GDPR in Ireland: Your Privacy Rights Explained

Ireland sits at the heart of European data protection enforcement. Because so many of the world's largest technology companies — Meta, Google, TikTok, Microsoft, Apple, LinkedIn — have their EU headquarters in Dublin, the Irish Data Protection Commission (DPC) acts as lead supervisory authority for a huge share of cross-border personal data processing in the EU. For Irish residents, that proximity translates into strong, actionable privacy rights under the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

This guide explains exactly what rights you have, how to exercise them, how the DPC handles complaints, and the practical steps you can take today to protect your personal data online.

What is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is the EU-wide law that governs how organisations collect, store, use, and share personal data about living individuals. In Ireland, GDPR is given domestic effect by the Data Protection Act 2018, and enforcement is handled by the Data Protection Commission based in Dublin and Portarlington.

GDPR applies to any organisation — public body, private company, charity, or sole trader — that processes the personal data of people in Ireland, regardless of where that organisation is based. That means a shop on Grafton Street and a social network based in California are both bound by the same rules when they handle your data.

Key Definitions You Should Know

• Personal data: any information relating to an identified or identifiable person — name, email, phone number, IP address, location data, cookie IDs, photos, or even voice recordings.
• Data controller: the organisation that decides why and how your data is processed (for example, your bank or employer).
• Data processor: a third party acting on the controller's instructions (for example, a cloud hosting provider).
• Special category data: sensitive information such as health, religion, ethnicity, trade union membership, biometric or genetic data — which attracts stronger protections.

Your Eight Core GDPR Rights in Ireland

GDPR gives every individual in Ireland eight enforceable rights over their personal data. You can exercise them directly with any organisation holding your information, usually free of charge, and they must respond within one calendar month.

1. The Right to Be Informed

Organisations must tell you — clearly and in plain language — what personal data they collect, why, how long they keep it, and who they share it with. This is normally delivered through a privacy notice or policy on their website or at the point of collection.

2. The Right of Access

You can submit a Subject Access Request (SAR) and receive a copy of all personal data an organisation holds about you, along with information about how it is being used. Responses are free and must be delivered within one month.

3. The Right to Rectification

If data about you is inaccurate or incomplete, you can require the organisation to correct or complete it without undue delay.

4. The Right to Erasure ("Right to Be Forgotten")

In certain circumstances — for example, when data is no longer necessary, or you withdraw consent — you can ask for your personal data to be deleted. This right is not absolute and may be refused where there is a legal obligation to retain records.

5. The Right to Restrict Processing

You can ask an organisation to pause processing your data while a dispute is resolved, for example while an accuracy complaint is being investigated.

6. The Right to Data Portability

Where data is processed by automated means based on consent or a contract, you can request it in a structured, commonly used, machine-readable format and transmit it to another provider.

7. The Right to Object

You can object to processing based on legitimate interests, direct marketing, or scientific/historical research. For direct marketing, your objection is absolute — the organisation must stop immediately.

8. Rights Related to Automated Decision-Making and Profiling

You have the right not to be subject to decisions based solely on automated processing — including profiling — that produce legal or similarly significant effects on you (such as credit scoring or recruitment screening).

How to Exercise Your GDPR Rights: A Step-by-Step Process

Making a GDPR request in Ireland is straightforward and free. Follow these steps:

1. Identify the data controller. Check the organisation's privacy policy — it usually names a Data Protection Officer (DPO) or privacy contact.
2. Write a clear request. State which right you are exercising (e.g. access, erasure, objection) and include enough identifying information for the organisation to locate your records.
3. Send it in writing. Email is fine. Keep a copy and note the date — this starts the one-month response clock.
4. Verify your identity if asked. Organisations may ask for reasonable proof of identity, but cannot demand excessive documentation.
5. Review the response. You should receive the data or a reasoned explanation within 30 days (extendable by two further months for complex requests, with notice).
6. Escalate if needed. If you are unhappy with the response, complain to the Data Protection Commission.

The Role of the Irish Data Protection Commission

The Data Protection Commission (DPC) is Ireland's independent regulator and the lead EU supervisory authority for most of the world's major tech platforms. It investigates complaints, conducts inquiries, issues fines, and provides guidance to both individuals and organisations.

How to Make a Complaint

If an organisation fails to respond to your request or you believe your rights have been breached, you can lodge a complaint with the DPC. Submit it via the online webform at dataprotection.ie, by post to 21 Fitzwilliam Square South, Dublin 2, or to the Portarlington office. There is no fee.

Notable Enforcement Actions

The DPC has issued some of the largest GDPR fines in Europe. These include multi-hundred-million-euro penalties against major social media and messaging platforms for issues such as unlawful transfers of EU data outside the EEA, inadequate transparency, and failures to protect children's data. These cases demonstrate that the regulator takes enforcement seriously — even against the biggest players.

Comparison: GDPR Rights vs Common Industry Practice

The table below shows the gap between what GDPR requires and what many online services actually deliver — and what you can demand.

Right	What GDPR Guarantees	Common Practice	What You Can Demand
Access	Full copy within 30 days, free	Partial exports via self-serve tools	A complete SAR response in writing
Erasure	Deletion where applicable	Account deactivation only	True deletion with written confirmation
Portability	Machine-readable export	PDFs or screenshots	JSON, CSV or similar structured file
Marketing opt-out	Immediate cessation	Up to 28 days to action	Stop immediately upon objection
Cookies	Freely-given, specific consent	Pre-ticked boxes or dark patterns	Equally easy "Reject All" option

Pros and Cons of the Irish GDPR Framework

Pros

• Among the strongest statutory privacy rights in the world.
• Free to exercise — no legal fees for standard requests.
• Independent regulator with real enforcement powers (fines up to €20 million or 4% of global turnover).
• Covers organisations based abroad if they target Irish users.
• Clear statutory timelines (one month to respond).

Cons

• Complaint investigations can take years, especially cross-border cases.
• The DPC has been criticised for the pace of inquiries into large platforms.
• Enforcement against SMEs and public bodies can be inconsistent.
• Individuals rarely receive direct compensation from fines issued.
• Complex legal bases (legitimate interests, public task) can be hard to challenge without legal advice.

Cookies, Trackers, and the ePrivacy Regulations

Alongside GDPR, Ireland enforces the ePrivacy Regulations 2011, which govern cookies and electronic marketing. Websites targeting Irish users must obtain your prior, informed consent before placing non-essential cookies — including analytics and advertising trackers.

In 2020 the DPC published updated cookie guidance making clear that:

• Pre-ticked consent boxes are invalid.
• Continuing to scroll does not constitute consent.
• "Reject All" must be as easy to click as "Accept All".
• Consent must be refreshed — typically every six months.

If you encounter a site that drops tracking cookies without consent, you can report it directly to the DPC.

Practical Steps to Protect Your Privacy Online

Knowing your rights is only half the battle. These practical measures reduce how much personal data organisations collect about you in the first place:

1. Review app permissions quarterly. On iOS and Android, revoke access to location, contacts, microphone and camera for apps that don't need them.
2. Use a privacy-respecting browser. Firefox, Brave and Safari offer strong default tracker blocking.
3. Enable encrypted DNS. DNS-over-HTTPS (DoH) prevents your network provider from seeing which sites you visit.
4. Create disposable email aliases for sign-ups you don't trust, so you can shut them off if abused.
5. Shorten and track links you share using a privacy-aware service. Tools like Lunyb let you shorten URLs without harvesting excessive personal data — useful for marketers and content creators who want to respect their own audience's privacy. You can read our honest review of Lunyb or compare alternatives in our 2026 URL shortener buyer's guide.
6. Opt out of direct marketing wherever you sign up — and remember the opt-out must be respected immediately under GDPR.
7. Request erasure from old accounts you no longer use.

GDPR for Irish Businesses: Key Obligations

If you run a business in Ireland that processes personal data, you have corresponding obligations. The core requirements are:

• Maintain a Record of Processing Activities (ROPA).
• Identify a lawful basis for every processing activity.
• Publish a clear, accessible privacy notice.
• Implement appropriate technical and organisational security measures.
• Report personal data breaches to the DPC within 72 hours where there is a risk to individuals.
• Appoint a Data Protection Officer if required (large-scale monitoring or special category data).
• Conduct Data Protection Impact Assessments (DPIAs) for high-risk processing.

Non-compliance can trigger administrative fines of up to €20 million or 4% of global annual turnover — whichever is higher.

Children's Data and the Fundamentals

Ireland has set the digital age of consent at 16. Information society services (social media, apps, online games) targeted at children must comply with the DPC's "Fundamentals for a Child-Oriented Approach to Data Processing" — a set of 14 principles including best-interests-of-the-child, transparency fit for children, and bans on profiling children for marketing. Parents and guardians can exercise GDPR rights on behalf of under-16s.

Frequently Asked Questions

How long does an organisation have to respond to my GDPR request in Ireland?

One calendar month from receipt of your request. This can be extended by a further two months for genuinely complex or numerous requests, but the organisation must tell you within the original month and explain why.

Can I be charged for a Subject Access Request?

No — the first copy of your data must be provided free of charge. A reasonable fee based on administrative cost may be charged only for additional copies, or if your request is manifestly unfounded or excessive (which is a high bar to meet).

What happens after I complain to the Data Protection Commission?

The DPC will acknowledge your complaint, usually try to resolve it amicably with the organisation, and if that fails may open a formal inquiry. Outcomes can include corrective orders, reprimands, or administrative fines. You will be kept informed of progress, though complex cases can take considerable time.

Does GDPR apply to data I share on social media?

Yes. Social media platforms are data controllers and must comply with GDPR for all users in Ireland. You can request access, erasure, and portability of your posts, messages, photos and metadata. The "household exemption" only applies to purely personal activity by individuals — it does not cover the platforms themselves.

Can I claim compensation if my GDPR rights are breached?

Yes. Article 82 GDPR and the Data Protection Act 2018 allow you to bring a civil action for material damage (financial loss) or non-material damage (distress) in the Irish courts. Recent Court of Justice of the EU case law has clarified that even non-material damage is compensable, though you must show actual harm rather than a mere technical breach.

Conclusion

GDPR gives everyone living in Ireland real, enforceable control over their personal data — backed by one of the most consequential regulators in the European Union. By understanding your eight core rights, knowing how to submit a request, and taking a few practical privacy steps in your daily online life, you can meaningfully reduce how much information is held about you and hold organisations to account when they get it wrong.

Whether you're an individual tightening up your digital footprint or a business building compliant services, treating privacy as a default — not an afterthought — is now both the legal and the ethical standard in Ireland.