Making a Protected Disclosure to the DPC
The Protected Disclosures Act 2014 is legislation enacted to provide protection to employees who wish to raise a concern relating to potential wrongdoing in the workplace. The Act sets out a number of ways in which disclosures can be made to employers as well as to external bodies.
Role of the Data Protection Commission
Section 7 of the Protected Disclosures Act provides that protected disclosures may be made to certain external regulators, referred to as “prescribed persons” in the Act. These prescribed persons are listed in Statutory Instrument 339/2014 as amended by Statutory Instrument 448/2015.
The Data Protection Commission is a prescribed person under section 7 of the Protected Disclosures Act and Statutory Instrument 339 of 2014. This means that employees may make protected disclosures to the Data Protection Commission regarding compliance with the Data Protection Acts.
However, the Protected Disclosures Act will only apply to disclosures made to the Data Protection Commission in this way if:
- the person making the disclosure reasonably believes that the relevant wrongdoing relates to compliance with the Data Protection Acts, and
- the person making the disclosure reasonably believes that the information disclosed, and any allegation contained in it, are substantially true.
All disclosures, however made, are taken seriously and all efforts are made to address appropriately, the issues raised
In general, protected disclosures made to the Data Protection Commission are dealt with on a confidential basis. There are some exceptions to this, for example, if identifying the person making the disclosure is essential to the effective investigation of matters raised.
How to make a disclosure
To make a disclosure to the Data Protection Commission please email
A disclosure should contain:
- Name of the individual making the disclosure and contact details
- Name of the organisation(s) involved
- As many details as possible regarding the concerns
We will acknowledge disclosures within 14 days of receipt and will assess the information provided.