The criteria for making a valid complaint to the Data Protection Commission (DPC) is set out under Article 77 of the General Data Protection Regulation (GDPR). This states that an individual can make a complaint if they consider that the ‘processing of personal data relating to him or her infringes this Regulation’. Therefore, for a complaint to be valid, there must be processing of your personal data in the first instance and this processing must then infringe some part of the GDPR.

What constitutes ‘processing’ of data is defined under Article 4(2) of the GDPR. In simple terms, the data controller (entity who is processing your data) must be doing something with your personal data, such as collecting, storing, altering or disclosing your data to another person/entity.  If this processing is being carried out in a manner that is infringing one or some of the provisions of the GDPR, or you are concerned that this may be the case, you may wish to contact the DPC regarding this concern to ascertain if you have a valid complaint.

Please note that if your data is not being processed by the data controller, then there is no valid complaint.