GDPR in Ireland: Your Privacy Rights Explained (2026 Guide)

Ireland occupies a unique position in the European data protection landscape. As the European headquarters of Google, Meta, TikTok, Apple, LinkedIn, and countless other tech giants, the Irish Data Protection Commission (DPC) has become one of the most influential privacy regulators in the world. Yet many Irish residents remain unaware of the powerful rights the General Data Protection Regulation (GDPR) grants them over their personal information.

This guide explains exactly what your privacy rights are under GDPR in Ireland, how to exercise them, and what to do when organisations fail to respect your data.

What is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is a European Union law that came into force on 25 May 2018, giving individuals sweeping rights over how their personal data is collected, stored, and used. In Ireland, GDPR is implemented and supplemented by the Data Protection Act 2018.

The regulation applies to any organisation that processes the personal data of people living in Ireland, regardless of where that organisation is based. This means an Irish resident has the same rights whether their data is held by a local Dublin business, a UK bank, or a US-based social media company.

Who Enforces GDPR in Ireland?

The Data Protection Commission (DPC), headquartered in Dublin, is Ireland's independent regulator responsible for enforcing GDPR. Because so many multinational tech companies have their EU headquarters in Ireland, the DPC often acts as the lead supervisory authority for cross-border data protection issues affecting hundreds of millions of Europeans.

The DPC has the power to investigate complaints, conduct audits, and impose fines of up to €20 million or 4% of a company's global annual turnover, whichever is higher.

Your Eight Core Privacy Rights Under GDPR

GDPR grants Irish residents eight fundamental rights over their personal data. Understanding each one is the first step to protecting your privacy.

1. The Right to Be Informed

You have the right to know who is collecting your data, why they are collecting it, how long they will keep it, and who they will share it with. This information should be provided in a clear, plain-language privacy notice at the point of data collection.

2. The Right of Access

You can request a copy of all personal data an organisation holds about you. This is known as a Subject Access Request (SAR). The organisation must respond within one month, and in most cases, must provide the information free of charge.

3. The Right to Rectification

If an organisation holds inaccurate or incomplete data about you, you have the right to have it corrected or completed without undue delay.

4. The Right to Erasure ('Right to Be Forgotten')

You can request the deletion of your personal data in specific circumstances, such as when the data is no longer necessary for its original purpose, when you withdraw consent, or when the data has been unlawfully processed.

5. The Right to Restrict Processing

You can ask an organisation to pause the processing of your data while a dispute is being resolved, for example, if you have contested the accuracy of the information.

6. The Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another organisation. This applies to data you have provided directly and which is processed by automated means.

7. The Right to Object

You can object to the processing of your data for direct marketing, scientific research, or tasks carried out in the public interest. Objections to direct marketing must always be honoured.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects on you, such as automated loan refusals or job application screening.

How to Make a Subject Access Request in Ireland

A Subject Access Request is one of the most powerful tools available to Irish consumers. Here's a step-by-step process for making one effectively.

1. Identify the data controller. This is the organisation that decides how and why your data is processed. Their contact details should be in their privacy policy.
2. Write a clear request. State that you are making a Subject Access Request under Article 15 of GDPR. Include your full name, contact details, and any account references that will help them locate your data.
3. Specify the data you want. You can request all data or narrow it down to specific categories (e.g., emails, call recordings, purchase history).
4. Send the request in writing. Email is acceptable and creates a useful paper trail. Keep a copy of your request and any acknowledgement.
5. Wait for a response. The organisation has one calendar month to respond. This can be extended by two further months for complex requests, but they must inform you within the first month.
6. Review the response. Check that the data provided is complete and accurate. If not, you can follow up or escalate to the DPC.

Comparing GDPR Rights with Common Business Practices

The gap between what GDPR grants and how many businesses actually operate can be significant. This table shows some common scenarios.

Your GDPR Right	Common Business Practice	What You Can Do
Right to Erasure	Retaining data "just in case"	Submit a formal deletion request citing Article 17
Right of Access (free)	Charging administrative fees	Refuse to pay; report to the DPC
Right to Object to Marketing	Unsubscribe links that don't work	Send a written objection; file a complaint
Right to Be Informed	Buried, jargon-heavy privacy policies	Request clarification in plain language
Right to Data Portability	Locked-in proprietary formats	Insist on machine-readable export

Consent and Cookies: What Irish Websites Must Do

Under GDPR and the Irish ePrivacy Regulations, websites accessed from Ireland must obtain valid consent before placing non-essential cookies or trackers on your device. This means:

• Consent must be freely given, specific, informed, and unambiguous.
• Pre-ticked boxes and "cookie walls" that force you to accept are not valid.
• Rejecting cookies must be as easy as accepting them.
• You must be able to withdraw consent at any time.

The DPC has published detailed guidance and has fined several major companies for cookie violations. If you encounter a website that doesn't offer a clear "Reject All" option, that's a red flag worth reporting.

Data Breaches: Your Rights When Companies Lose Your Data

A personal data breach is any security incident that leads to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of your personal data. GDPR sets strict rules for how organisations must respond.

Notification Requirements

Data controllers must notify the DPC of a breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. If the breach poses a high risk to your rights and freedoms, the organisation must also notify you directly without undue delay.

What to Do If You're Affected

1. Change passwords immediately, especially if credentials were compromised.
2. Monitor financial accounts and credit reports for unusual activity.
3. Be alert to phishing attempts using leaked information.
4. Document any harm or losses you suffer as a result.
5. Consider making a complaint to the DPC if the organisation's response was inadequate.

How to File a Complaint with the Irish DPC

If you believe your data protection rights have been violated and the organisation has failed to resolve the issue, you can lodge a complaint with the Data Protection Commission.

1. Try to resolve directly first. Contact the organisation's Data Protection Officer (DPO) and give them a reasonable opportunity to address your concern.
2. Gather your evidence. Keep copies of correspondence, screenshots, and any relevant documents.
3. Submit the complaint. You can file online via the DPC website (dataprotection.ie), by post to 21 Fitzwilliam Square South, Dublin 2, or by email.
4. Provide detailed information. Include your contact details, the organisation involved, the nature of the complaint, and what outcome you are seeking.
5. Cooperate with the investigation. The DPC may ask for additional information as they investigate.

Complaints to the DPC are free, and you do not need a solicitor to make one.

Practical Steps to Protect Your Privacy Online

Knowing your rights is only half the battle. Taking proactive steps to minimise the data you expose in the first place is equally important.

Reduce Your Digital Footprint

• Delete accounts you no longer use.
• Review app permissions on your phone regularly.
• Use encrypted DNS services to prevent your internet provider from logging every site you visit.
• Choose privacy-focused browsers such as Brave or Firefox with strict tracking protection enabled.
• Use disposable or forwarding email addresses when signing up for newsletters or trials.

Be Careful with the Links You Share

Many URL shorteners and tracking services log detailed information about every person who clicks a link, including IP addresses, device details, and location data. When sharing links with friends, colleagues, or your audience, consider using a privacy-conscious tool. Lunyb, for example, is a URL shortener designed with GDPR compliance in mind, offering data minimisation by default. For a broader look at options, see our 2026 buyer's guide to URL shorteners.

Encrypt Sensitive Communications

Use end-to-end encrypted messaging apps like Signal for private conversations, and enable full-disk encryption on your laptop and phone. Two-factor authentication should be enabled on every important account.

Special Protections for Children's Data in Ireland

Ireland has set the digital age of consent at 16, meaning children under 16 cannot legally consent to the processing of their personal data by information society services. Instead, consent must be given or authorised by a parent or guardian.

The DPC has published the "Fundamentals for a Child-Oriented Approach to Data Processing," which sets out 14 principles that organisations must follow when processing children's data, including a "floor of protection" for all users where age cannot be verified.

GDPR Enforcement in Ireland: Notable Cases

The Irish DPC has issued some of the largest GDPR fines in Europe, demonstrating that these rights have real teeth.

• Meta (Instagram) – €405 million (2022): For mishandling children's data.
• Meta (Facebook) – €1.2 billion (2023): For unlawful transfers of EU user data to the United States.
• TikTok – €345 million (2023): For breaches involving children's accounts and privacy settings.
• WhatsApp – €225 million (2021): For transparency failures around data sharing.

These cases show that even the world's largest tech companies are being held accountable under Irish enforcement of GDPR.

Frequently Asked Questions

How long does an organisation have to respond to my Subject Access Request?

Under GDPR, organisations must respond within one calendar month of receiving your request. This deadline can be extended by up to two additional months for complex or numerous requests, but they must notify you of the extension within the first month and explain why.

Can I be charged for making a Subject Access Request in Ireland?

No. Subject Access Requests are free of charge in almost all cases. An organisation can only charge a "reasonable fee" if your request is manifestly unfounded, excessive, or if you are requesting additional copies of information already provided. Any charge must be justified and proportionate.

What's the difference between the Data Protection Commission and the Data Protection Act 2018?

The Data Protection Act 2018 is the Irish legislation that gives effect to GDPR in Irish law and provides for specific national derogations. The Data Protection Commission (DPC) is the independent statutory body established under that Act to enforce data protection law, investigate complaints, and impose sanctions on organisations that fail to comply.

Do UK companies still have to comply with Irish GDPR after Brexit?

Yes. Any organisation—regardless of location—that offers goods or services to people in Ireland or monitors their behaviour must comply with EU GDPR. UK companies dealing with Irish customers are therefore subject to both UK GDPR and EU GDPR, and Irish residents retain full rights against them.

Can my employer access my personal emails at work?

Generally, employers must have a lawful basis and a clear, proportionate policy to access employee communications. They must inform staff in advance about monitoring, and any access should be limited to what is strictly necessary. Accessing personal emails without justification can breach GDPR and Irish employment law, and complaints can be brought to both the DPC and the Workplace Relations Commission.

Conclusion

GDPR gives Irish residents some of the strongest privacy rights in the world, backed by a regulator with genuine enforcement power. But rights are only meaningful when they are exercised. Whether you are making a Subject Access Request, objecting to intrusive marketing, or reporting a data breach to the DPC, taking action sends a signal that privacy matters.

Combine your legal rights with practical privacy habits—minimising the data you share, using encrypted tools, and choosing services that respect your information by design—and you'll be well placed to keep your personal information under your control in 2026 and beyond.