GDPR in Ireland: Your Privacy Rights Explained

Ireland sits at the heart of European data protection enforcement. With most of the world's largest tech companies headquartered in Dublin, the Irish Data Protection Commission (DPC) has become one of the most influential privacy regulators on the planet. Yet many Irish residents still don't fully understand what the General Data Protection Regulation (GDPR) means for them personally, or how to use it to take back control of their own information.

This guide explains your GDPR rights in Ireland in plain English — what they are, how to exercise them, which authority to contact, and what to expect when you make a complaint. Whether you're worried about a nuisance marketer, a data breach notification, or a social media platform that won't delete your account, the law is on your side.

What Is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is an EU-wide law that governs how organisations collect, store, and use personal data. It applies directly in Ireland and is supplemented by the Irish Data Protection Act 2018, which fills in national-level details such as the age of digital consent and the powers of the DPC.

GDPR applies to any organisation — public or private, Irish or foreign — that processes the personal data of people in Ireland. That includes everything from your local GP surgery to multinational platforms like Meta, Google, and TikTok, many of which have their European headquarters in Dublin.

What Counts as Personal Data?

Personal data is any information that can identify a living individual, directly or indirectly. In Ireland this includes:

• Name, address, email, phone number
• PPS number and Eircode
• IP addresses and device identifiers
• Photos, CCTV footage, and voice recordings
• Health, financial, and biometric data (treated as "special category" data with extra protection)
• Online identifiers such as cookies and advertising IDs

Your Eight Core GDPR Rights in Ireland

GDPR gives every individual in Ireland eight enforceable rights. These apply whether the organisation processing your data is based in Dublin, Berlin, or San Francisco — as long as they're targeting services at people in the EU.

1. The Right to Be Informed

You have the right to know who is collecting your data, why, how long it will be kept, and who it will be shared with. This is why you see privacy notices and cookie banners on Irish websites. The information must be concise, transparent, and in plain language.

2. The Right of Access (Subject Access Request)

You can ask any organisation for a copy of the personal data it holds about you. They must respond within one month and, in most cases, provide the data free of charge. This is one of the most powerful rights because it reveals exactly what's being stored.

3. The Right to Rectification

If data about you is inaccurate or incomplete, you can require the organisation to correct it. This is particularly important for credit records, medical files, and HR data.

4. The Right to Erasure ("Right to Be Forgotten")

You can ask for your data to be deleted when it's no longer needed, when you withdraw consent, or when it was processed unlawfully. This right isn't absolute — for example, your bank must keep certain records for anti-money-laundering purposes — but it's broad.

5. The Right to Restrict Processing

You can require an organisation to pause processing your data while a complaint or correction is being investigated.

6. The Right to Data Portability

You can ask for your data in a machine-readable format (like CSV or JSON) and have it transferred to another provider. Useful when switching banks, energy suppliers, or social platforms.

7. The Right to Object

You can object to processing based on "legitimate interests" or for direct marketing. If you object to marketing, the organisation must stop immediately — no questions asked.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions made purely by algorithms (such as automated loan refusals or insurance pricing) when they significantly affect you, and to request human review.

The Role of the Irish Data Protection Commission (DPC)

The DPC is Ireland's independent regulator for data protection, headquartered in Dublin with offices in Portarlington. Because so many large tech firms base their EU operations in Ireland, the DPC acts as the "lead supervisory authority" for cross-border cases under the GDPR's one-stop-shop mechanism.

What the DPC Does

• Investigates complaints from individuals
• Audits organisations for compliance
• Issues fines (which have reached into the hundreds of millions of euro)
• Provides guidance to businesses and the public
• Cooperates with other EU regulators through the European Data Protection Board

Recent DPC Enforcement Highlights

Over the past few years the DPC has issued some of the largest GDPR fines in Europe, targeting illegal data transfers, child-safety failings on social platforms, and insufficient legal bases for advertising. These cases set the standard not just for Ireland but for the entire EU.

How to Exercise Your GDPR Rights: Step by Step

Making a GDPR request in Ireland is straightforward and free in most cases. Here's how to do it properly.

1. Identify the data controller. This is the organisation that decides why and how your data is processed. Check their privacy policy for contact details.
2. Find the Data Protection Officer (DPO). Large organisations and public bodies must appoint one. Their email is usually something like dpo@company.ie.
3. Write a clear request. Specify which right you're invoking (access, erasure, etc.), include identification, and keep a copy for your records.
4. Wait up to one month. The organisation must respond within 30 days, extendable by two months for complex requests (they must tell you if they're extending).
5. Escalate if ignored. If they don't respond or you're unhappy with the outcome, you can complain to the DPC.

Sample Subject Access Request

You don't need legal language. A simple email like this is enough: "Under Article 15 of the GDPR, I request a copy of all personal data you hold about me, including the purposes of processing, categories of data, recipients, retention periods, and the source of the data if not collected from me. My account details are [X]. Please respond within one month."

Comparing GDPR Rights with Related Irish Protections

Cookies, Marketing, and Everyday Privacy in Ireland

Alongside GDPR, the Irish ePrivacy Regulations (SI 336/2011) govern cookies and electronic marketing. Websites must get your consent before setting non-essential cookies, and "reject all" must be as easy as "accept all" — a point the DPC has emphasised in guidance.

Nuisance Marketing

Unsolicited marketing calls, texts, or emails without consent are a criminal offence in Ireland. You can report them to the DPC, and offending companies have been prosecuted and fined through the District Court.

Protecting Yourself Online

Beyond knowing your rights, there are practical steps every Irish internet user can take to reduce exposure:

• Use a privacy-focused browser and enable tracking protection
• Switch to encrypted DNS (like 1.1.1.1 or 9.9.9.9)
• Review app permissions on your phone every few months
• Use strong, unique passwords with a password manager
• Be cautious with links from unknown sources — a privacy-respecting URL shortener like Lunyb can help you preview and share links without exposing unnecessary tracking data

If you share links professionally and want a tool that respects GDPR, our team has reviewed the market in the Best URL Shorteners Buyer's Guide 2026, and you can read an honest look at our own platform in Is Lunyb Legit?.

Data Breaches: What Happens When Things Go Wrong

Under GDPR, organisations must notify the DPC of a personal data breach within 72 hours of becoming aware of it, where there's a risk to individuals. If the risk is high, they must also notify you directly without undue delay.

What to Do If You Receive a Breach Notification

1. Change passwords for the affected service and any account that reuses the same password
2. Enable two-factor authentication
3. Monitor your bank statements and credit record if financial data was involved
4. Watch for phishing attempts referencing the breach
5. Consider filing a complaint with the DPC if you believe the organisation was negligent

Making a Complaint to the DPC

If an organisation ignores your request or mishandles your data, you can lodge a formal complaint with the Data Protection Commission. The process is free and can be done online at dataprotection.ie.

What to Include in Your Complaint

• Your contact details
• Name of the organisation involved
• A clear description of what happened and when
• Copies of any correspondence (your original request, their reply or lack of one)
• What outcome you're seeking

The DPC will try to resolve the issue amicably first, often through "amicable resolution". If that fails, a formal statutory inquiry may follow, which can result in binding decisions, corrective orders, and fines.

Special Considerations for Children and Sensitive Data

In Ireland, the digital age of consent is 16. Below that age, parental consent is required for information-society services like social media. The DPC's Fundamentals for a Child-Oriented Approach to Data Processing set high standards that platforms serving under-18s must follow.

Special category data — including health, religious beliefs, trade union membership, sexual orientation, and biometric data used for identification — requires an additional legal basis beyond ordinary processing, and organisations handling it face stricter accountability.

GDPR for Irish Businesses: A Quick Overview

If you run a business in Ireland, GDPR compliance isn't optional. Even sole traders processing customer emails must comply. Key obligations include:

• Maintaining a Record of Processing Activities (ROPA)
• Having a lawful basis for every processing activity
• Providing clear privacy notices
• Securing data with appropriate technical measures
• Signing Data Processing Agreements with third-party suppliers
• Reporting breaches within 72 hours

Non-compliance can lead to fines of up to €20 million or 4% of global annual turnover, whichever is higher.

Frequently Asked Questions

Is GDPR still in force in Ireland after Brexit?

Yes. Ireland remains in the EU, so GDPR applies in full. Brexit affected the UK, which now has its own "UK GDPR", but Irish residents are still protected by the EU regulation and enforced by the Irish DPC.

How long does an organisation have to respond to my data request?

One calendar month from receipt. They can extend by two further months for complex or multiple requests, but must inform you of the extension within the original month and explain why.

Can I be charged for a Subject Access Request?

Generally no. Requests must be free. A "reasonable fee" can be charged only if the request is manifestly unfounded, excessive, or if you ask for additional copies of previously provided data.

What's the difference between the DPC and the European Data Protection Board?

The DPC is Ireland's national regulator. The European Data Protection Board (EDPB) coordinates data protection authorities across the EU and issues binding decisions in cross-border disputes, particularly against the large tech firms headquartered in Ireland.

Can I sue a company directly for a GDPR breach?

Yes. Under Article 82 GDPR and the Data Protection Act 2018, you can bring a civil action in the Irish Circuit Court or High Court for material or non-material damage, including distress. You don't need to go through the DPC first, though many people do.

Conclusion

GDPR gives everyone in Ireland strong, practical rights over their personal data — and the Irish DPC is one of the most active enforcers in Europe. Understanding your rights is the first step; using them is the second. Whether you're asking for a copy of your data, correcting an inaccurate record, or stopping unwanted marketing, the law is designed to be accessible, and the DPC is there to back you up when organisations fall short.

Treat your personal data like you'd treat your passport or bank card: valuable, worth protecting, and ultimately yours to control.