Ireland Data Privacy Laws: GDPR, DPC Enforcement & Your Rights (2026)

Ireland governs personal data through the EU General Data Protection Regulation (Regulation (EU) 2016/679), which applies directly as law since 25 May 2018, and the Data Protection Act 2018, which fills over 50 national derogations. The Data Protection Commission enforces both instruments as Ireland's independent supervisory authority.

Quick Answer: Ireland's Data Privacy Framework at a Glance

Ireland operates the most consequential data privacy regime in the European Union. The EU General Data Protection Regulation (GDPR), which has applied directly as EU law since 25 May 2018, forms the primary legal framework. The Data Protection Act 2018 gives further national effect to the GDPR and fills over 50 member-state derogations. The Data Protection Commission (DPC) enforces both instruments as Ireland's independent supervisory authority. Because every major American technology platform has located its European headquarters in Dublin, the DPC functions as the de facto privacy regulator for the global internet. The constitutional foundation for this framework rests on Article 40.3 of the Irish Constitution, under which the courts have recognised an unenumerated right to privacy since 1987.

Jurisdiction scope: This article addresses data privacy law in Ireland, covering the EU GDPR (Regulation (EU) 2016/679), the Data Protection Act 2018, and the DPC's enforcement role as lead supervisory authority. It does not address recording-consent law; for that, see Ireland Recording Laws. For the broader EU framework applicable across all 27 member states, see EU Data Privacy Laws. For a step-by-step guide to complaining to the regulator, see How to Complain to the DPC, and for wider Irish coverage see the Ireland legal hub.

The Constitutional Basis: Privacy as a Fundamental Right

Ireland's right to privacy has a deeper constitutional foundation than most EU member states. The Irish Constitution does not enumerate a specific right to privacy, but the courts have consistently recognised it as an unenumerated personal right under Article 40.3, which requires the State to protect and vindicate the personal rights of the citizen.

The foundational case is Kennedy and Arnold v Attorney General [1987] IR 587. Hamilton P. held that the right to privacy is one of the unenumerated rights implicit in Article 40.3 of the Constitution. The case arose from unlawful phone tapping by agents of the State against two journalists. The court held that the wiretapping constituted a direct and deliberate violation of the constitutional right to privacy and awarded damages against the State.

This constitutional grounding matters for data protection in two ways. First, it provides a basis for individuals to bring constitutional actions against the State where statutory data protection remedies are inadequate. Second, it has shaped Irish courts' interpretation of GDPR provisions, including the proportionality analysis applied when data processing conflicts with other rights such as freedom of expression or legitimate business interests.

The right to privacy under Article 40.3 coexists with rights protected by the European Convention on Human Rights. Article 8 of the ECHR, which guarantees respect for private life, became part of Irish domestic law under the European Convention on Human Rights Act 2003, and operates as an interpretive aid in Irish courts when privacy questions arise.

The Legal Framework: GDPR and the Data Protection Act 2018

Ireland's data privacy regime rests on two pillars. The first is the EU GDPR, which applies directly as law across all 27 EU member states without requiring national transposition. The second is the Data Protection Act 2018, which gives further national effect to the GDPR and governs areas where the regulation permits member-state discretion.

What the GDPR Covers

The GDPR establishes the baseline rules for data protection throughout Europe. It sets requirements for lawful processing of personal data, data subject rights, breach notification, data protection impact assessments (DPIAs), and the appointment of data protection officers (DPOs). The regulation applies to any organisation that processes the personal data of individuals in the EU, regardless of where that organisation is headquartered.

Maximum penalties under Article 83(5) GDPR reach 20 million euros or 4% of total worldwide annual turnover, whichever is higher. For less severe infringements covered by Article 83(4), fines can reach 10 million euros or 2% of annual worldwide turnover.

What the Data Protection Act 2018 Adds

The Data Protection Act 2018 fills the member-state derogations permitted by the GDPR. It replaced the Data Protection Commissioner with the multi-member Data Protection Commission and largely repealed the Data Protection Acts 1988 and 2003.

Key Ireland-specific provisions in the 2018 Act include:

Digital age of consent set at 16. Ireland chose the maximum age permitted by Article 8 GDPR (which allows member states to set it between 13 and 16). Online service providers must make reasonable efforts to verify parental consent before processing personal data of children under 16.

Children's marketing data (not in force). Section 30 would make it an offence for a company or corporate body to process a child's personal data for direct marketing, profiling or micro-targeting, punishable by an administrative fine under section 141. It has never been commenced: the Commencement Order (S.I. No. 174 of 2018) excluded it, and no later order has brought it into operation.

Right to erasure for children. A specific right to erasure applies to personal data collected from children in relation to information society services, regardless of consent given at the time.

Law enforcement processing. Where data processing is carried out for law enforcement purposes (prevention, investigation, detection, or prosecution of criminal offences), the GDPR does not apply. Part 5 of the 2018 Act implements the EU Law Enforcement Directive (Directive 2016/680) for those operations.

Journalistic, academic, and artistic exemptions. Section 43 permits processing that would otherwise breach the GDPR where the processing is solely for journalistic, academic, artistic, or literary purposes and where compliance with the GDPR would be incompatible with those purposes, subject to a proportionality assessment.

A judicial remedy with real teeth. Section 117 of the 2018 Act creates the "data protection action": a data subject can sue a controller or processor in the District Court or the Circuit Court (each concurrently with the High Court) for an injunction, a declaration, or compensation, and damage expressly includes both material and non-material damage.

The ePrivacy Regulations

Ireland also enforces the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. No. 336 of 2011). Under Regulation 5(3), storing information on a user's device, or accessing information already stored there, requires the user's consent plus clear and comprehensive information that is prominently displayed and easily accessible; this is the legal foundation of Irish cookie-consent practice. Regulation 5(5) exempts storage or access that is strictly necessary to deliver a service the user explicitly requested. Regulation 13 requires consent for unsolicited marketing by email, SMS, or automated calls, subject to a limited soft opt-in for existing customers under Regulation 13(11). The DPC has issued enforcement notices against organisations for non-compliant cookie banners and prosecutes electronic-marketing offences.

Legal Bases for Processing Personal Data

Article 6 GDPR requires that every processing operation of personal data have a valid legal basis. The DPC's guidance on legal bases sets out how Irish organisations must apply these provisions.

The six available legal bases are:

Consent in Practice

For consent to be valid under the GDPR, it must be freely given, specific, informed, and unambiguous. Pre-ticked boxes, bundled consents, and consent as a condition of service do not meet this standard. The DPC's enforcement record against LinkedIn (310 million euros, October 2024) turned on exactly this issue: LinkedIn's consent mechanisms for behavioural advertising were found to be neither freely given nor sufficiently informed.

Consent can be withdrawn at any time, and withdrawal must be as easy as giving consent. Where consent is the legal basis for processing, organisations must stop processing promptly after withdrawal and must not penalise the data subject for withdrawing.

Legitimate Interests

Legitimate interests under Article 6(1)(f) require a three-part balancing test: the legitimate interest must be identified; the processing must be necessary for that interest; and the interest must not be overridden by the data subject's rights. Public authorities processing in the exercise of their official functions cannot rely on legitimate interests. Meta relies on legitimate interests as the legal basis for training its generative AI models on public EU user posts, an approach the DPC assessed and conditionally accepted in May 2025.

The Data Protection Commission: Structure, Powers, and 2025 Activity

The DPC is Ireland's independent national supervisory authority under Article 51 GDPR. It now operates with three commissioners in post: Dr Des Hogan, who has chaired the Commission as Commissioner for Data Protection since February 2024; Dale Sunderland, appointed alongside him in February 2024; and Niamh Sweeney, who became the third commissioner in September 2025. The three-member structure replaced the former single-commissioner model and provides resilience the older structure lacked.

Enforcement Powers

The DPC holds the full corrective powers enumerated in Article 58(2) GDPR, including the power to:

• Issue warnings and reprimands
• Order compliance with data subject rights
• Order the restriction or suspension of processing
• Order the erasure of data
• Withdraw certification
• Suspend data transfers to third countries
• Impose administrative fines up to 20 million euros or 4% of worldwide annual turnover

2025 Activity: Key Statistics

The DPC published its 2025 Annual Report on 30 June 2026. Key figures:

• 16,160 new cases received from individuals in 2025, a 45% increase on 2024
• 11,734 cases concluded during the year, a 12% increase
• 208 valid cross-border complaints concluded as lead supervisory authority, a 43% increase
• 6,521 valid personal data breach notifications received, a 16% decrease on 2024
• 4 large-scale inquiries finalised, with administrative fines totalling just over 530.77 million euros, led by the TikTok China-transfers decision
• 275 electronic direct marketing investigations concluded, an 88% increase, plus 50 warning letters

For comparison, the 2024 Annual Report, published in June 2025, recorded 11,091 new cases, 10,510 cases concluded, 2,673 cases in the formal complaint handling process, 7,781 valid breach notifications, and 652 million euros in fines from 11 finalised inquiry decisions.

Breach Notification Requirements

Organisations must report personal data breaches to the DPC within 72 hours of becoming aware of the breach, where the breach presents a risk to the rights and freedoms of affected individuals. The DPC applies an expansive interpretation of "awareness": controllers cannot run the 72-hour clock from the moment they subjectively discovered the breach. They must account for when they reasonably ought to have known, including delays by processors in escalating the incident to the controller.

Where a breach is likely to result in a high risk to individuals, those individuals must also be notified directly without undue delay. Failure to notify can trigger fines up to 10 million euros or 2% of annual worldwide turnover under Article 83(4) GDPR.

Complaints Process

Individuals who believe their data protection rights have been violated should first contact the data controller directly. If dissatisfied with the response, they may file a complaint with the DPC. The DPC must provide an update or outcome within three months. Where the DPC considers an amicable resolution reasonably likely, it may try to arrange one before taking other action (section 109 of the Data Protection Act 2018). Note that the DPC does not award compensation to complainants; its corrective powers run against the organisation, and any fines go to the Exchequer. For compensation, the route is a data protection action under section 117 of the Data Protection Act 2018 in the District Court, Circuit Court or High Court. Our step-by-step guide to making a complaint to the DPC walks through the webform, the evidence to gather, and what happens next.

Data Protection Officers and DPIAs

Who Must Appoint a DPO

Article 37 GDPR and the DPC's guidance require appointment of a Data Protection Officer in three situations:

• The controller or processor is a public authority or public body (with limited exceptions for courts acting in a judicial capacity)
• The core activities consist of processing operations that require regular and systematic monitoring of data subjects on a large scale
• The core activities consist of large-scale processing of special categories of data (sensitive data) or data relating to criminal convictions and offences

"Large scale" is assessed by reference to the number of data subjects, the volume of data, the duration of the processing, and its geographic extent. A hospital processing patient health data, a bank monitoring account transactions, or a technology platform tracking the browsing behaviour of millions of users would each typically require a DPO.

DPOs must have expert knowledge of data protection law and practice. The GDPR does not prescribe formal qualifications, but the DPC has issued guidance that the level of expertise should be commensurate with the sensitivity and scale of the processing. DPO contact details must be published and notified to the DPC.

Data Protection Impact Assessments

A DPIA is mandatory under Article 35 GDPR before commencing processing that is likely to result in a high risk to the rights and freedoms of natural persons. The DPC publishes a list of processing types that always require a DPIA in Ireland, which includes:

• Large-scale processing of special categories of data
• Systematic monitoring of publicly accessible areas on a large scale
• Processing that uses new technologies where the privacy risks are not fully understood
• Profiling that produces legal or similarly significant effects

Where a DPIA reveals that residual high risks cannot be mitigated, the controller must consult the DPC before proceeding. The DPC has eight weeks (extendable by six weeks) to respond. Proceeding without required prior consultation exposes the controller to fines under Article 83(4) GDPR.

Record-Breaking Enforcement: The DPC's Major Fines

The DPC has issued more GDPR fines by value than any other EU supervisory authority. The table below lists its largest fines:

Notable Facts on Key Decisions

Meta 1.2 billion euros (May 2023): The DPC adopted its final decision on 12 May 2023 and announced it on 22 May 2023, finding an infringement of Article 46(1) GDPR. Meta had continued transferring EU user data to the US via Standard Contractual Clauses after the CJEU invalidated Privacy Shield in Schrems II (Case C-311/18, July 2020). The SCCs and supplementary measures Meta relied upon did not adequately protect data subjects' fundamental rights against US surveillance law. Alongside the fine, the DPC ordered Meta to suspend the transfers within five months and to bring its US processing into compliance within six months. The EDPB directed the DPC through a binding decision under Article 65 to impose the fine; the DPC's own draft decision would not have included a financial penalty.

TikTok 530 million euros (May 2025): The DPC found, in a decision of 30 April 2025 announced on 2 May 2025, that TikTok's transfers of EEA user data to China breached Article 46(1) GDPR because TikTok failed to verify and demonstrate that its supplementary measures were effective in the Chinese legal environment. The fine comprised 485 million euros for the transfer infringement and 45 million euros for transparency failures under Article 13(1)(f). The case also involved TikTok disclosing in April 2025 that it had stored EEA user data on servers in China, directly contradicting statements made to the DPC throughout the inquiry. TikTok was ordered to bring its processing into compliance within six months and is appealing to the Irish High Court.

Google 403 million euros (September 2026): In a decision announced on 21 September 2026, following an own-volition inquiry opened in February 2020 after complaints from European consumer organisations including BEUC, the DPC found that Google Ireland's processing of location data in Web & App Activity and Location History between May 2018 and February 2020 infringed the lawfulness and fairness principle, that Google breached its transparency obligations for all three features examined, and that it kept location data too long. It imposed fines totalling 403 million euros and ordered Google to bring its processing into compliance within six months.

LinkedIn 310 million euros (October 2024): The DPC found that LinkedIn Ireland Unlimited Company processed member data for behavioural analysis and targeted advertising on the bases of consent, legitimate interests, and contract. All three legal bases were found invalid for this purpose: consent was not freely given or sufficiently informed; legitimate interests did not survive the balancing test against data subjects' fundamental rights; and contract could not justify processing beyond what was strictly necessary for service delivery. The case originated from a 2018 complaint to the French CNIL.

Meta 91 million euros (September 2024): The DPC fined Meta for storing the passwords of hundreds of millions of Facebook and Instagram users in plaintext (unencrypted), in breach of Articles 5 and 32 GDPR, which require appropriate technical security measures for personal data.

The Collection Problem: Fines Issued vs. Fines Collected

While the DPC's cumulative fine total exceeds 4 billion euros, a significant gap exists between fines imposed and fines actually collected. Nearly every large fine is subject to legal challenge in the Irish courts and, in some cases, at the CJEU. Appeals can run for years, and the financial incentive for companies to litigate is strong relative to the cost of delay.

This gap does not eliminate the practical legal risk. A fine under appeal typically remains secured, and the associated compliance orders (such as orders to suspend data transfers or restructure processing operations) are generally enforceable on short timelines independently of any fine appeal. The 1.2 billion euro Meta fine included an order to suspend EU-US transfers within five months, regardless of the appeal timeline.

The One-Stop-Shop Mechanism: Lead Supervisory Authority

The GDPR's one-stop-shop (OSS) mechanism under Article 60 was designed to simplify multi-jurisdictional enforcement. A controller with its main establishment in a given EU member state is subject primarily to the supervisory authority of that state for all EU-wide data processing activities.

For the DPC, this means handling the majority of cross-border cases involving major technology platforms. By the end of 2024, the DPC had received over 1,850 cross-border complaints as lead supervisory authority, with 82% of those cases concluded.

The EDPB and Binding Decisions

The OSS mechanism has produced significant friction. Other EU data protection authorities have raised objections under Article 60 GDPR to multiple DPC draft decisions, leading to referrals to the EDPB for binding dispute resolution under Article 65 GDPR. The EDPB has issued binding decisions directing the DPC to impose higher fines or broaden the scope of its conclusions in the WhatsApp, Meta (transfers), Instagram, and Meta (advertising legal basis) cases.

The DPC filed legal challenges arguing the EDPB exceeded its jurisdiction. In January 2025, the EU General Court dismissed those challenges (Cases T-70/23, T-84/23 and T-111/23), upholding the EDPB's power to require the DPC to carry out further investigations and issue new draft decisions.

Watch out: The OSS mechanism does not insulate a company from scrutiny by all 27 EU regulators. Other supervisory authorities retain full jurisdiction over complaints from their own residents and can trigger EDPB involvement if they believe the lead authority's decision is inadequate.

Data Subject Rights in Ireland

The GDPR grants every EU resident a set of enforceable rights against any controller processing their personal data. The DPC enforces these rights and has issued enforcement notices where organisations failed to honour access requests on time.

The right of access is the most commonly exercised right in Ireland: access requests accounted for 34% of all formal complaints in the DPC's 2024 Annual Report, followed by fair processing (17%) and the right to erasure (14%).

Employee Data Protection and Workplace Monitoring

Employers in Ireland must comply with the GDPR and the Data Protection Act 2018 when collecting, using, or storing employee data. The DPC has issued specific guidance on workplace surveillance.

Covert surveillance of employees is generally unlawful. It is permitted only in exceptional circumstances, such as detecting, preventing, or investigating serious crime, and the monitoring must be fair, reasonable, and proportional to the legitimate objective. Employers must inform employees about any monitoring in place, including CCTV, email monitoring, and internet usage tracking. Data protection impact assessments are typically required before deploying new workplace monitoring technologies.

Cross-Border Data Transfers: Schrems Legacy and the Data Privacy Framework

Ireland's DPC is the primary battleground for EU-US and EU-China data transfer law. The Schrems litigation series, which ran from 2013 to 2023, destroyed two successive EU-US transfer frameworks and produced the world's largest GDPR fine.

The Schrems Cases

Austrian privacy activist Maximilian Schrems brought his original complaint in 2013, arguing that Facebook's transfers of EU user data to the US were unlawful given US mass surveillance revealed by Edward Snowden. The CJEU invalidated the EU-US Safe Harbour framework in Maximilian Schrems v Data Protection Commissioner (Case C-362/14, Schrems I) in October 2015.

The Privacy Shield framework, which replaced Safe Harbour, was invalidated in Data Protection Commissioner v Facebook Ireland Limited and Maximilian Schrems (Case C-311/18, Schrems II) in July 2020. The CJEU held that US surveillance law did not provide an equivalent level of protection. Both cases were referred to the CJEU by the DPC and the Irish High Court, placing Ireland's regulator at the centre of both pivotal rulings.

The EU-US Data Privacy Framework (July 2023)

The EU-US Data Privacy Framework (DPF), adopted by European Commission Implementing Decision (EU) 2023/1795 on 10 July 2023, provides the current adequacy mechanism for EU-US transfers. Companies that self-certify with the US Department of Commerce may receive EU personal data without additional transfer safeguards. The DPF incorporated structural reforms to US surveillance law, including Executive Order 14086, which established a Data Protection Review Court as a redress mechanism for EU individuals.

In September 2025, the EU General Court dismissed a challenge to the DPF brought by French politician Philippe Latombe (Case T-553/23), ruling that the Commission's adequacy determination was valid at the time of adoption. Latombe appealed to the CJEU on 31 October 2025; the appeal is pending as Case C-703/25 P. NOYB, the privacy organisation founded by Maximilian Schrems, has also indicated it is considering a separate challenge. The DPF remains in force as of mid-2026.

Standard Contractual Clauses and Supplementary Measures

For transfers to countries without adequacy decisions, the principal mechanisms remain Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs). The TikTok 530 million euro decision reinforced that SCCs alone are insufficient where the legal environment of the recipient country creates systemic risks to data subjects' rights. Controllers must conduct genuine transfer impact assessments and implement technically effective supplementary measures, not merely sign standard documentation.

The EU AI Act Overlay

Regulation (EU) 2024/1689 (the EU AI Act), which entered into force on 1 August 2024, adds a new regulatory layer that interacts directly with the GDPR in Ireland. The Act takes a risk-based approach: the higher the potential harm from an AI system, the more stringent the obligations.

Prohibited Practices (in force since 2 February 2025)

The AI Act prohibits certain AI practices as of 2 February 2025, including:

• AI systems that use subliminal techniques to manipulate behaviour outside of a person's conscious awareness
• AI systems that exploit vulnerabilities of specific groups (age, disability) to distort behaviour harmfully
• Biometric categorisation systems that infer sensitive attributes such as political opinions, racial origin, or sexual orientation from physical characteristics
• Real-time remote biometric identification in publicly accessible spaces for law enforcement (with limited exceptions)
• Social scoring of individuals by public or private actors that leads to unjustified or detrimental treatment

From 2 December 2026, Regulation (EU) 2026/1744 (the Digital Omnibus on AI) adds two further prohibitions: AI systems that generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without their explicit consent, and AI systems that generate child sexual abuse material. For providers, these apply where that output is the system's intended purpose or a reasonably foreseeable outcome without adequate safeguards (new Article 5(1a)).

These prohibitions apply to any system deployed in Ireland, regardless of where the system was developed.

High-Risk AI Systems (applying from December 2027)

High-risk AI systems, listed in Annex III of the AI Act, include systems used for employment decisions (recruitment, performance evaluation), essential services (credit scoring, health care), law enforcement (risk assessment), border management, and administration of justice. Providers and deployers of these systems must comply with transparency, documentation, human oversight, and conformity assessment requirements. Under Regulation (EU) 2026/1744 (the Digital Omnibus on AI), which entered into force in July 2026, those requirements apply from 2 December 2027 for Annex III systems and from 2 August 2028 for AI built into products covered by Annex I. The original date of 2 August 2026 no longer applies to them.

Ireland's Implementation Structure

The Irish Government announced on 5 March 2025 that Ireland will implement the AI Act through a distributed model, using existing sectoral regulators rather than creating a new monolithic authority. The DPC is designated as a competent authority for high-risk AI systems that process personal data. The Regulation of Artificial Intelligence Act 2026, signed into law on 21 July 2026, establishes the AI Office of Ireland (Oifig IS na hÉireann) as an independent statutory body and Ireland's central coordinating authority for the AI Act. The DPC states that its AI Act functions rest on S.I. No. 366/2025 (as amended) and that Act.

The EDPB confirmed in its 2024 statement that DPAs should be designated as market surveillance authorities for high-risk AI systems in their core enforcement areas. Guidance on the interaction between GDPR obligations and AI Act compliance is being developed by the EDPB and the European Commission jointly.

AI-Specific Enforcement: Meta AI Training and the X Inquiry

The DPC has already engaged with AI training as a distinct enforcement area.

Meta AI Training (May 2025)

In March 2024, Meta informed the DPC of its plans to use public posts from adult Facebook and Instagram users in the EU/EEA to train its large language models. The DPC requested a pause pending regulatory review. Meta paused training in June 2024.

The DPC sought an EDPB opinion on AI model training data protection requirements in September 2024. The EDPB published that opinion in December 2024, setting criteria for assessing compliance. Meta revised its approach, updated its Legitimate Interest Assessment, DPIA, and supplementary safeguards (de-identification, data filtering, and output filters), and resubmitted documentation.

Following that review, the DPC issued a statement on 21 May 2025 indicating it was satisfied that Meta's updated measures met the required standard for training to proceed. Meta relies on Article 6(1)(f) GDPR (legitimate interests) as the legal basis. The DPC requires Meta to submit an evaluation report by October 2025 and continues to monitor compliance. Individuals may exercise the right to object under Article 21 GDPR through Meta's privacy settings to prevent their public posts being used for AI training.

X (Twitter) AI Training Inquiry (April 2025)

The DPC commenced an inquiry into X Internet Unlimited Company (XIUC) in April 2025, examining whether X's use of public EU/EEA user posts to train its Grok large language models complied with GDPR. The inquiry covers lawfulness, transparency, and the existence of a valid legal basis. The outcome is pending.

In February 2026 the DPC opened a second, large-scale inquiry into XIUC, this time over non-consensual intimate and sexualised images, including of children, generated with the Grok functionality on the X platform. It examines Articles 5, 6, 25 and 35 GDPR. Separately, in July 2025 the DPC opened a new inquiry into TikTok's transfers of EEA users' personal data to servers located in China.

Business Compliance: What Organisations in Ireland Must Do

Any organisation that processes the personal data of individuals in Ireland, or that targets individuals in Ireland with goods or services, must comply with the GDPR and the Data Protection Act 2018. The Department of Enterprise provides guidance for businesses on their core obligations.

The following requirements apply to most organisations:

• Identify a valid legal basis under Article 6 GDPR before any processing begins, and document it in a record of processing activities under Article 30.
• Publish a privacy notice that is clear, concise, and easily accessible, covering the controller's identity, purposes and legal bases, retention periods, data subject rights, and international transfers.
• Appoint a DPO if mandatory (public authority, large-scale monitoring, or large-scale sensitive data processing).
• Conduct DPIAs before high-risk processing operations, including new technologies and large-scale profiling.
• Report data breaches to the DPC within 72 hours where the breach risks harming individuals.
• Honour data subject rights within statutory timelines: access within one month, erasure, restriction, portability, and objection responses.
• Maintain records of processing activities under Article 30 GDPR (most organisations with fewer than 250 employees are exempt unless their processing involves sensitive data or is not occasional).
• Implement appropriate security measures under Article 32 GDPR: encryption, pseudonymisation, access controls, regular testing, calibrated to the risk level.
• Ensure valid consent mechanisms for cookies, direct marketing, and any processing where consent is the chosen legal basis.
• Assess international transfers before sending personal data outside the EU/EEA: confirm an adequacy decision, SCCs, BCRs, or another Article 46 mechanism is in place, supported by a documented transfer impact assessment.

Watch out: Reliance on legitimate interests (Article 6(1)(f)) requires a documented balancing test. The DPC's enforcement record in the LinkedIn and Meta advertising decisions makes clear that characterising a commercial interest as "legitimate" is not sufficient. The balancing test against data subjects' fundamental rights must be genuinely conducted and documented before processing begins.

Penalties: How the Fine Structure Works

GDPR fines operate on a two-tier structure. Article 83(4) covers less severe violations (DPO obligations, records of processing, processor contracts, breach notification, DPIAs, prior consultation): the maximum is 10 million euros or 2% of total worldwide annual turnover. Article 83(5) covers core principles (lawfulness, fairness, transparency), data subject rights, and international transfer obligations: the maximum is 20 million euros or 4% of worldwide annual turnover.

Under section 147 of the Data Protection Act 2018, the DPC may bring summary prosecutions for offences under the Act, and it also prosecutes electronic-marketing offences under the ePrivacy Regulations (S.I. No. 336 of 2011).

How to Enforce Your Rights

If you believe an organisation in Ireland has violated your data protection rights:

1. Contact the organisation directly. Under the GDPR, organisations must respond to data subject rights requests within one month. Most issues can be resolved at this stage.
2. File a complaint with the DPC at dataprotection.ie if the organisation fails to respond or provides an inadequate response. Complaints are free to file. Our guide to making a complaint to the DPC covers the webform, the amicable resolution stage, and the three-month update obligation.
3. Seek a judicial remedy. Article 79 GDPR preserves the right to bring civil proceedings in the Irish courts against a controller or processor regardless of whether a DPC complaint has been filed. In Irish law this takes the form of a data protection action under section 117 of the Data Protection Act 2018, which the District Court and the Circuit Court can each hear concurrently with the High Court (the District Court since 11 January 2024).
4. Claim compensation. Article 82 GDPR and section 117 of the 2018 Act provide a right to compensation for material and non-material damage (including distress) where a data protection breach has harmed you. The DPC itself does not award compensation; the courts do. The controller bears the burden of proving it was not at fault.

For wider coverage of Irish law on this site, see the Ireland legal hub.

Disclaimer

This article presents general legal information about data privacy law in Ireland, covering the EU General Data Protection Regulation (Regulation (EU) 2016/679), the Data Protection Act 2018 (Number 7 of 2018), and the Data Protection Commission's enforcement activities. It does not constitute legal advice and does not address any individual's specific circumstances. The information in this article was last reviewed on 26 October 2026. Statutes cited reflect their in-force versions as of that date. Laws and DPC guidance are subject to change; readers should verify the current position before relying on this information. Organisations or individuals who need advice on compliance with Irish or EU data protection law should consult a solicitor qualified and practising in Ireland.

Last updated: 26 October 2026.

Frequently Asked Questions

Why does Ireland regulate data privacy for Meta, Google, Apple, and TikTok?

Under the GDPR's one-stop-shop mechanism in Article 60, the supervisory authority in the country where a company has its main EU establishment becomes the lead regulator for the entire EU. Because Meta, Google, Apple, Microsoft, TikTok, and LinkedIn established their European headquarters in Dublin, Ireland's Data Protection Commission serves as their primary GDPR regulator, overseeing data protection compliance for over 450 million European users.

Who leads the Data Protection Commission?

The DPC has three commissioners. Dr Des Hogan has been chairperson and Commissioner for Data Protection since February 2024. Dale Sunderland was appointed commissioner in February 2024, and Niamh Sweeney became the third commissioner in September 2025. The three-member structure replaced the former single-commissioner model.

How much has the Irish DPC fined companies under the GDPR?

The DPC has imposed over 4 billion euros in GDPR fines since May 2018, more than any other EU supervisory authority. Major fines include 1.2 billion euros against Meta for EU-US data transfers (May 2023), 530 million euros against TikTok for transfers to China (May 2025), 405 million euros against Instagram for children's data defaults (September 2022), 403 million euros against Google over location data (September 2026), 345 million euros against TikTok for children's privacy (September 2023), 310 million euros against LinkedIn for unlawful advertising legal basis (October 2024), 251 million euros against Meta for a 2018 data breach (December 2024), 225 million euros against WhatsApp for transparency failures (September 2021), and 91 million euros against Meta for password security failures (September 2024). A large proportion of these fines remain subject to legal challenge and have not been collected.

What is the digital age of consent in Ireland?

Ireland set the digital age of consent at 16 under the Data Protection Act 2018 (Number 7 of 2018), the highest age permitted by Article 8 of the GDPR (which allows member states to set it anywhere between 13 and 16). Online service providers must make reasonable efforts to verify parental consent before processing personal data of children under 16. Section 30 of the Act, which would make it an offence for companies to process children's data for direct marketing, profiling or micro-targeting, has never been commenced.

What is the constitutional basis for privacy rights in Ireland?

The Irish Constitution does not enumerate a specific right to privacy. However, Irish courts have recognised privacy as an unenumerated personal right protected under Article 40.3 of the Constitution, which requires the State to protect and vindicate citizens' personal rights. The foundational case is Kennedy and Arnold v Attorney General [1987] IR 587, where Hamilton P held that the right to privacy was violated by unlawful State phone tapping of journalists. This constitutional foundation coexists with Article 8 of the European Convention on Human Rights, which became part of Irish domestic law under the European Convention on Human Rights Act 2003.

What is the EU-US Data Privacy Framework and is it still valid?

The EU-US Data Privacy Framework (DPF), adopted by the European Commission on 10 July 2023 (Implementing Decision (EU) 2023/1795), provides the current adequacy mechanism for EU-to-US personal data transfers. It replaced the Privacy Shield framework, which was invalidated by the CJEU in Schrems II (Case C-311/18, July 2020). Companies certified under the DPF may receive EU personal data without additional transfer safeguards. In September 2025, the EU General Court dismissed a legal challenge to the DPF (Case T-553/23), ruling that the Commission's adequacy decision was valid. The claimant's appeal is pending before the CJEU as Case C-703/25 P. The DPF remains in force as of mid-2026.

What does the EU AI Act mean for organisations in Ireland?

The EU AI Act (Regulation (EU) 2024/1689) applies in Ireland as EU law. Prohibited AI practices (including social scoring, subliminal manipulation, and real-time biometric identification for law enforcement) have been banned since 2 February 2025, and AI that generates non-consensual intimate images or child sexual abuse material is banned from 2 December 2026. Requirements for Annex III high-risk AI systems apply from 2 December 2027, and for AI in products covered by Annex I from 2 August 2028, under Regulation (EU) 2026/1744. Ireland's DPC is designated as a competent authority for AI systems that process personal data. Organisations using AI in employment, health, law enforcement, or financial services must assess whether their systems qualify as high-risk and prepare for conformity assessment requirements.

Do I need a Data Protection Officer in Ireland?

Under Article 37 GDPR, a DPO is mandatory for public authorities and bodies, for organisations whose core activities require regular and systematic monitoring of individuals on a large scale, and for organisations whose core activities involve large-scale processing of special categories of data (health, biometric, racial or ethnic origin, etc.). The DPO must have expert knowledge of data protection law, must be independent, and may not receive instructions regarding their tasks. Contact details must be published and notified to the DPC. Voluntary appointment is also permitted and may be beneficial for other organisations.

What happens if the DPC and other EU regulators disagree on a case?

When the DPC issues a draft decision in a cross-border case, other EU supervisory authorities may raise relevant and reasoned objections within four weeks. If consensus cannot be reached, the matter goes to the EDPB for a binding dispute resolution decision under Article 65 GDPR. The EDPB has overruled the DPC in the WhatsApp, Meta (transfers), Instagram, and Meta (advertising legal basis) cases, resulting in higher fines and broader compliance orders. In January 2025, the EU General Court dismissed the DPC's challenges (Cases T-70/23, T-84/23 and T-111/23), upholding the EDPB's power to require the DPC to carry out further investigations and issue new draft decisions.

How do I file a data protection complaint in Ireland?

Contact the organisation first and allow one month for a response. If you are unsatisfied, file a complaint with the DPC at dataprotection.ie, free of charge, using its online webform. The DPC must provide an update or outcome within three months, and where it considers an amicable resolution reasonably likely it may try to arrange one. The DPC does not award compensation to complainants. For damages, you can bring a data protection action under section 117 of the Data Protection Act 2018 in the District Court, Circuit Court or High Court, and damage includes non-material damage such as distress. You also retain the right under Article 79 GDPR to go to court independently of any DPC complaint.