GDPR in Ireland: Your Privacy Rights Explained

Ireland sits at the heart of Europe's data protection landscape. Home to the European headquarters of Meta, Google, TikTok, Apple, and Microsoft, Ireland's Data Protection Commission (DPC) is one of the most influential regulators in the world. For Irish residents, this means your privacy rights under the General Data Protection Regulation (GDPR) are not just theoretical — they are backed by a well-resourced regulator and reinforced by the Data Protection Act 2018.

This guide explains what GDPR means for you in Ireland, the eight core rights you can exercise, how to make a complaint, and how to protect your personal data in everyday life.

What Is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is an EU-wide law that governs how organisations collect, store, and use personal data. It came into force on 25 May 2018 and applies directly in Ireland, supplemented by the Data Protection Act 2018.

In Ireland, the regulator responsible for enforcing GDPR is the Data Protection Commission (DPC), based in Dublin and Portarlington. Because so many global tech companies have their EU headquarters in Ireland, the DPC acts as the "lead supervisory authority" for cross-border investigations into these firms under the GDPR's one-stop-shop mechanism.

GDPR applies whenever an organisation processes "personal data" — any information that can identify a living person. This includes your name, email address, IP address, location data, device identifiers, photos, financial details, PPS number, and health records.

Who Must Comply with GDPR in Ireland?

GDPR applies to:

Any business, charity, public body, or sole trader established in Ireland that processes personal data
Organisations outside the EU that offer goods or services to people in Ireland
Organisations that monitor the behaviour of people located in Ireland (for example, through tracking cookies or analytics)

Your Eight Core Privacy Rights Under GDPR

GDPR grants every person in Ireland eight enforceable rights over their personal data. Understanding these rights is the first step to protecting your privacy.

1. The Right to Be Informed

Organisations must tell you — in clear, plain language — what personal data they collect, why they need it, how long they keep it, who they share it with, and the legal basis for processing. This is usually delivered through a privacy notice on a website or app.

2. The Right of Access

You can ask any organisation for a copy of the personal data they hold about you. This is known as a Subject Access Request (SAR). The organisation must respond within one month, free of charge in most cases.

3. The Right to Rectification

If an organisation holds inaccurate or incomplete data about you, you can require them to correct or complete it without undue delay.

4. The Right to Erasure ("Right to Be Forgotten")

You can request that your data be deleted when it is no longer needed, when you withdraw consent, or when it has been processed unlawfully. This right is not absolute — organisations may refuse if they have a legal obligation to retain the data (for example, tax records).

5. The Right to Restrict Processing

You can ask an organisation to pause processing your data while a dispute is resolved — for instance, if you have challenged the accuracy of the data.

6. The Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format and transfer it to another service provider. This typically applies to data you have provided under consent or contract.

7. The Right to Object

You can object to processing based on legitimate interests, direct marketing, or scientific research. Objections to direct marketing must always be honoured.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal or similarly significant effects. This matters for credit scoring, insurance pricing, and some recruitment tools.

Comparison of Your Core GDPR Rights

Right	Response Deadline	Cost	Common Limitations
Access	1 month (extendable by 2 months)	Free (fee for excessive requests)	Third-party data must be protected
Rectification	1 month	Free	Data must be factually incorrect
Erasure	1 month	Free	Legal retention obligations
Restriction	1 month	Free	Temporary measure only
Portability	1 month	Free	Consent or contract basis only
Object	Immediate for marketing	Free	Compelling legitimate grounds may override

How to Exercise Your Rights: A Step-by-Step Guide

Making a GDPR request in Ireland is straightforward. Follow these steps:

Identify the data controller. This is the organisation that decides how your data is used. Their contact details are in their privacy policy.
Write a clear request. State which right you are exercising (for example, "I am making a Subject Access Request under Article 15 GDPR").
Verify your identity. The organisation may ask for proof of identity to prevent fraud.
Keep records. Save a copy of your request and the date it was sent.
Wait for a response. Organisations have one month to reply, extendable by two further months for complex requests.
Escalate if needed. If you are unhappy with the response, you can complain to the Data Protection Commission.

The Role of the Data Protection Commission (DPC)

The DPC is Ireland's independent supervisory authority for data protection. It handles complaints, investigates breaches, and imposes fines of up to €20 million or 4% of global annual turnover — whichever is higher.

How to Make a Complaint

If an organisation does not respond to your request, or you believe your rights have been breached, you can file a complaint with the DPC. You can do this through the online form at dataprotection.ie, by email, or by post to their offices in Dublin or Portarlington.

Before complaining to the DPC, it is best practice to:

Raise the issue directly with the organisation first
Give them a reasonable chance to respond
Keep copies of all correspondence

Notable DPC Enforcement Actions

The DPC has issued some of the largest GDPR fines in Europe, including a €1.2 billion fine against Meta in 2023 for unlawful transfers of EU user data to the United States, and significant penalties against TikTok, WhatsApp, and Instagram for issues ranging from children's privacy to transparency failings.

Special Protections for Children in Ireland

Ireland has set the digital age of consent at 16 years under the Data Protection Act 2018. This means children under 16 cannot legally consent to the processing of their personal data by information society services (such as social media) without parental authorisation.

The DPC has also published the "Fundamentals for a Child-Oriented Approach to Data Processing," which sets 14 principles that organisations must follow when children's data is involved. These include a child's "best interests first" test, floor of protection, and zero interference with children's rights.

Everyday Steps to Protect Your Personal Data

While GDPR provides strong legal protections, you can take practical steps to minimise the data you share and reduce your exposure to breaches.

1. Review App and Website Permissions

Check what data apps and websites can access. Revoke permissions that are not necessary for the service you use.

2. Use Strong, Unique Passwords

A password manager helps you create and store unique credentials for every account, reducing the impact of any single breach.

3. Enable Two-Factor Authentication

Where available, turn on two-factor authentication (2FA) for your email, banking, and social accounts. This blocks the vast majority of account takeover attempts.

4. Be Careful with Links

Phishing remains the number one way personal data is stolen. Before clicking a shortened link, consider previewing it with a trusted service. If you share links yourself — for business, newsletters, or social media — use a privacy-respecting shortener such as Lunyb that does not harvest excessive data from your audience. You can read our honest review of Lunyb or compare options in our 2026 URL shortener buyer's guide.

5. Use Encrypted DNS and Private Browsers

Enabling encrypted DNS (DNS over HTTPS) and switching to a privacy-focused browser like Firefox or Brave reduces how much of your browsing activity is visible to third parties.

6. Exercise Your Erasure Rights Regularly

Delete old accounts you no longer use. Each dormant account is a potential data breach waiting to happen.

GDPR and Marketing: What Irish Consumers Should Know

Under GDPR and the ePrivacy Regulations (S.I. 336 of 2011), organisations in Ireland must have your consent before sending electronic direct marketing — including email, SMS, and automated calls. There is a limited "soft opt-in" for existing customers, but you must always be given a free, easy way to unsubscribe.

Cookies that are not strictly necessary — including tracking and analytics cookies — also require your consent before being set. The DPC's cookie guidance makes clear that "continue browsing" banners or pre-ticked boxes are not valid consent.

Common Myths About GDPR in Ireland

Myth 1: "GDPR Means I Can Have Anything About Me Deleted"

The right to erasure is not absolute. Organisations may legitimately keep your data to comply with Revenue requirements, employment law, or ongoing legal proceedings.

Myth 2: "Small Businesses Are Exempt"

No. GDPR applies to organisations of all sizes. There are some reduced obligations for organisations with fewer than 250 employees — such as a lighter record-keeping requirement — but the core rights still apply.

Myth 3: "If I Consent Once, I Can Never Withdraw It"

Consent must be as easy to withdraw as it is to give. You can change your mind at any time.

Myth 4: "GDPR Only Covers Digital Data"

GDPR covers both electronic and structured paper records. Your medical file at a GP surgery is protected just as much as your online account.

FAQ: GDPR Privacy Rights in Ireland

How long does an organisation have to respond to a Subject Access Request in Ireland?

Organisations must respond within one calendar month of receiving the request. This can be extended by a further two months for particularly complex or numerous requests, but they must notify you of the extension within the first month and explain why.

Can I claim compensation if my GDPR rights are breached?

Yes. Under Article 82 GDPR and section 117 of the Data Protection Act 2018, you can bring a civil action for material damage (such as financial loss) or non-material damage (such as distress) in the Irish courts. Recent case law — including the Kaminski and Dillon decisions — has clarified that mere technical breaches without evidence of real harm may not succeed, so you should document the impact on you.

What is the digital age of consent in Ireland?

Ireland has set the digital age of consent at 16 under the Data Protection Act 2018. Children under 16 need parental consent before online services can process their personal data based on consent.

Do I need to pay a fee to make a GDPR request?

No. Requests are generally free. An organisation may only charge a "reasonable fee" based on administrative costs if your request is manifestly unfounded or excessive — for example, if it is repetitive. In practice, this is rare.

Does GDPR still apply when I share data with companies outside the EU?

Yes. When an Irish-established organisation transfers your data outside the European Economic Area, it must put appropriate safeguards in place — such as Standard Contractual Clauses or an adequacy decision from the European Commission. The DPC closely scrutinises international transfers, as seen in its landmark Meta decision in 2023.

Final Thoughts

GDPR gives you real, enforceable control over your personal data in Ireland. The Data Protection Commission is one of the most active regulators in Europe, and the rights outlined above are easy to exercise once you know they exist. Combine your legal rights with sensible everyday privacy practices — strong passwords, careful link handling, minimal data sharing — and you will be well positioned to protect yourself in 2026 and beyond.

If you run a business and share links with Irish or EU audiences, choose tools that align with GDPR by default. Our URL shortener comparison and Rebrandly review can help you pick a provider that respects your users' privacy.