GDPR in Ireland: Your Privacy Rights Explained

Ireland sits at the heart of European data protection. With global tech giants like Meta, Google, TikTok, Apple, and Microsoft operating their EU headquarters in Dublin, the Irish Data Protection Commission (DPC) has become one of the most influential regulators in the world. For Irish residents, this means your privacy rights under the General Data Protection Regulation (GDPR) are not only robust on paper — they are actively enforced in practice.

This guide explains exactly what GDPR means for you in Ireland, the eight fundamental rights you can exercise, how to make a complaint, and what organisations must do when they handle your personal data.

What Is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is an EU-wide law that came into force on 25 May 2018. It governs how organisations collect, store, use, and share personal data about individuals in the European Economic Area (EEA). In Ireland, GDPR is implemented alongside the Data Protection Act 2018, which fills in national-level details and establishes the DPC as the lead supervisory authority.

GDPR applies to any organisation — regardless of where it is based — that processes personal data of people in Ireland. That includes Irish SMEs, multinationals headquartered in Dublin's Silicon Docks, public bodies, charities, and even sole traders who keep customer lists.

What Counts as Personal Data?

Personal data is any information that can identify a living individual, either directly or indirectly. Examples include:

• Name, address, phone number, email
• PPS number, passport number, Eircode
• IP address, device identifiers, cookies
• Photos, CCTV footage, voice recordings
• Location data and online browsing behaviour
• Health records, biometric data, genetic data (special category)

Your Eight GDPR Rights as an Irish Resident

GDPR grants you eight specific rights over how your personal data is used. Each one is enforceable, free of charge in most cases, and must be responded to within one month.

1. The Right to Be Informed

Organisations must tell you — clearly and in plain language — what data they collect, why, how long they keep it, and who they share it with. This is usually delivered through a privacy notice on a website, in an app, or at the point of data collection.

2. The Right of Access

You can request a copy of all personal data an organisation holds about you. This is known as a Subject Access Request (SAR). The response must be provided within one month and is free unless the request is "manifestly unfounded or excessive".

3. The Right to Rectification

If data about you is inaccurate or incomplete, you can require the controller to correct it without undue delay.

4. The Right to Erasure ("Right to Be Forgotten")

You can ask for your data to be deleted when, for example, it is no longer needed for the original purpose, you withdraw consent, or the processing was unlawful. Some exceptions apply — for instance, where a company must keep records for Revenue or legal defence purposes.

5. The Right to Restrict Processing

You can require an organisation to pause processing your data while a dispute is being resolved (for example, while they verify its accuracy).

6. The Right to Data Portability

You can obtain your data in a structured, commonly used, machine-readable format (such as CSV or JSON) and transfer it to another service provider.

7. The Right to Object

You can object to processing based on legitimate interests, direct marketing, or profiling. For direct marketing, your objection is absolute — the organisation must stop immediately.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions made solely by automated means (including profiling) that produce legal or similarly significant effects — unless specific safeguards apply.

Quick Comparison: GDPR Rights at a Glance

Right	What You Can Do	Response Time	Cost
Be Informed	Know what's collected and why	At point of collection	Free
Access	Request a copy of your data	1 month	Free
Rectification	Correct inaccurate data	1 month	Free
Erasure	Request deletion	1 month	Free
Restrict Processing	Pause data use	1 month	Free
Data Portability	Receive data in portable format	1 month	Free
Object	Stop certain processing	1 month	Free
Automated Decisions	Request human review	1 month	Free

The Role of the Irish Data Protection Commission (DPC)

The DPC, based in Dublin and Portarlington, is Ireland's independent regulator for data protection. Because so many multinational tech firms have their EU headquarters in Ireland, the DPC acts as the lead supervisory authority for cross-border cases across the entire EU — a role known as the "one-stop-shop" mechanism.

Since 2018, the DPC has issued some of the largest GDPR fines on record, including:

• €1.2 billion against Meta (2023) for unlawful EU–US data transfers
• €405 million against Instagram (2022) for children's data handling
• €345 million against TikTok (2023) for children's privacy settings
• €265 million against Meta (2022) for a data scraping incident

These enforcement actions demonstrate that the regulator takes complaints from Irish residents seriously — and that even the world's biggest companies are held accountable.

How to Exercise Your GDPR Rights: A Step-by-Step Guide

1. Identify the controller. Find out which organisation holds your data. This is often in the privacy policy, usually linked at the footer of a website.
2. Contact the Data Protection Officer (DPO). Larger organisations and all public bodies must appoint a DPO. Their contact details should be published.
3. Submit your request in writing. Email is fine. State clearly which right you are exercising (e.g. "I am making a Subject Access Request under Article 15 GDPR").
4. Verify your identity. The controller may ask for proof of ID to ensure they're not disclosing data to the wrong person.
5. Wait up to one month. The controller can extend by two further months for complex requests, but must tell you why.
6. Escalate if unsatisfied. If you get no response, an inadequate response, or a refusal, you can complain to the DPC.

How to Make a Complaint to the DPC

If an organisation has mishandled your personal data or ignored a rights request, you can file a complaint directly with the Data Protection Commission. The process is free and does not require a solicitor.

Steps to File a Complaint

1. Gather evidence: copies of your original request, the organisation's reply (if any), and relevant correspondence.
2. Visit dataprotection.ie and use the online complaint form, or email info@dataprotection.ie.
3. Describe the issue clearly, including dates, names, and the right you believe was violated.
4. The DPC will acknowledge receipt and may try to mediate between you and the organisation before launching a formal inquiry.
5. If the DPC finds a breach, it can issue reprimands, order corrective action, or impose fines of up to €20 million or 4% of global turnover.

You also retain the right to seek a judicial remedy through the Irish courts, including compensation for material or non-material damage (such as distress).

Common GDPR Scenarios in Everyday Irish Life

CCTV at Your Neighbour's House

If a domestic CCTV camera captures footage beyond the household's own property — for example, pointing at a public road or your garden — GDPR applies. You can request access to footage of yourself and ask for the camera to be repositioned.

Employer Monitoring

Your employer can monitor emails or internet use only if they have a lawful basis, have told you in advance (usually via an acceptable use policy), and the monitoring is proportionate. Covert monitoring is rarely lawful.

Marketing Calls and Emails

Under the ePrivacy Regulations 2011 and GDPR, companies need your consent for electronic marketing. You can object at any time, and persistent unsolicited calls can be reported to both the DPC and ComReg.

Health Data in Hospitals and GP Surgeries

Health information is "special category data" and attracts the highest protections. You can request your full medical record from the HSE, a private hospital, or your GP — and corrections if anything is inaccurate.

Protecting Your Privacy Beyond GDPR

GDPR gives you powerful legal rights, but day-to-day privacy also depends on the tools and habits you use online. A few practical steps help limit how much personal data gets collected in the first place:

• Use a privacy-respecting browser and block third-party cookies by default.
• Enable encrypted DNS (DNS over HTTPS) to prevent your internet provider from logging every site you visit.
• Review app permissions on your phone — especially location, microphone, and contacts.
• Use a reputable password manager and enable two-factor authentication wherever possible.
• Be mindful when sharing links on social media; shortened links can sometimes track clicks. Choose a shortener with a transparent privacy policy, such as Lunyb, which offers link shortening without aggressive tracking. For more context, see our honest review of Lunyb and our wider 2026 URL shortener comparison.

What Businesses in Ireland Must Do

If you run a business — from a Dublin start-up to a Galway café with a loyalty scheme — GDPR applies to you. The core obligations include:

• Maintain a Record of Processing Activities (ROPA)
• Publish a clear, accessible privacy notice
• Identify a lawful basis for each processing activity
• Implement "appropriate technical and organisational measures" to secure data
• Report personal data breaches to the DPC within 72 hours of becoming aware
• Carry out Data Protection Impact Assessments (DPIAs) for high-risk processing
• Appoint a DPO if you are a public body or carry out large-scale monitoring or processing of special category data

Pros and Cons of Ireland's GDPR Framework

Pros

• Strong, enforceable rights backed by one of the most active EU regulators
• Free complaint process accessible to any resident
• Significant fines create real deterrence against misuse of personal data
• Harmonised rules across the EU make cross-border rights straightforward

Cons

• DPC investigations can take years to conclude, particularly against large tech firms
• Small businesses sometimes struggle with compliance costs and complexity
• "Consent fatigue" from cookie banners has reduced meaningful user choice
• Enforcement priorities are sometimes criticised as being too lenient on Irish-based tech multinationals

Frequently Asked Questions

How long does an organisation have to respond to a Subject Access Request in Ireland?

One calendar month from receipt of the request. This can be extended by a further two months if the request is complex or involves multiple requests, but the controller must inform you of the extension and the reason within the first month.

Can I claim compensation for a GDPR breach?

Yes. Under Section 117 of the Data Protection Act 2018, you can bring a civil action in the Circuit Court for material damage (such as financial loss) or non-material damage (such as distress or anxiety) caused by a breach of your data protection rights.

Does GDPR apply to data about deceased family members?

No. GDPR only protects living individuals. However, some confidentiality duties (for example, under HSE policies or medical ethics) may still apply to records of deceased persons.

What is the difference between a data controller and a data processor?

A controller decides why and how personal data is processed (for example, your employer or bank). A processor acts on the controller's instructions (for example, a cloud hosting provider or payroll bureau). You can exercise your rights against the controller, who is primarily responsible for compliance.

Can I use GDPR to remove old news articles about me from Google?

Yes, in some circumstances. Following the Google Spain ruling and GDPR's right to erasure, you can ask search engines to de-list results that are inaccurate, inadequate, irrelevant, or excessive. Google has an online form for this. The outcome balances your privacy against the public interest in the information remaining available.

Final Thoughts

GDPR has transformed privacy in Ireland from a niche legal concern into a fundamental right that every resident can actively use. Whether you're asking your bank for a copy of your records, telling a retailer to stop sending marketing emails, or complaining to the DPC about a data breach, the law is firmly on your side. Understanding your eight rights — and knowing how to exercise them — is the first step to taking real control of your digital life.