GDPR in Ireland: Your Privacy Rights Explained

Ireland sits at the heart of Europe's data protection landscape. Because so many of the world's largest technology companies — including Meta, Google, TikTok, LinkedIn, and Microsoft — have their European headquarters in Dublin, the Irish Data Protection Commission (DPC) is the lead supervisory authority for a huge portion of EU citizens' personal data. If you live in Ireland, this means your privacy rights are not just protected by law — they are actively enforced by one of the most influential regulators in the world.

This guide explains exactly what the General Data Protection Regulation (GDPR) means for people living in Ireland, what rights you can exercise, how to make a complaint, and the practical steps you can take to protect your personal data in 2026 and beyond.

What Is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is an EU-wide law that came into force on 25 May 2018. It governs how organisations collect, store, process, and share personal data about individuals in the European Union. In Ireland, GDPR is implemented through the Data Protection Act 2018, which supplements the regulation with national-specific provisions.

GDPR applies to any organisation — regardless of where it is based — that processes the personal data of people in Ireland. This includes:

Irish businesses of any size, from sole traders to multinationals
Public sector bodies such as the HSE, Revenue, and local councils
Charities, schools, and sports clubs
Overseas companies offering goods or services to Irish residents

The Irish regulator is the Data Protection Commission (DPC), headquartered in Dublin with offices in Portarlington. The DPC has the power to investigate complaints, audit organisations, and issue fines of up to €20 million or 4% of annual global turnover — whichever is higher.

Why Ireland Matters Globally

Because of the "one-stop-shop" mechanism under GDPR, the DPC acts as the lead authority for many global tech firms headquartered in Dublin. Decisions made in Ireland frequently set precedent for the entire EU. In recent years, the DPC has issued record-breaking fines, including a €1.2 billion penalty against Meta in 2023 and a €345 million fine against TikTok for mishandling children's data.

Your Eight Core Privacy Rights Under GDPR

As a person living in Ireland, you have eight fundamental rights over your personal data. Every organisation that processes your information must respect these rights, usually responding within one month of your request, free of charge.

Right to be informed — You must be told who is collecting your data, why, how long it will be kept, and who it will be shared with. This is usually delivered via a privacy notice.
Right of access — You can request a copy of all personal data an organisation holds about you. This is known as a Subject Access Request (SAR).
Right to rectification — You can ask for inaccurate or incomplete data to be corrected.
Right to erasure — Also called the "right to be forgotten," this lets you request deletion of your data in certain circumstances.
Right to restrict processing — You can ask an organisation to pause processing your data while a dispute is resolved.
Right to data portability — You can request your data in a machine-readable format and transfer it to another provider.
Right to object — You can object to processing based on legitimate interests, direct marketing, or research purposes.
Rights related to automated decision-making — You can demand human review of decisions made purely by algorithms, including profiling.

How to Make a Subject Access Request in Ireland

A Subject Access Request (SAR) is the most commonly used GDPR right. It lets you see exactly what an Irish organisation knows about you — from your bank to your gym to your former employer.

Step-by-Step Process

Identify the data controller. This is usually the company itself, not an individual employee. Check their privacy policy for a Data Protection Officer (DPO) contact.
Submit your request in writing. Email is usually best — it creates a paper trail. State clearly that you are making a Subject Access Request under Article 15 of GDPR.
Verify your identity. The organisation may ask for proof of identity, but cannot demand excessive documentation.
Wait up to one month. This can be extended to three months for complex requests, but they must notify you.
Review the response. You should receive a copy of your data, information about why it's processed, who it's shared with, and how long it's retained.

If you don't receive a satisfactory response, you can escalate to the DPC.

Comparing GDPR Rights: What's Enforceable in Ireland

Right	Response Deadline	Common Exceptions	Enforced By
Access	1 month	Legal privilege, third-party data	DPC
Erasure	1 month	Legal obligations, public interest	DPC
Rectification	1 month	None in most cases	DPC
Portability	1 month	Only applies to data you provided	DPC
Object (marketing)	Immediate	No exceptions	DPC
Restrict processing	1 month	Public interest tasks	DPC
Automated decisions	1 month	Contract necessity, explicit consent	DPC
Be informed	At point of collection	Research exemptions	DPC

How to Make a Complaint to the Irish Data Protection Commission

If an organisation ignores your rights or mishandles your data, you can file a formal complaint with the DPC. The process is free and does not require a solicitor.

Before You Complain

The DPC generally expects you to contact the organisation first and give them a reasonable chance to respond. Keep records of all communications — emails, screenshots, and dates.

Filing the Complaint

Visit dataprotection.ie and use the online complaint form.
Provide a clear summary of the issue, including the name of the organisation, dates, and what rights you believe were breached.
Attach supporting evidence (emails, correspondence, screenshots).
The DPC will acknowledge your complaint and may attempt amicable resolution before formal investigation.

If the DPC finds a breach, it can issue reprimands, order corrective actions, or impose administrative fines. You also retain the right to pursue compensation through the Irish courts under Section 117 of the Data Protection Act 2018.

Special Protections for Children and Sensitive Data

Ireland sets the digital age of consent at 16 years old — one of the highest in the EU. This means children under 16 cannot legally consent to data processing by information society services (social media, apps, online games) without parental authorisation.

The DPC also published the Fundamentals for a Child-Oriented Approach to Data Processing, a set of 14 principles that organisations must follow when processing children's data. These include transparency in child-friendly language, default privacy settings set to the highest level, and no profiling of children for marketing purposes.

Special Category Data

Certain types of data receive extra protection, including:

Health and medical records
Racial or ethnic origin
Religious or philosophical beliefs
Political opinions and trade union membership
Genetic and biometric data
Sexual orientation

Processing this data generally requires explicit consent or a specific legal basis under Article 9 of GDPR.

Practical Steps to Protect Your Privacy in Ireland

Legal rights are powerful, but prevention is better than enforcement. Here are practical measures Irish residents can take in 2026 to minimise their exposure.

1. Audit Your Digital Footprint

Make a list of every service that holds your personal data — email providers, banks, retailers, social media, loyalty schemes. Delete accounts you no longer use. Many Irish retailers still hold data from accounts you created years ago.

2. Use Privacy-Respecting Tools

Switch to browsers and search engines that minimise tracking. Enable encrypted DNS (such as DNS-over-HTTPS) in your browser settings. Use end-to-end encrypted messaging. When sharing links online — particularly in marketing or professional contexts — consider using a privacy-focused shortener like Lunyb, which doesn't harvest personal data from your audience the way some free alternatives do. You can read our honest review of Lunyb for details.

3. Review Cookie Consents

Under Irish ePrivacy rules, websites must get your clear consent before setting non-essential cookies. You have the right to reject them. The DPC has fined several Irish and multinational websites for failing to offer a genuine "reject all" option.

4. Enable Two-Factor Authentication

While not strictly a GDPR right, 2FA dramatically reduces the risk of your personal data being accessed in a breach. Use an authenticator app rather than SMS where possible.

5. Choose Services Carefully

When selecting online tools, review their privacy policy and data processing locations. Our 2026 buyer's guide to URL shorteners compares providers on data handling practices — a useful framework you can apply to any software category.

What Happens When Companies Break GDPR in Ireland

The DPC has become one of the most active enforcement bodies in Europe. Notable Irish-led decisions include:

Meta (2023): €1.2 billion fine for unlawful transfers of EU user data to the US
TikTok (2023): €345 million for breaches related to children's accounts
Instagram (2022): €405 million for mishandling teen users' contact details
WhatsApp (2021): €225 million for lack of transparency

These enforcement actions show that even the world's largest companies are accountable under Irish law — and that your rights have real teeth.

The Future of GDPR in Ireland

The regulatory landscape continues to evolve. The EU Digital Services Act (DSA), Digital Markets Act (DMA), and the forthcoming AI Act all build on GDPR foundations. Ireland, as the EU HQ for most Big Tech firms, will remain the frontline for enforcement. Expect more focus on:

Algorithmic transparency and automated decisions
Cross-border data transfers post-Schrems II
Protection of children online
AI training data and lawful basis for processing

Frequently Asked Questions

How long do I have to wait for a response to a GDPR request in Ireland?

Organisations must respond within one calendar month of receiving your request. This can be extended by up to two further months for complex requests, but they must inform you of the delay and the reasons within the first month.

Can I be charged a fee for making a Subject Access Request?

No. Subject Access Requests must be handled free of charge. An organisation can only charge a reasonable administrative fee if your request is "manifestly unfounded or excessive" — for example, repeated identical requests. This exception is applied narrowly in Ireland.

What's the difference between the DPC and the ICO?

The Data Protection Commission (DPC) is Ireland's regulator. The Information Commissioner's Office (ICO) is the UK equivalent. Since Brexit, the UK operates under its own UK GDPR, so if you live in Ireland your complaints should always go to the DPC.

Does GDPR apply to small Irish businesses and sole traders?

Yes. GDPR applies regardless of company size. However, the record-keeping obligations under Article 30 are lighter for organisations with fewer than 250 employees, provided their processing is not high-risk, not regular, and does not involve special category data.

Can I claim compensation if my data is misused in Ireland?

Yes. Under Section 117 of the Data Protection Act 2018, you can bring a civil action in the Circuit Court or High Court for material or non-material damage, including distress caused by a data protection breach. You do not need to prove financial loss to claim.

What should I do if I receive unwanted marketing emails or calls?

First, use the unsubscribe link or reply asking to be removed. If the organisation continues contacting you, this is a breach of both GDPR and Ireland's ePrivacy Regulations. You can report persistent offenders to the DPC — this is one of the most common types of complaint they handle.

This article is for general information purposes and does not constitute legal advice. For specific legal issues, consult a solicitor qualified in Irish data protection law or contact the Data Protection Commission directly at dataprotection.ie.