiki