GDPR in Ireland: Your Privacy Rights Explained

The General Data Protection Regulation (GDPR) gives people in Ireland some of the strongest privacy rights in the world. Whether you're shopping online, using social media, or signing up for a loyalty card at your local SuperValu, you have a legal right to know how your personal data is collected, used, and shared. This guide explains those rights in plain English, how the Irish Data Protection Commission (DPC) enforces them, and what you can do if a company gets it wrong.

What Is GDPR and How Does It Apply in Ireland?

GDPR is an EU-wide regulation that came into force on 25 May 2018. In Ireland, it is implemented alongside the Data Protection Act 2018, which fills in national-level detail such as the age of digital consent (set at 16 in Ireland) and the powers of the Data Protection Commission.

GDPR applies to any organisation — public or private, Irish or international — that processes the personal data of people located in the EU. Because Dublin hosts the European headquarters of Meta, Google, TikTok, LinkedIn, Microsoft and Apple, the Irish DPC acts as the lead supervisory authority for much of Europe. That makes Ireland one of the most consequential GDPR jurisdictions on the continent.

Who Enforces GDPR in Ireland?

The Data Protection Commission (DPC), based on Fitzwilliam Square in Dublin, is the independent authority responsible for upholding data protection rights. It handles complaints, carries out investigations, issues fines, and works with other EU regulators through the European Data Protection Board (EDPB).

Your Eight Core GDPR Rights

Under GDPR, every person in Ireland has eight fundamental rights over their personal data. Understanding each one is the first step to exercising them effectively.

1. The Right to Be Informed

Organisations must tell you — clearly and in plain language — what data they collect, why they collect it, how long they keep it, and who they share it with. This is usually delivered through a privacy notice at the point of data collection.

2. The Right of Access

You can request a copy of all personal data an organisation holds about you. This is known as a Subject Access Request (SAR). The organisation has one month to respond and must provide the information free of charge in most cases.

3. The Right to Rectification

If data about you is inaccurate or incomplete, you have the right to have it corrected without undue delay.

4. The Right to Erasure ("Right to Be Forgotten")

You can ask for your personal data to be deleted when it is no longer necessary, when you withdraw consent, or when it has been processed unlawfully. There are limits — for example, data needed for legal or tax reasons may be retained.

5. The Right to Restrict Processing

You can ask an organisation to pause processing your data while a dispute (such as about accuracy) is being resolved.

6. The Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format (like CSV or JSON) and move it to another service provider.

7. The Right to Object

You can object to processing based on legitimate interests, direct marketing, or scientific research. For direct marketing, the objection is absolute — the organisation must stop immediately.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions made solely by automated means (including profiling) that produce legal or similarly significant effects. This is increasingly important as AI-driven decisions enter banking, insurance, and recruitment.

Quick Reference: Your GDPR Rights at a Glance

Right	What It Means	Response Deadline
Be Informed	Clear privacy notice at data collection	At or before collection
Access	Copy of all personal data held	1 month
Rectification	Correct inaccurate data	1 month
Erasure	Delete data where legally allowed	1 month
Restrict Processing	Pause data use during disputes	1 month
Data Portability	Receive data in machine-readable form	1 month
Object	Stop processing (absolute for marketing)	Immediate for marketing
Automated Decisions	Human review of AI-driven decisions	Case by case

How to Make a Subject Access Request in Ireland

A Subject Access Request is the most commonly used GDPR right. Here is a step-by-step process to file one with any organisation operating in Ireland.

1. Identify the data controller. This is the company or body deciding how your data is used. Check their privacy policy or website footer.
2. Find the right contact. Most organisations publish a Data Protection Officer (DPO) email, such as dpo@company.ie.
3. Write a clear request. State that you are making a Subject Access Request under Article 15 GDPR. Include your full name, any account identifiers, and the period you are interested in.
4. Verify your identity. The controller may ask for ID — this is reasonable, but they should not demand more than is necessary.
5. Wait up to one month. If the request is complex, they can extend by two further months, but must tell you within the first month.
6. Review the response. Check that it is complete, intelligible, and that any third-party data has been appropriately redacted (not your own data).
7. Escalate if needed. If you are unhappy, complain internally first, then to the DPC.

Legal Bases for Processing Your Data

Organisations must have a lawful basis before processing your personal data. Under Article 6 GDPR there are six, and knowing which applies helps you understand your options.

• Consent — you have freely given clear permission (and can withdraw it).
• Contract — processing is necessary to fulfil a contract (e.g. delivering an order).
• Legal obligation — required by Irish or EU law (e.g. Revenue reporting).
• Vital interests — to protect someone's life.
• Public task — carried out by a public authority.
• Legitimate interests — a balanced business interest that does not override your rights.

Sensitive data — including health, religion, sexuality, political views, and biometric data — needs a stricter Article 9 basis, usually explicit consent.

Cookies, Tracking and the ePrivacy Regulations

In Ireland, cookies and similar technologies are governed by both GDPR and the ePrivacy Regulations 2011 (SI 336/2011). The DPC's 2020 Cookie Guidance made it clear that:

• Non-essential cookies require opt-in consent — pre-ticked boxes are not valid.
• "Reject All" must be as easy as "Accept All".
• Cookie walls that force consent in exchange for access are generally not lawful.
• Analytics cookies are not strictly necessary and need consent.

If you see a dodgy cookie banner on an Irish site, that is a legitimate complaint for the DPC.

How to File a Complaint with the Data Protection Commission

If an organisation fails to respect your rights, you can lodge a free complaint with the DPC. The process is straightforward.

1. Try to resolve it directly first. The DPC prefers that you give the organisation a reasonable chance to put things right.
2. Gather evidence. Keep copies of emails, screenshots, dates, and any responses received.
3. Submit via the DPC webform at dataprotection.ie, or by post to 21 Fitzwilliam Square South, Dublin 2.
4. Engage with the DPC caseworker. They may try informal resolution or launch a formal inquiry.
5. Appeal if necessary. You can appeal DPC decisions to the Circuit Court.

Complaints are free, and you do not need a solicitor. You can also claim compensation through the courts if you have suffered material or non-material damage.

Notable GDPR Enforcement in Ireland

The DPC has issued some of the largest GDPR fines in Europe, including:

• Meta (Facebook/Instagram) — €1.2 billion in 2023 for unlawful EU–US data transfers.
• TikTok — €345 million in 2023 over children's data processing.
• WhatsApp — €225 million in 2021 over transparency failings.
• LinkedIn — €310 million in 2024 for behavioural advertising practices.

These cases show that even the largest tech companies face real consequences — and that your rights are genuinely enforceable.

Practical Steps to Protect Your Privacy in Ireland

Knowing your rights is only half the battle. Here are everyday actions that strengthen your privacy posture.

1. Audit your accounts. Delete old services you no longer use. Each dormant account is a potential breach source.
2. Use strong, unique passwords with a reputable password manager.
3. Turn on two-factor authentication wherever possible — especially for Revenue, banking, and email.
4. Review app permissions on your phone every few months.
5. Check cookie settings before clicking "Accept All". Most Irish websites now offer granular controls.
6. Use privacy-respecting tools. For example, when sharing links online — whether for business or personal use — a URL shortener like Lunyb can help you share clean, trackable links without exposing unnecessary query parameters that often leak personal data. You can read our honest Lunyb review or compare options in our 2026 shortener buyer's guide.
7. Enable encrypted DNS (DNS over HTTPS) in your browser to reduce how much your network provider can see.

GDPR for Small Businesses in Ireland

If you run a small Irish business, GDPR compliance is not optional — but it is manageable. Focus on these essentials:

• Maintain a Record of Processing Activities (ROPA).
• Publish a clear, up-to-date privacy notice.
• Have a data breach response plan — breaches must be notified to the DPC within 72 hours.
• Train staff on basic data handling.
• Use processors (hosting, email, analytics providers) that offer Data Processing Agreements.
• Only transfer data outside the EEA under approved mechanisms (SCCs, adequacy decisions).

What's Changing in 2025–2026

The Irish and EU privacy landscape is evolving quickly. Watch for:

• The EU AI Act, phasing in through 2026, which overlaps significantly with GDPR for automated decisions.
• The Digital Services Act and Digital Markets Act, which the DPC co-enforces with the European Commission.
• Ongoing scrutiny of EU–US data transfers under the Data Privacy Framework.
• Expected guidance from the DPC on AI training data and generative models.

Frequently Asked Questions

Does GDPR apply to me if I am not an EU citizen but live in Ireland?

Yes. GDPR protects anyone physically located in the EU, regardless of citizenship. If you live, work, or are visiting Ireland, your rights apply to any organisation processing your data.

How long does an organisation have to respond to my Subject Access Request?

One calendar month from the date they receive your request. They can extend by up to two further months for complex requests, but must notify you within the first month and explain why.

Can I be charged for making a Subject Access Request?

In most cases, no. The response must be free. Organisations may charge a reasonable fee only if the request is manifestly unfounded, excessive, or repetitive — and they must justify this.

What is the difference between a data controller and a data processor?

A controller decides why and how your data is processed (e.g. your bank). A processor acts on the controller's instructions (e.g. a cloud hosting provider used by your bank). Your rights are generally exercised against the controller.

What should I do if my data has been breached?

The organisation must notify the DPC within 72 hours of becoming aware, and must notify you directly if the breach poses a high risk to your rights. Change affected passwords, monitor your accounts, and consider lodging a complaint with the DPC if the response is inadequate.

Final Thoughts

GDPR has transformed privacy in Ireland from a niche legal issue into an everyday right. The Data Protection Commission has shown — through billion-euro fines against the world's biggest tech firms — that these rights have real teeth. But rights only matter if you use them. Make a Subject Access Request. Reject unnecessary cookies. Audit your accounts. And when something feels wrong, complain. The system in Ireland is built so that ordinary people, not just lawyers, can hold organisations to account.