GDPR in Ireland: Your Privacy Rights Explained

The General Data Protection Regulation (GDPR) gives everyone in Ireland powerful control over how their personal data is collected, stored, and used. Whether you're shopping online, using social media, or applying for a job, Irish law — reinforced by the Data Protection Act 2018 — guarantees you a set of enforceable rights. This guide explains exactly what those rights are, how to use them, and what to do when a company refuses to comply.

What Is GDPR and How Does It Apply in Ireland?

The GDPR is an EU-wide regulation that came into force on 25 May 2018. It governs how organisations process the personal data of individuals in the EU and EEA. In Ireland, it is supplemented by the Data Protection Act 2018 and enforced by the Data Protection Commission (DPC), based in Dublin.

Because many of the world's largest tech companies — including Meta, Google, TikTok, Apple, and Microsoft — have their European headquarters in Ireland, the Irish DPC is often the lead supervisory authority for cross-border cases. This gives Irish residents an unusually direct line to regulators handling some of the biggest privacy decisions in Europe.

Who Does GDPR Protect?

GDPR protects any identifiable natural person (a "data subject") whose personal data is processed by an organisation. If you live in Ireland, you are protected whenever:

An Irish or EU-based company processes your data.
A non-EU company offers goods or services to you in Ireland.
A non-EU company monitors your behaviour (for example, through tracking cookies) while you're in Ireland.

What Counts as Personal Data?

Personal data is any information relating to an identified or identifiable person. This includes obvious items like your name, address, PPSN, and email, but also IP addresses, device identifiers, location data, photographs, biometric data, and even opinions about you.

Your Eight Core GDPR Rights in Ireland

GDPR grants data subjects eight distinct rights. Every organisation handling your data — from your local GP to multinational platforms — must respect them. Here is a quick comparison of each right and when to use it.

Right	What It Means	Typical Use Case
Right to be informed	Clear information about how your data is used	Reading a privacy notice
Right of access	Get a copy of your personal data	Subject Access Request (SAR)
Right to rectification	Correct inaccurate or incomplete data	Fixing a wrong address with your bank
Right to erasure	Have data deleted ("right to be forgotten")	Removing an old account
Right to restrict processing	Pause use of your data	While disputing accuracy
Right to data portability	Receive data in a reusable format	Switching service providers
Right to object	Stop processing, e.g. for marketing	Opting out of profiling
Rights re automated decisions	Human review of AI-driven decisions	Loan or insurance scoring

1. The Right to Be Informed

Before an organisation collects your data, it must tell you who they are, why they want the data, how long they'll keep it, who they share it with, and your rights. This information is usually found in a privacy notice or policy. If a notice is vague, buried, or missing, that is itself a GDPR breach.

2. The Right of Access (Subject Access Request)

You can ask any organisation for a copy of all personal data they hold about you. This is called a Subject Access Request (SAR). Key points:

Requests are free (except for "manifestly unfounded or excessive" ones).
Organisations must respond within one month.
They may extend by two months for complex requests, but must tell you.
You can submit by email, letter, or sometimes an in-app form.

3. The Right to Rectification

If data about you is wrong or incomplete, you can demand correction. Organisations must act without undue delay — generally within one month — and inform any third parties they've shared the data with.

4. The Right to Erasure

Often called "the right to be forgotten," this lets you have your data deleted when:

The data is no longer needed for the original purpose.
You withdraw consent and there's no other legal basis.
You object and no overriding legitimate interest exists.
The data was processed unlawfully.
Erasure is required by Irish or EU law.

There are exceptions — for example, your bank must retain certain records for anti-money-laundering compliance.

5. The Right to Restrict Processing

You can temporarily "freeze" the use of your data — for example, while you dispute its accuracy or while a complaint is being investigated. The organisation can still store the data but cannot otherwise use it.

6. The Right to Data Portability

Where processing is based on consent or a contract and is done by automated means, you can request your data in a structured, commonly used, machine-readable format (such as CSV or JSON). You can even ask that it be sent directly to another provider — useful when switching email providers, fitness apps, or streaming services.

7. The Right to Object

You have an absolute right to object to direct marketing — companies must stop immediately. For processing based on legitimate interests or public tasks, you can object on grounds relating to your particular situation, and the organisation must stop unless it can demonstrate compelling overriding interests.

8. Rights Related to Automated Decision-Making and Profiling

If a decision that significantly affects you is made purely by an algorithm — such as an automated credit refusal — you have the right to human intervention, to express your point of view, and to contest the decision.

How to Make a GDPR Request in Ireland: Step-by-Step

Exercising your rights is simpler than most people think. Here is the standard process:

Identify the data controller. This is the organisation that decides how and why your data is processed.
Find their contact point. Look for a Data Protection Officer (DPO), privacy email, or privacy portal.
Write your request. State clearly which right you are exercising and what data or action you want.
Verify your identity. Organisations may ask for reasonable proof — but cannot demand excessive documentation.
Track the one-month deadline. Note the date and set a reminder.
Escalate if ignored. If the organisation refuses or ignores you, complain to the DPC.

Sample Subject Access Request Template

"Dear [Company], Under Article 15 of the GDPR, I request a copy of all personal data you hold about me, including the purposes of processing, categories of data, recipients, retention periods, and the source of any data not collected directly from me. My details are: [name, email, account ID]. Please respond within one month. Kind regards, [Your name]."

The Role of the Irish Data Protection Commission (DPC)

The DPC is Ireland's independent regulator for data protection. It handles complaints, conducts investigations, issues fines, and provides guidance. Because of Ireland's role as an EU tech hub, the DPC has issued some of the largest GDPR fines on record — including multi-hundred-million-euro penalties against major social networks.

How to Make a Complaint to the DPC

Try to resolve the issue directly with the organisation first.
Gather evidence: your request, their response (or lack of one), screenshots, and dates.
Submit a complaint via the DPC's online webform at dataprotection.ie.
Cooperate with the DPC's case officer. Investigations can take months, but your rights are preserved throughout.

Complaints to the DPC are free, and you do not need a solicitor — though for complex cases, legal advice can help.

Practical Privacy Tips for Irish Residents

Knowing your rights is only half the battle. Reducing how much data you share in the first place is just as important. Here are practical steps anyone in Ireland can take today.

Minimise Data at the Source

Use a secondary email for newsletters and sign-ups.
Decline optional cookies — Irish guidance requires that "reject all" be as easy as "accept all".
Review app permissions on iOS and Android every few months.
Use encrypted DNS (such as DNS over HTTPS) in your browser to reduce passive tracking by network operators.
Prefer privacy-respecting browsers like Firefox or Brave for day-to-day browsing.

Share Links Without Oversharing

Many URLs carry tracking parameters (utm_source, fbclid, gclid) that leak information about where a link came from and who clicked it. When sharing links on social media, in emails, or in group chats, consider using a privacy-respecting URL shortener such as Lunyb, which strips surplus tracking and gives you clean, branded short links. You can read our honest breakdown in Is Lunyb Legit? An Honest Review or compare it to other tools in our 2026 URL shortener buyer's guide.

Protect Yourself from Breaches

Use a password manager and unique passwords for every account.
Enable two-factor authentication, preferably via an authenticator app rather than SMS.
Monitor breach notification services to see if your email has appeared in known leaks.
Freeze your credit file with Irish credit reference agencies if you suspect identity theft.

Common GDPR Myths in Ireland

Several misconceptions make it harder for people to use their rights. Let's clear them up.

Myth	Reality
"GDPR only applies to big tech."	It applies to almost every organisation, including small businesses, clubs, and schools.
"I need a reason for a SAR."	You don't. Organisations cannot demand justification.
"Companies can charge for data access."	Access is generally free.
"Brexit removed my UK data rights."	The UK has its own UK GDPR; your Irish rights remain unchanged, and cross-border protections still apply.
"Deleting my account deletes all my data."	Not always — backups and legal retention periods may apply.

Penalties and Why Companies Take GDPR Seriously

GDPR fines can reach up to €20 million or 4% of global annual turnover, whichever is higher. The DPC has issued record-breaking fines against major platforms headquartered in Dublin, which has prompted substantial changes to default privacy settings, advertising practices, and international data transfers across the industry.

Beyond fines, companies face reputational damage, lawsuits from affected individuals, and mandatory corrective actions ordered by the DPC — such as suspending certain data flows or re-engineering their systems.

Frequently Asked Questions

How long does an organisation have to respond to a GDPR request in Ireland?

The default response time is one calendar month from the date the request is received. For complex or multiple requests, this can be extended by up to two further months, but the organisation must notify you of the extension and the reasons within the first month.

Can I make a GDPR request on behalf of someone else?

Yes. You can act on behalf of a child, a family member, or anyone who has given you written authorisation. The organisation may ask for proof of your authority — such as a signed letter or power of attorney — before releasing information.

What should I do if a company ignores my GDPR request?

First, send a polite follow-up referencing the one-month deadline and the specific GDPR article. If there's still no satisfactory response, you can file a formal complaint with the Irish Data Protection Commission at dataprotection.ie. Complaints are free and can be made entirely online.

Does GDPR cover CCTV footage of me in Irish shops or workplaces?

Yes. CCTV images are personal data when you are identifiable. You can submit a Subject Access Request to receive footage of yourself, though organisations may blur other individuals to protect their privacy. Workplaces must also provide clear signage and a documented policy explaining why CCTV is used.

Do GDPR rights apply to data about me from before 2018?

Yes. GDPR applies to any personal data an organisation currently holds and processes, regardless of when it was originally collected. So you can request access to or deletion of records that pre-date 2018, as long as they are still being stored or used.

Conclusion

GDPR gives people in Ireland some of the strongest privacy rights in the world — and with the DPC based in Dublin, enforcement is close to home. The key is to actually use these rights: submit access requests, object to unwanted marketing, correct inaccurate records, and complain when organisations fall short. Combined with practical habits like minimising data sharing, using encrypted services, and cleaning up the links you share, you can take meaningful control of your digital footprint today.