GDPR in Ireland: Your Privacy Rights Explained

The General Data Protection Regulation (GDPR) is the cornerstone of privacy law across the European Union, and in Ireland it is enforced through the Data Protection Act 2018 and overseen by the Data Protection Commission (DPC). Because so many of the world's largest technology companies — including Meta, Google, TikTok, LinkedIn and Apple — have their European headquarters in Dublin, Ireland's regulator plays an outsized role in shaping how GDPR is applied across the entire bloc.

This guide explains your GDPR privacy rights as an individual in Ireland, how organisations must handle your personal data, and the practical steps you can take if your rights are breached.

What Is GDPR and How Does It Apply in Ireland?

GDPR is an EU-wide regulation that came into force on 25 May 2018. It governs how personal data of individuals in the EU and European Economic Area must be collected, stored, processed and shared. In Ireland, it is implemented through the Data Protection Act 2018, which also establishes the Data Protection Commission as the national supervisory authority.

GDPR applies to any organisation — whether based in Ireland, elsewhere in the EU, or outside the EU — that processes the personal data of people located in Ireland. This includes small Irish businesses, public bodies like the HSE and Revenue, and multinational tech firms with Irish subsidiaries.

What Counts as Personal Data?

Personal data is any information relating to an identified or identifiable living person. Examples include:

• Name, address, phone number, email address
• PPS number, passport details, driving licence
• IP address, device identifiers, cookie IDs
• Location data, CCTV footage, biometric data
• Health records, financial information, employment history
• Opinions and preferences expressed online

A special category of "sensitive" personal data — including information about health, race, religion, political opinions, trade union membership, sexual orientation and genetic or biometric data — receives extra protection and generally requires explicit consent to process.

Your Eight Core GDPR Rights in Ireland

Every individual in Ireland has eight fundamental rights under GDPR. These apply free of charge in most cases, and organisations must respond within one month of your request.

1. The Right to Be Informed

Organisations must tell you clearly what data they collect, why, how long they keep it, who they share it with, and what your rights are. This is usually delivered through a privacy notice or privacy policy on their website.

2. The Right of Access

You can submit a Subject Access Request (SAR) to any organisation holding your data. They must provide a copy of the personal data they hold about you, along with details of how it is being used.

3. The Right to Rectification

If data about you is inaccurate or incomplete, you can require it to be corrected or updated.

4. The Right to Erasure ("Right to Be Forgotten")

In certain circumstances, you can ask for your personal data to be deleted — for example, when it is no longer needed for the purpose it was collected, or when you withdraw consent and there is no other legal basis for processing.

5. The Right to Restrict Processing

You can require an organisation to stop actively processing your data while a dispute is being resolved, such as when you contest the accuracy of the data.

6. The Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format (such as CSV or JSON) and transfer it to another provider — useful when switching banks, email providers or social networks.

7. The Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. For direct marketing, the objection is absolute: the organisation must stop immediately.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions based solely on automated processing — including profiling — that produce legal or similarly significant effects, such as automated loan refusals or job application screening.

Lawful Bases for Processing Personal Data

Under GDPR, every organisation processing your data must rely on one of six lawful bases. Understanding these helps you assess whether your data is being handled legitimately.

Lawful Basis	When It Applies	Common Example in Ireland
Consent	You freely give specific, informed permission	Signing up to a marketing newsletter
Contract	Processing is necessary to perform a contract	Delivering goods ordered from an Irish retailer
Legal Obligation	Required by Irish or EU law	Revenue processing tax records
Vital Interests	Needed to protect someone's life	Emergency medical treatment by HSE
Public Task	Carried out in the public interest	Local council providing public services
Legitimate Interests	Necessary for the organisation's interests, balanced against your rights	Fraud prevention by a bank

How to Make a Subject Access Request in Ireland

A Subject Access Request (SAR) is the most commonly exercised GDPR right. Here is a practical step-by-step process for making one.

1. Identify the controller. Find out which organisation holds your data. Check their privacy policy for a Data Protection Officer (DPO) or privacy contact.
2. Put your request in writing. Email or post works. State clearly: "I am making a Subject Access Request under Article 15 of the GDPR."
3. Specify what you want. Either request all data held about you, or narrow it down (e.g., "all emails mentioning me between January and June 2026").
4. Provide proof of identity. The controller may ask for ID to confirm you are who you say you are.
5. Wait up to one month. They must respond within 30 calendar days. This can be extended by two further months for complex requests, but they must tell you why.
6. Review the response. If information is missing or redacted without justification, you can push back or complain to the DPC.

SARs are free in most cases. A fee may be charged only if the request is "manifestly unfounded or excessive" — for example, repeated identical requests.

The Role of the Data Protection Commission

The Data Protection Commission (DPC), headquartered in Dublin with an office in Portarlington, is Ireland's independent supervisory authority. It has three main functions:

• Handling complaints from individuals who believe their rights have been breached.
• Investigating organisations for suspected GDPR violations, often as the "lead supervisory authority" for multinationals headquartered in Ireland.
• Issuing guidance and fines. The DPC has imposed some of the largest GDPR fines in Europe, including a €1.2 billion fine against Meta in 2023 for unlawful data transfers.

How to Make a Complaint to the DPC

If an organisation does not respond adequately to your request, you can lodge a complaint with the DPC free of charge. The process typically involves:

1. Trying to resolve the issue directly with the organisation first (recommended but not mandatory).
2. Submitting a complaint via the DPC website (dataprotection.ie) with supporting evidence.
3. The DPC assessing admissibility and attempting amicable resolution.
4. If unresolved, a formal statutory inquiry may be opened, potentially leading to enforcement action.

GDPR, Cookies and the ePrivacy Rules

In Ireland, website tracking is governed by both GDPR and the ePrivacy Regulations 2011 (SI 336/2011). The DPC's 2020 Cookies Guidance is strict: websites must obtain prior, informed, opt-in consent before setting non-essential cookies.

What this means in practice:

• Pre-ticked boxes are not valid consent.
• "Reject all" must be as easy to click as "Accept all".
• Continuing to browse the site does not count as consent.
• Analytics, advertising and social media cookies all require consent.

If an Irish website drops tracking cookies before you click accept, it is likely in breach of the law — and you can complain to the DPC.

Protecting Your Privacy in Everyday Online Life

Knowing your rights is one half of the equation. The other half is reducing how much personal data you expose in the first place. Practical steps include:

• Use a privacy-focused browser such as Firefox or Brave, with tracker blocking enabled.
• Switch to encrypted DNS (DNS over HTTPS) to prevent your internet provider from logging the sites you visit.
• Review app permissions on your phone regularly and revoke anything unnecessary.
• Use strong, unique passwords with a password manager and enable two-factor authentication.
• Minimise data sharing when signing up for services — don't give a phone number if an email will do.
• Use link shorteners that respect privacy when sharing URLs publicly. Services such as Lunyb let you share and track links without exposing recipients to invasive third-party trackers. For a wider comparison, see our 2026 buyer's guide to URL shorteners.

Children's Data and the Digital Age of Consent

Ireland has set the digital age of consent at 16 under the Data Protection Act 2018. This means children under 16 cannot legally give consent for information society services (such as social media accounts) — parental consent is required instead.

The DPC also published the "Fundamentals for a Child-Oriented Approach to Data Processing" in 2021, which sets 14 principles organisations must follow when processing children's data, including "best interests of the child", transparency in child-friendly language, and strong default privacy settings.

What Happens When Companies Breach GDPR

GDPR fines can reach up to €20 million or 4% of global annual turnover, whichever is higher. Ireland's DPC has issued several landmark decisions, including:

Year	Company	Fine	Reason
2023	Meta (Facebook)	€1.2 billion	Unlawful EU–US data transfers
2023	TikTok	€345 million	Children's data processing failures
2022	Meta (Instagram)	€405 million	Children's account privacy settings
2021	WhatsApp	€225 million	Transparency failings

Beyond fines, affected individuals in Ireland can also pursue compensation through the courts for material or non-material damage — including distress — caused by a GDPR breach.

Common Myths About GDPR in Ireland

Myth 1: "GDPR only applies to big companies."

False. Every organisation processing personal data — from one-person sole traders to multinationals — must comply, although obligations scale with risk and size.

Myth 2: "I need to consent to everything."

False. Consent is only one of six lawful bases. A hospital, for example, does not need your consent to keep your medical records — it processes under legal obligation and vital interests.

Myth 3: "The right to be forgotten is absolute."

False. Erasure can be refused where processing is still necessary — for example, Revenue cannot delete your tax records on request.

Myth 4: "GDPR doesn't apply after Brexit."

Mostly false. In Ireland, GDPR continues to apply fully as EU law. UK organisations handling Irish residents' data must also comply.

Frequently Asked Questions

How long do organisations in Ireland have to respond to a GDPR request?

One calendar month from receipt of a valid request. This can be extended by up to two further months for complex or numerous requests, but the organisation must inform you of the extension and the reason within the first month.

Can I make a GDPR complaint to the DPC anonymously?

No. The Data Protection Commission requires complainants to identify themselves so it can investigate properly and communicate findings. However, your identity is not usually disclosed to the organisation without your consent during initial amicable resolution.

Does GDPR cover CCTV in Ireland?

Yes. CCTV footage identifying individuals is personal data. Businesses and homeowners using CCTV covering public areas must comply with GDPR, display signage, limit retention periods and respond to access requests from people captured on camera.

What is a Data Protection Officer and does my organisation need one?

A Data Protection Officer (DPO) is an independent expert who oversees GDPR compliance. Appointing one is mandatory for public authorities, organisations whose core activities involve large-scale monitoring, or those processing special category data on a large scale.

Can I claim compensation if my data is leaked in a breach?

Yes. Under Article 82 of GDPR and Section 117 of the Data Protection Act 2018, you can sue for compensation in the Irish Circuit Court for material damage (financial loss) and non-material damage (distress, anxiety) resulting from a GDPR infringement.

Final Thoughts

GDPR gives people in Ireland some of the strongest privacy rights in the world — but those rights only matter if you know how to use them. Whether it is submitting a Subject Access Request to find out what a company holds about you, objecting to intrusive marketing, or complaining to the Data Protection Commission when something goes wrong, the law puts real power in your hands.

Combine that legal protection with practical privacy habits — encrypted DNS, careful app permissions, privacy-respecting tools — and you will significantly reduce how exposed you are online. For a related read on choosing trustworthy online services, see our honest review of Lunyb.