GDPR in Ireland: Your Privacy Rights Explained

If you live in Ireland, the General Data Protection Regulation (GDPR) gives you some of the strongest privacy rights in the world. Combined with the Irish Data Protection Act 2018, GDPR controls how companies, websites, employers, and public bodies collect and use your personal data. This guide explains those rights in plain English, shows you how to exercise them, and highlights what to do when things go wrong.

What Is GDPR and Why Does It Matter in Ireland?

The General Data Protection Regulation is an EU-wide law that came into force on 25 May 2018. It governs how personal data about individuals in the EU is processed by organisations, whether those organisations are based in Ireland, elsewhere in Europe, or outside the EU entirely.

In Ireland, GDPR is enforced by the Data Protection Commission (DPC), headquartered in Dublin. Because many of the world's largest technology companies — including Meta, Google, TikTok, LinkedIn, and Apple — have their European headquarters in Ireland, the DPC acts as the lead supervisory authority for much of the EU. That makes Irish regulators uniquely influential in shaping global privacy enforcement.

For you as a resident, GDPR matters because it shifts the balance of power. Organisations must justify every use of your data, be transparent about what they do with it, and respond when you ask questions or make requests.

What Counts as Personal Data?

Personal data is any information that can identify a living individual, directly or indirectly. Under GDPR, this definition is deliberately broad.

Examples of personal data include:

• Your name, address, phone number, and email
• Your PPS number and other identifiers
• IP addresses, cookie identifiers, and device IDs
• Location data from your phone or car
• Photos, CCTV footage, and voice recordings
• Workplace records, performance reviews, and payroll data

A smaller subset, called special category data, enjoys extra protection. This includes information about your health, race or ethnic origin, religion, political opinions, trade union membership, sexual orientation, biometrics, and genetics. Organisations generally need explicit consent or another narrow legal basis to process this data.

Your Eight Core GDPR Rights

GDPR grants you eight specific rights over your personal data. Each applies whether the data controller is a shop in Galway, a government department, a hospital, or a US social media platform.

1. The Right to Be Informed

Organisations must tell you — clearly and up front — what data they collect, why they collect it, how long they keep it, who they share it with, and what your rights are. This is usually delivered through a privacy notice or policy. If a privacy notice is vague, hidden, or missing, that itself may be a breach.

2. The Right of Access

You can ask any organisation for a copy of the personal data they hold about you. This is called a Subject Access Request (SAR). The organisation must respond within one month and in most cases cannot charge a fee. You are also entitled to supplementary information, such as who the data has been shared with.

3. The Right to Rectification

If data about you is inaccurate or incomplete, you can require the organisation to correct it. For example, if your bank has an incorrect address or your medical record contains a factual error, you can insist on an update.

4. The Right to Erasure ("Right to Be Forgotten")

In certain circumstances you can require your data to be deleted — for instance, when it is no longer needed for the purpose it was collected, when you withdraw consent, or when it has been processed unlawfully. This right is not absolute: an employer may need to retain some records for tax law, and a hospital may need to keep clinical history for safety reasons.

5. The Right to Restrict Processing

You can ask an organisation to pause its use of your data while a dispute is being resolved — for example, while they verify whether the data is accurate or whether their legal basis is valid.

6. The Right to Data Portability

Where processing is based on consent or a contract and is carried out automatically, you can ask for a copy of your data in a structured, commonly used, machine-readable format. You can also ask that it be transmitted directly to another provider.

7. The Right to Object

You can object to processing based on "legitimate interests" or carried out in the public interest. You have an absolute right to object to direct marketing — once you do, the organisation must stop immediately.

8. Rights Related to Automated Decision-Making and Profiling

If a decision that significantly affects you — for example, loan approval or insurance pricing — is made purely by an algorithm, you have the right to request human review, express your point of view, and contest the outcome.

Legal Bases: Why Can Organisations Process Your Data at All?

Every piece of processing must rest on one of six legal bases. Understanding these helps you challenge misuse.

Legal Basis	Typical Example	Can You Withdraw?
Consent	Marketing emails, optional cookies	Yes, at any time
Contract	Delivering goods you ordered	Not easily — tied to the service
Legal obligation	Revenue tax reporting	No
Vital interests	Emergency medical treatment	No
Public task	Local authority services	Limited — right to object
Legitimate interests	Fraud prevention, basic analytics	Right to object applies

If a company cannot clearly identify a lawful basis — or relies on "consent" that was never freely given — the processing is unlawful.

How to Make a Subject Access Request in Ireland

A Subject Access Request is the single most powerful tool individuals have under GDPR. It costs nothing and forces organisations to show their hand.

1. Identify the data controller. Check the organisation's privacy policy for a dedicated email such as dpo@company.ie or privacy@company.com.
2. Put your request in writing. Email is fine. State clearly: "I am making a Subject Access Request under Article 15 of the GDPR."
3. Be specific where possible. You can ask for everything, or you can narrow the request (e.g. "all CCTV footage of me from 3 March" or "all emails mentioning my name between January and June").
4. Prove your identity. The organisation can ask for reasonable ID, but not excessive amounts.
5. Wait up to one calendar month. This can be extended by two months for complex requests, but they must tell you.
6. Review the response. You should receive the data itself plus the "supplementary information" required by GDPR.

If the response is incomplete, late, or refused without good reason, you can complain to the Data Protection Commission.

Making a Complaint to the Data Protection Commission

The DPC is Ireland's independent supervisory authority. You can lodge a complaint online at dataprotection.ie, by post to its Dublin or Portarlington offices, or by email.

Before complaining, the DPC generally expects you to have:

• Contacted the organisation directly
• Given them a reasonable chance to respond (typically one month)
• Kept copies of all correspondence

The DPC can investigate, mediate, order corrective action, and impose administrative fines. In landmark Irish-led cases, fines have reached hundreds of millions of euros — including record penalties against Meta for transatlantic data transfers and against TikTok for children's data handling.

You also retain the right to go to court for compensation if you have suffered material or non-material damage.

GDPR at Work: Your Rights as an Irish Employee

Employment is one of the most common areas where GDPR questions arise. Your employer is a data controller and must comply like any other organisation.

Monitoring and Surveillance

Employers can monitor emails, internet use, and CCTV only where there is a clear lawful basis, a documented policy, and proportionality. Covert monitoring is rarely lawful.

HR Files and References

You can make a SAR for your HR file, performance reviews, disciplinary records, and even internal emails that mention you. References received in confidence may be partly redacted, but the content is not automatically off-limits.

Biometric Clock-Ins

Fingerprint or facial recognition for timekeeping involves special category data. The DPC has repeatedly warned that less intrusive alternatives (PIN, swipe card) must be offered where possible.

Cookies, Tracking, and Online Privacy

Alongside GDPR, the ePrivacy Regulations 2011 govern cookies and electronic marketing in Ireland. The DPC's cookie guidance makes clear that:

• Non-essential cookies require prior, specific, and informed consent
• Pre-ticked boxes and "continue browsing to accept" banners are not valid
• Rejecting cookies must be as easy as accepting them

For personal privacy online, consider pairing GDPR rights with practical tools: a privacy-respecting browser, encrypted DNS, careful review of app permissions, and link tools that do not profile you. For example, when sharing URLs you can use a privacy-conscious shortener like Lunyb, which focuses on clean, trackable links without excessive third-party data collection — see our honest Lunyb review and the broader 2026 shortener buyer's guide for comparisons.

Data Breaches: What Should Happen

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Under GDPR, organisations must:

1. Notify the DPC within 72 hours where there is a risk to individuals' rights and freedoms.
2. Notify affected individuals "without undue delay" where there is a high risk — for example, if financial data or passwords have been exposed.
3. Document every breach internally, even the ones that do not require notification.

If you receive a breach notification, change affected passwords, enable two-factor authentication, monitor your bank statements, and consider a credit watch. You can also complain to the DPC if the organisation's handling of the breach was inadequate.

Children, Schools, and GDPR

In Ireland, the digital age of consent is 16. Below this age, parents or guardians must consent to information society services such as social media accounts. Schools, sports clubs, and apps that process children's data must apply the "best interests of the child" standard and should carry out Data Protection Impact Assessments for high-risk activities.

The DPC's "Fundamentals for a Child-Oriented Approach to Data Processing" document provides fourteen principles that organisations serving children are expected to follow.

Cross-Border Transfers After Schrems II

Max Schrems, an Austrian lawyer whose cases have been argued through the Irish courts, successfully challenged the EU-US Privacy Shield in 2020. Today, transfers of EU personal data to the US rely on the EU-US Data Privacy Framework and Standard Contractual Clauses, backed by extra technical and organisational safeguards.

For individuals, this means you can ask any Irish company that uses US cloud providers how your data is protected during international transfer. If the answer is unsatisfactory, that is a legitimate complaint ground.

Practical Steps to Protect Your Privacy Today

1. Read privacy policies of services you use most — focus on retention periods and third-party sharing.
2. Submit a SAR to a company you have long used (bank, telco, social network) just to see what they hold.
3. Opt out of direct marketing — the right is absolute, so use it.
4. Clear old accounts you no longer use by requesting erasure.
5. Enable two-factor authentication on email, banking, and cloud storage.
6. Review browser cookie preferences and app permissions quarterly.
7. Keep records of any privacy requests and the organisation's response.

Frequently Asked Questions

Does GDPR still apply in Ireland after Brexit?

Yes. GDPR applies across all EU member states, and Ireland remains an EU member. The UK now has its own "UK GDPR", but Irish residents' rights come from the EU regulation and the Data Protection Act 2018.

How long does an organisation have to respond to my Subject Access Request?

One calendar month from receipt. This can be extended by a further two months for complex or numerous requests, but the organisation must inform you of the extension and the reasons within the first month.

Can I be charged a fee for a Subject Access Request?

In almost all cases, no. A fee or refusal is only permitted where a request is "manifestly unfounded or excessive" — for example, if you repeatedly submit the same request. The burden is on the organisation to prove this.

What is the maximum GDPR fine in Ireland?

Fines can reach €20 million or 4% of a company's worldwide annual turnover, whichever is higher. Ireland's DPC has imposed some of the largest fines in Europe due to its role as lead supervisor for major tech companies.

Can I claim compensation for a GDPR breach?

Yes. Article 82 GDPR allows claims for material damage (financial loss) and non-material damage (such as distress). Claims are typically brought in the Circuit Court, and Irish courts have confirmed that proven, more-than-trivial distress can be compensable.

Final Thoughts

GDPR gives Irish residents a meaningful set of tools to understand, control, and reclaim their personal data. The rights are only as strong as your willingness to use them — submit the SAR, send the objection, lodge the complaint. The Data Protection Commission has shown it is willing to act, even against the world's largest technology companies, and your individual actions contribute to a stronger privacy culture across Ireland and the EU.