Data Protection Commission (DPC)
The Data Protection Commission (DPC) is Ireland’s independent supervisory authority for the GDPR, set up under section 10 of the Data Protection Act 2018 and known in Irish as An Coimisiún um Chosaint Sonraí. For a player, it is the body that hears complaints when a gambling operator mishandles personal data, from passport scans sent for KYC to the transaction history held after an account closes. It does not regulate gambling, and it cannot award you compensation.
Where Players Meet the DPC
Most players never think about the DPC until an operator asks for a utility bill, a bank statement or a source-of-funds declaration before releasing a withdrawal. Those documents are personal data, and the operator holding them is bound by the GDPR wherever its gambling licence was issued.
The usual first step is yours, not the Commission’s.
The DPC states plainly that it does not exercise data protection rights on anyone’s behalf, so you write to the operator first, for example with a subject access request, and bring the matter to the Commission only if the reply is refused, ignored or plainly incomplete. Where the operator’s main EU establishment sits in another member state, the authority there may lead the case, although you can still lodge the complaint in Ireland under Article 77 GDPR.
How a DPC Complaint Proceeds
Under section 108 of the 2018 Act, where the DPC is the competent authority it must handle the complaint and tell the complainant of its progress or outcome within 3 months of receiving it. That is a duty to report back, not a deadline for a final decision.
Complex cases can run far longer.
If you disagree with the result, the remedy is judicial review in the courts, and any claim for money lost through a data breach is also a matter for the courts rather than the Commission.
DPC Compared With the GRAI
The DPC is often confused with the Gambling Regulatory Authority of Ireland, which licenses and supervises gambling under the Gambling Regulation Act 2024. The GRAI deals with how an operator runs its games and treats customers, while the DPC deals only with how it collects, stores and shares personal data.
A frozen withdrawal is therefore a GRAI or operator complaint, but a refusal to hand over your own KYC file belongs with the DPC, and a single dispute can touch both bodies at once.
