GDPR in Ireland: Your Privacy Rights Explained (2026 Guide)

Ireland sits at the heart of Europe's data protection landscape. Because so many global tech companies — Meta, Google, LinkedIn, TikTok, Apple, Microsoft — base their European headquarters in Dublin, the Irish Data Protection Commission (DPC) acts as the lead supervisory authority for hundreds of millions of EU users. For Irish residents, that means GDPR isn't just a piece of Brussels legislation; it's a tool enforced by a regulator on your doorstep.

This guide breaks down your GDPR privacy rights in Ireland, how they apply in everyday situations, and the exact steps to take when a company mishandles your personal data.

What Is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is an EU-wide law, in force since 25 May 2018, that governs how organisations collect, store, use and share personal data about individuals in the European Economic Area. In Ireland, GDPR is supplemented by the Data Protection Act 2018, which fills in national details such as the age of digital consent (16 in Ireland) and the powers of the DPC.

GDPR applies to any organisation — whether based in Ireland, elsewhere in the EU, or abroad — that processes personal data of people located in Ireland. That includes everything from your local GP surgery and credit union to international platforms like Facebook or Amazon.

Who Enforces GDPR in Ireland?

The Data Protection Commission (DPC), based in Dublin and Portarlington, is the Irish regulator responsible for enforcing GDPR. It handles complaints from individuals, investigates breaches, and issues fines. Because of Ireland's role as an EU tech hub, the DPC has issued some of the largest GDPR fines in Europe, including penalties exceeding €1 billion against Meta.

Your 8 Core Privacy Rights Under GDPR

GDPR gives every Irish resident eight enforceable rights over their personal data. Understanding them is the first step to exercising control over your digital footprint.

Right	What It Means	Typical Response Time
Right to be informed	Clear information about how your data is used	At collection
Right of access	Request a copy of all data held about you	1 month
Right to rectification	Correct inaccurate or incomplete data	1 month
Right to erasure ("right to be forgotten")	Have your data deleted in certain circumstances	1 month
Right to restrict processing	Pause how your data is used while a dispute is resolved	1 month
Right to data portability	Receive your data in a machine-readable format	1 month
Right to object	Stop processing for marketing or certain other purposes	Immediate for marketing
Rights around automated decisions	Not be subject to purely automated decisions with legal effects	On request

1. The Right to Be Informed

Before an organisation collects your data, it must tell you who it is, why it wants the data, how long it will keep it, and who it will share it with. This is usually delivered through a privacy notice or privacy policy. Vague, buried or deliberately confusing notices breach GDPR.

2. The Right of Access (Subject Access Request)

You can ask any company or public body for a copy of all personal data they hold about you. This is called a Subject Access Request (SAR). The organisation must respond within one calendar month and, in almost all cases, provide the data free of charge.

3. The Right to Rectification

If a bank has your address wrong, or a hospital has outdated medical notes, you can demand correction. Organisations must act within one month and inform any third parties they've shared the inaccurate data with.

4. The Right to Erasure

Also known as the "right to be forgotten," this lets you have personal data deleted when, for example, it is no longer needed, you withdraw consent, or processing was unlawful. It is not absolute — organisations can refuse if they have a legal obligation to keep records (for instance, Revenue retention rules).

5. The Right to Restrict Processing

You can ask a company to stop actively using your data while a dispute is being resolved, for example while they verify a correction you've requested.

6. The Right to Data Portability

For data you've provided based on consent or a contract, you can request it in a structured, commonly used format (such as CSV or JSON) and move it to another provider — handy when switching banks, fitness apps or social networks.

7. The Right to Object

You have an absolute right to object to direct marketing. Once you object, processing must stop immediately. You can also object to processing based on "legitimate interests," though the organisation can continue if it demonstrates compelling grounds.

8. Rights Around Automated Decision-Making

If a decision with a legal or similarly significant effect on you (such as a loan refusal or an insurance quote) is made purely by an algorithm, you have the right to human review and to contest the outcome.

How to Make a Subject Access Request in Ireland

A Subject Access Request (SAR) is the most-used GDPR right. You don't need a solicitor, special form, or even to quote GDPR — a plain email is enough.

1. Identify the data controller. This is the organisation that decides how your data is used (e.g. Bank of Ireland, Ryanair, your employer).
2. Find their Data Protection Officer (DPO) or privacy contact. This is usually listed in the privacy policy.
3. Write a clear request. State your name, any account details needed to identify you, and say: "Under Article 15 of the GDPR, I am requesting a copy of all personal data you hold about me."
4. Specify a scope if useful. You can narrow it — e.g. "all CCTV footage from 3 May 2026" — to get a faster response.
5. Prove your identity. The organisation may ask for ID; provide only what is strictly necessary.
6. Wait up to one month. They can extend by two further months for complex requests but must tell you within the first month.

If they ignore you, respond late, or refuse without proper reasons, you can escalate to the DPC.

How to Complain to the Data Protection Commission

If an organisation mishandles your data or refuses to honour a GDPR right, you can lodge a complaint with the DPC. It's free and does not require a solicitor.

1. Raise it with the organisation first. The DPC expects you to have tried to resolve it directly.
2. Gather evidence. Save emails, screenshots, dates and copies of any SAR correspondence.
3. Submit your complaint via the DPC's online webform at dataprotection.ie, by post, or by email to info@dataprotection.ie.
4. Engage with the DPC caseworker. They may try amicable resolution first before opening a formal inquiry.
5. Appeal if needed. You can challenge a DPC decision in the Circuit Court or, for points of law, the High Court.

You also have a direct right to seek compensation through the Irish courts for material or non-material damage (including distress) caused by a GDPR breach.

GDPR and Everyday Situations in Ireland

Workplace Monitoring

Employers can monitor emails, internet use and CCTV, but only with a clear lawful basis, a written policy, and proportionate measures. Covert monitoring is almost never lawful outside serious misconduct investigations.

CCTV in Shops, Apartments and Estates

Any organisation or management company operating CCTV must display clear signage, limit retention (typically 28–30 days), and provide footage on request. Domestic CCTV that only covers your own property is generally outside GDPR, but cameras that capture the public footpath or a neighbour's garden fall within the rules.

Schools and Children's Data

In Ireland, the digital age of consent is 16. Under that age, parental consent is required for information society services like social media. Schools must have clear policies on photographs, biometric systems and online learning platforms.

Healthcare Records

You have the right to access your HSE records, GP notes and hospital files. Access can only be refused in narrow circumstances, such as where disclosure would cause serious harm to your mental or physical health.

Marketing Calls, Texts and Emails

These are governed by GDPR plus the ePrivacy Regulations (SI 336 of 2011). Marketing to Irish consumers without clear consent — or after you've opted out — can lead to prosecution by the DPC and fines in the District Court.

Protecting Your Own Data: Practical Steps

GDPR gives you rights, but good personal practice reduces how often you need to use them. A few habits significantly reduce your exposure:

• Use strong, unique passwords stored in a reputable password manager.
• Enable two-factor authentication on email, banking and social accounts.
• Review app permissions on your phone every few months — revoke access to location, contacts and microphone where not needed.
• Use a privacy-respecting browser with tracker and fingerprint protection.
• Enable encrypted DNS (DNS-over-HTTPS) so your internet provider can't easily log every site you visit.
• Be careful what you click and share. Shortened links can hide the real destination; use a transparent link service like Lunyb that provides link previews and analytics without harvesting personal data, and hover over any link before clicking.
• Regularly request and review the data big platforms hold about you via their built-in download tools.

If you run a small business or a side project, remember that GDPR applies to you too. Keep a simple record of what data you collect, why, and how long you keep it. Services that minimise data collection — for example, a privacy-aware URL shortener that doesn't profile your audience — make compliance easier. You can also read our honest review of Lunyb to see how a modern, GDPR-friendly link tool is structured.

Fines and Enforcement: What Happens When Companies Get It Wrong

GDPR fines can reach the greater of €20 million or 4% of global annual turnover. The DPC has been among the most active regulators in the EU, issuing landmark decisions including:

• €1.2 billion against Meta (2023) for unlawful transfers of EU user data to the US.
• €345 million against TikTok (2023) over the processing of children's data.
• €405 million against Instagram (2022) for similar children's data failings.
• Multi-million euro penalties against WhatsApp, LinkedIn and Airbnb for transparency failures.

These decisions show that even the largest companies are not immune — and that Irish residents' complaints often trigger EU-wide investigations.

GDPR After Brexit: What Changes for Irish Residents?

The UK left the EU in 2020 and adopted the "UK GDPR," which currently mirrors the EU version. For Irish residents, this matters because data sent to UK-based services still flows under an EU adequacy decision (renewed in 2025). If that adequacy decision were ever revoked, organisations transferring data from Ireland to the UK would need additional safeguards. For now, your rights against UK-based companies that target Irish customers remain enforceable through the DPC.

Frequently Asked Questions

Is there a fee to make a GDPR request in Ireland?

No. Subject Access Requests and all other GDPR rights are free. An organisation can only charge a "reasonable fee" if your request is manifestly unfounded, excessive or repetitive — and they must justify that in writing.

How long does an organisation have to respond to my request?

One calendar month from receipt. They can extend by up to two more months for complex or numerous requests, but they must notify you of the extension within the first month and explain why.

Can I claim compensation if my data is leaked?

Yes. Under Article 82 of GDPR and Section 117 of the Data Protection Act 2018, you can sue in the Irish courts for both material damage (financial loss) and non-material damage (such as distress or anxiety) caused by a data breach. Irish case law, including Kaminski v Ballymaguire Foods, has clarified that genuine, demonstrable distress is required — not every minor breach qualifies.

Does GDPR cover data held by An Garda Síochána?

Yes, but under a separate regime — Part 5 of the Data Protection Act 2018 implements the Law Enforcement Directive. You still have rights of access and rectification, but exemptions apply for ongoing investigations and national security.

What should I do if a company refuses my erasure request?

Ask for their reasons in writing and the legal basis for refusal. If you're not satisfied, raise a formal complaint with the DPC via dataprotection.ie. Include copies of your original request, their response, and a clear explanation of why you believe the refusal is wrong.

Final Thoughts

GDPR is one of the strongest privacy frameworks in the world, and Irish residents are among its biggest beneficiaries thanks to the DPC's role as lead regulator for most of Big Tech in Europe. Knowing your eight core rights — and the practical steps to enforce them — turns GDPR from legal jargon into a real tool for controlling your digital life. Combine those rights with sensible personal security habits, and you'll be ahead of most Irish internet users in 2026 and beyond.