Ireland Data Protection Law: DPC Complaints, CCTV and Recording

Ireland's data protection law runs on two instruments read together: the GDPR (Regulation (EU) 2016/679), which sets the EU wide rules, and the Data Protection Act 2018, which supplies Ireland's national detail, from the powers of the regulator to the enforcement route in section 117. Whatever question brought you here, a neighbour's camera, a recorded work meeting, a phone call, or a complaint you want to make, the process runs through the same regulator: the Data Protection Commission.

The single fact that decides most of what follows is which body actually deals with your problem, because it is not always the DPC. The DPC investigates GDPR complaints, electronic marketing and cookie complaints under the ePrivacy Regulations (S.I. No. 336 of 2011), and law enforcement data processing under Part 5 of the Data Protection Act 2018. It cannot award you compensation, and it cannot order a private individual to remove a camera. Money claims and camera disputes both end up at the same place instead: a data protection action under section 117 of the Act.

Recording itself, a phone call, a work meeting, or a face to face conversation you are part of, sits mostly outside the criminal law once you are a participant. Section 98(6) of the Postal and Telecommunications Services Act 1983, as substituted by section 13(3) of the 1993 Act, treats either party's consent to a telecommunications message as enough, and no separate Irish statute reaches a recorder running in a room. The real constraints on a participant who records come from the GDPR and the Data Protection Act 2018 instead, which is why every question below sits under data protection rather than criminal law.

Information last verified on 21 July 2026. This page presents general legal information, not legal advice.

Jurisdiction scope: This page covers data protection law in the Republic of Ireland under the GDPR and the Data Protection Act 2018, enforced by the Data Protection Commission. It does not cover Northern Ireland, which follows UK GDPR and the UK Information Commissioner's Office.

Who handles your complaint, and what they can actually do

The Data Protection Commission (DPC) is Ireland's supervisory authority for the GDPR, and it also handles electronic marketing and cookie complaints under the ePrivacy Regulations, and law enforcement data processing under Part 5 of the Data Protection Act 2018. Before it takes on a complaint, the DPC expects evidence that you raised the problem with the organisation, or its data protection officer, first.

Our guide on how to make a GDPR complaint to Ireland's Data Protection Commission walks through the free webform at forms.dataprotection.ie/contact, the DPC's duty to give you an update or an outcome report within 3 months, and the one-stop-shop process for complaints about platforms headquartered in Dublin, where the DPC's decisions have included a record €1.2 billion fine against Meta in 2023 and a €530 million fine against TikTok in 2025.

One limit trips people up. The DPC cannot award you compensation. A money claim for material or non-material damage has to be brought separately, as a data protection action under section 117 of the Data Protection Act 2018, in the Circuit Court, the High Court, or since 11 January 2024, the District Court. That same route is also the practical remedy for a neighbour's camera and for unlawful recording at work, covered further down this page.

If your question is instead about your own data, a subject access request under Article 15 GDPR is free and must be answered within one month, extendable by two further months for complex or numerous requests. The DPC complaint guide covers that request process too.

Recording a phone call

Ireland treats recording a call you are part of very differently from recording one you are not. Section 98(6) of the Postal and Telecommunications Services Act 1983, as substituted by section 13(3) of the 1993 Act, excludes recording from the definition of interception wherever either the sender or the intended recipient has consented, which in practice means recording your own call is not a criminal offence. Recording a call you are not part of is different entirely. That is interception, an offence under section 98(1), lawful only under a Ministerial authorisation issued for a criminal investigation or State security under section 2 of the 1993 Act.

The Privacy and Electronic Communications Regulations 2011 (S.I. No. 336 of 2011) add a further layer aimed at third parties and network operators rather than a participant in the call. The lawful business practice exception in that instrument is a saver for already authorised recording of a business communication, not a standalone permission to record. Our guide to recording phone calls in Ireland sets out why no Irish law actually requires a "this call may be recorded" announcement, and why the real exposure sits at the point you share or publish a recording rather than at the point you make it.

Recording a meeting or conversation at work

The same one party logic covers a work meeting. Section 98(6) only reaches a telecommunications message in the course of transmission, so a recorder running in a meeting room, or a recording of a face to face conversation you are part of, falls outside it altogether. No Irish statute prohibits that kind of recording on its own.

That narrow criminal rule is not, however, the law that actually decides whether recording a colleague or a meeting is a good idea. Because the GDPR applies to any recording that identifies a person, an employer cannot rely on an employee's consent as its lawful basis. The DPC treats consent as doubtful wherever there is a clear imbalance between the parties, and names the employer relationship as an example. It treats recording staff without their knowledge as generally unlawful, allowed only on an exceptional, case by case basis for preventing, detecting or investigating offences, backed by a written policy and a data protection impact assessment.

Whether a covert recording is admissible once you are already in a Workplace Relations Commission hearing is a separate question again, and the WRC has gone both ways on it, excluding one covert recording and admitting another with its weight expressly reserved. Our guide to recording conversations at work in Ireland works through employer obligations, an employee's options for covert recording, and what to do if you believe you were recorded unlawfully.

Cameras at home: doorbells, CCTV and a neighbour's camera

A domestic camera, a video doorbell included, sits inside the GDPR's household exemption in Article 2(2)(c) for as long as it only captures images within the perimeter of your own property, garden and driveway included. The DPC has said a smart doorbell is likely to stay within that exemption if it only records the private area inside your own perimeter, and that a doorbell which is not continuously recording is likely to remain inside it too. Once a camera's field of view crosses that boundary, the exemption ends and the owner becomes a data controller with signage, retention and other GDPR duties to meet.

A neighbour's camera pointed past your own boundary is a data protection problem, not a criminal one. The DPC cannot order a private individual to remove or dismantle it; it can only write to the owner explaining the rules. The real remedy is the same section 117 data protection action described above, and awards so far have been modest: the Circuit Court assessed non-material damages for misuse of CCTV footage at €2,000 in Kaminski v Ballymaguire Foods Ltd [2023] IECC 5. Our guide to home CCTV and doorbell cameras in Ireland covers apartment block cameras, audio recording, and a short checklist for keeping your own camera inside the exemption.

Guides in this section

• How to make a GDPR complaint to the Data Protection Commission
• Home CCTV and doorbell cameras in Ireland
• Recording conversations at work in Ireland
• Recording phone calls in Ireland

Disclaimer

This page presents general legal information about data protection law in Ireland, verified on 21 July 2026. It is not legal advice and does not create a solicitor client relationship. Data protection rules change over time and how they apply depends on your specific facts. For advice on your situation, consult a solicitor, or contact the Data Protection Commission directly.