GDPR in Ireland: Your Privacy Rights Explained

The General Data Protection Regulation (GDPR) has been in force across the European Union since 25 May 2018, and in Ireland it is enforced under the Data Protection Act 2018. As an Irish resident, you have some of the strongest privacy rights in the world — but many people are still unsure exactly what those rights are, how to exercise them, or who to turn to when something goes wrong.

This guide breaks down GDPR in Ireland in plain English: what it protects, the eight fundamental rights it gives you, how the Data Protection Commission (DPC) enforces it, and practical steps you can take to protect your personal data every day.

What Is GDPR and How Does It Apply in Ireland?

GDPR is an EU regulation that governs how organisations collect, store, process, and share personal data belonging to individuals in the European Economic Area. In Ireland, it is supplemented by the Data Protection Act 2018, which handles national-level provisions such as the age of digital consent (set at 16 in Ireland) and the powers of the Data Protection Commission.

Because Ireland hosts the European headquarters of many major technology companies — including Meta, Google, TikTok, Apple, and Microsoft — the Irish DPC acts as the lead supervisory authority for a significant share of all GDPR cases in Europe. That means decisions made in Dublin often set the tone for privacy enforcement across the entire EU.

Who Does GDPR Protect?

GDPR protects any identifiable natural person (a "data subject") whose personal data is processed by an organisation. You do not need to be an Irish or EU citizen — you simply need to be physically in the EU when the processing occurs, or be the subject of processing by an EU-based organisation.

What Counts as Personal Data?

Personal data is any information that can identify you, directly or indirectly. This includes:

• Name, address, PPS number, and date of birth
• Email addresses, phone numbers, and IP addresses
• Location data from your phone or car
• Photos, CCTV footage, and biometric identifiers
• Online identifiers such as cookies and advertising IDs
• Health records, financial details, and employment history

Special category data — including racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, health data, and data about sexual orientation — receives extra protection and generally requires explicit consent to process.

Your Eight GDPR Rights as an Irish Resident

GDPR gives you eight specific, legally enforceable rights over your personal data. You can exercise any of these rights for free, and organisations must respond within one month (extendable by two more months for complex requests).

1. The Right to Be Informed

Organisations must tell you — clearly and in plain language — what data they collect, why they collect it, how long they keep it, and who they share it with. This is usually done through a privacy notice or policy on their website.

2. The Right of Access (Subject Access Request)

You can ask any organisation for a copy of the personal data they hold about you. This is known as a Subject Access Request (SAR). The organisation must provide the data free of charge within one month.

3. The Right to Rectification

If any data an organisation holds about you is inaccurate or incomplete, you can demand that they correct or update it.

4. The Right to Erasure ("Right to Be Forgotten")

You can ask an organisation to delete your personal data when it is no longer needed, when you withdraw consent, or when it has been unlawfully processed. This right is not absolute — organisations can refuse if they have a legal obligation to retain the data (for example, Revenue records).

5. The Right to Restrict Processing

You can ask an organisation to pause processing your data while a dispute (such as a correction request) is being resolved.

6. The Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format so you can move it to another provider — for example, exporting your contacts or photos from one service to a competitor.

7. The Right to Object

You can object to processing based on legitimate interests or public interest, and you have an absolute right to object to direct marketing at any time.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions made solely by automated processing — including profiling — that produce legal or similarly significant effects on you, such as automated loan approvals or insurance pricing.

GDPR Rights at a Glance

Right	What It Lets You Do	Response Deadline
Be Informed	Know what data is collected and why	At point of collection
Access	Get a copy of your data	1 month
Rectification	Correct inaccurate data	1 month
Erasure	Have your data deleted	1 month
Restrict Processing	Pause data use	1 month
Data Portability	Transfer data to another service	1 month
Object	Stop certain types of processing	1 month
Automated Decisions	Demand human review	1 month

How to Make a Subject Access Request in Ireland

A Subject Access Request is the most commonly used GDPR right. Here is a straightforward process for submitting one to any organisation in Ireland:

1. Identify the data controller. This is the organisation responsible for deciding how your data is used. Check their privacy policy for a Data Protection Officer (DPO) contact.
2. Write a clear request. State that you are making a request under Article 15 of the GDPR. You do not need to use a specific form, but being explicit helps.
3. Prove your identity. The organisation may ask for ID to confirm you are who you say you are, but they cannot demand excessive documentation.
4. Specify what you want. You can request all data held about you, or narrow it down to a specific time period or type of information.
5. Keep records. Save copies of your request, any correspondence, and the date you sent it. This is essential if you later need to complain.
6. Wait up to one month. The organisation must respond within 30 days, unless they notify you of a reasonable extension.

The Data Protection Commission: Ireland's Watchdog

The Data Protection Commission (DPC) is the independent public authority responsible for upholding your data protection rights in Ireland. Headquartered in Dublin with an office in Portarlington, the DPC has the power to investigate complaints, conduct audits, and issue fines of up to €20 million or 4% of a company's global annual turnover — whichever is higher.

How to File a Complaint with the DPC

If you believe an organisation has violated your rights and you cannot resolve the issue directly, you can lodge a complaint with the DPC. The process is free and does not require a solicitor.

1. Try to resolve the issue with the organisation first (the DPC expects this).
2. Gather evidence: copies of requests, responses, and relevant correspondence.
3. Submit a complaint via the DPC's online webform at dataprotection.ie, by email, or by post.
4. The DPC will acknowledge receipt and may attempt amicable resolution before launching a formal inquiry.
5. If an investigation finds a breach, the DPC can order corrective action and issue fines.

Notable Irish DPC Decisions

The DPC has handed down some of the largest GDPR fines in Europe, including multi-hundred-million-euro penalties against major social media platforms for unlawful data transfers and inadequate protections for children's data. These cases demonstrate that the regulation has real teeth — and that even the world's largest companies must comply.

Everyday Steps to Protect Your Privacy in Ireland

Knowing your rights is important, but preventing privacy problems in the first place is even better. Here are practical steps every Irish resident can take.

Review the Permissions You Give Online

Audit the apps on your phone and revoke permissions you no longer need. Check which websites can send you notifications, access your camera, or track your location. On most browsers you can do this in Settings → Privacy & Security.

Use Privacy-Focused Tools

Consider privacy-first browsers such as Firefox or Brave, encrypted email providers like Proton Mail (which is also GDPR-friendly), and encrypted DNS resolvers (such as Cloudflare's 1.1.1.1 or NextDNS) to reduce the amount of data your internet service provider can see.

Be Careful with Link Sharing

Many free URL shorteners track clicks, collect IP addresses, and build detailed profiles on the people clicking your links. If you share links on social media, in newsletters, or across your business, choose a shortener that respects privacy. Lunyb is a privacy-conscious URL shortener built with GDPR compliance in mind — it minimises data collection while still giving you useful analytics. You can read an honest review of Lunyb here, or compare it against other options in our 2026 buyer's guide to URL shorteners.

Manage Cookies Properly

Under GDPR and the ePrivacy Directive (transposed in Ireland by the ePrivacy Regulations 2011), websites must get your consent before setting non-essential cookies. Reject cookies you do not need — it is your legal right, and "Reject All" must be as easy as "Accept All".

Protect Your Inbox from Marketing Spam

Every marketing email must contain a one-click unsubscribe link. If an Irish organisation keeps emailing you after you unsubscribe, that is a direct violation of GDPR and you can report it to the DPC.

GDPR and Your Workplace in Ireland

Your employer is also a data controller and must respect your GDPR rights. This includes being transparent about CCTV in the workplace, any monitoring of emails or internet use, and how performance data is stored. Employers must have a lawful basis for processing employee data and should provide a workforce privacy notice. If you feel your employer is overstepping, you can raise it internally with the DPO, through a trade union, or escalate to the DPC.

GDPR for Small Businesses and Sole Traders

If you run a business in Ireland — even a one-person operation — you are almost certainly a data controller under GDPR. Key obligations include:

• Publishing a clear privacy notice on your website
• Having a lawful basis for every processing activity
• Keeping records of processing activities (unless you qualify for an exemption)
• Reporting personal data breaches to the DPC within 72 hours
• Implementing appropriate technical and organisational security measures
• Appointing a Data Protection Officer if you carry out large-scale processing or handle special category data

The DPC website offers free guidance specifically tailored to SMEs, which is well worth reading before you build your first customer database or email list.

Frequently Asked Questions

Does GDPR apply to me if I'm not an EU citizen but live in Ireland?

Yes. GDPR protects anyone physically located in the EU when their personal data is processed, regardless of nationality or citizenship. If you live in Ireland, you have full GDPR rights.

How much does it cost to make a Subject Access Request or file a DPC complaint?

Both are completely free. Organisations can only charge a "reasonable fee" if a request is manifestly unfounded, excessive, or repetitive — which is rare. Filing a complaint with the Data Protection Commission also costs nothing.

What happens if a company ignores my GDPR request?

If an organisation fails to respond within one month without a valid reason, you can file a complaint with the DPC. The Commission can investigate, issue corrective orders, and fine the organisation up to €20 million or 4% of global annual turnover.

Can I ask Google or Facebook to delete my data?

Yes. Both companies have dedicated privacy portals where you can submit erasure requests under GDPR. Because their European headquarters are in Dublin, the Irish DPC is the lead supervisory authority for most complaints about them, and you can escalate there if they fail to comply.

Are CCTV cameras in shops and workplaces covered by GDPR?

Yes. CCTV footage that identifies individuals is personal data. Operators must display clear signage, have a lawful basis for recording, retain footage only as long as necessary (usually 28 days), and allow individuals to request copies of footage featuring them.

Final Thoughts

GDPR gives Irish residents a powerful toolkit to control how organisations use their personal data — but these rights only work if people exercise them. Whether you are submitting a Subject Access Request, rejecting unnecessary cookies, choosing privacy-respecting tools for your business, or filing a complaint with the DPC, each action reinforces a culture where privacy is treated as a fundamental right rather than an afterthought.

Keep this guide bookmarked, share it with friends and family, and remember: in Ireland, your data is yours. The law is on your side.