GDPR in Ireland: Your Privacy Rights Explained (2026 Guide)

The General Data Protection Regulation (GDPR) gives people in Ireland some of the strongest privacy rights in the world. Yet many Irish residents still don't know what those rights actually mean in practice, how to exercise them, or where to turn when a company mishandles their personal data. This guide breaks down GDPR in Ireland, your eight core rights, and the practical steps to protect your personal information in 2026.

What Is GDPR and How Does It Apply in Ireland?

The General Data Protection Regulation (GDPR) is an EU-wide law that came into force on 25 May 2018. It governs how organisations collect, store, process, and share personal data belonging to individuals in the European Economic Area.

In Ireland, GDPR is implemented alongside the Data Protection Act 2018, which fills in national-level details such as the age of digital consent (set at 16 in Ireland) and the powers of the Data Protection Commission (DPC). Because so many global tech giants — Meta, Google, TikTok, Microsoft, Apple, LinkedIn — have their EU headquarters in Dublin, the Irish DPC acts as the lead supervisory authority for huge swathes of European data processing. This makes Ireland one of the most consequential jurisdictions for digital privacy on the planet.

GDPR applies to any organisation — whether based in Ireland, elsewhere in the EU, or overseas — that processes the personal data of people located in Ireland. That means a US-based e-commerce shop selling to Cork customers must comply with GDPR just as strictly as a local credit union in Galway.

What Counts as "Personal Data" Under GDPR?

Personal data is any information that can identify a living individual, either on its own or combined with other data. Examples include:

• Name, address, email, phone number, PPS number
• IP addresses, device IDs, cookie identifiers
• Location data, photos, and CCTV footage
• Health records, biometric data, and genetic information
• Political opinions, religious beliefs, and trade union membership

The last three categories are classified as special category data and receive extra protection under GDPR.

Your Eight GDPR Rights in Ireland

GDPR grants every individual in Ireland eight distinct rights over their personal data. Understanding these rights is the first step to using them effectively.

1. The Right to Be Informed

Organisations must tell you — clearly and in plain language — what data they collect, why they collect it, how long they keep it, and who they share it with. This is usually delivered through a privacy notice or policy on the organisation's website or at the point of data collection.

2. The Right of Access (Subject Access Request)

You have the right to ask any organisation for a copy of the personal data it holds about you. This is known as a Subject Access Request (SAR). The organisation must respond within one calendar month, and the first copy must be provided free of charge.

3. The Right to Rectification

If any personal data held about you is inaccurate or incomplete, you can request that it be corrected without undue delay.

4. The Right to Erasure ("Right to Be Forgotten")

You can ask an organisation to delete your personal data when it is no longer needed, when you withdraw consent, or when it has been processed unlawfully. This right is not absolute — organisations can refuse in certain cases, such as legal obligations or freedom of expression.

5. The Right to Restrict Processing

In certain situations, you can request that an organisation pause processing your data rather than delete it entirely — for example, while you contest its accuracy.

6. The Right to Data Portability

You can request a copy of the data you have provided to an organisation in a structured, commonly used, machine-readable format (such as CSV or JSON) and have it transferred to another provider.

7. The Right to Object

You can object to processing based on legitimate interests or direct marketing. Direct marketing objections must always be honoured — no questions asked.

8. Rights Related to Automated Decision-Making

You have the right not to be subject to decisions made solely by automated systems — including profiling — that produce significant legal or similar effects on you, such as loan rejections or job application filtering, unless specific exemptions apply.

How to Exercise Your GDPR Rights in Ireland

Exercising your rights is simpler than most people assume. Follow these steps:

1. Identify the data controller. This is the organisation that decides how and why your data is processed. Check their privacy policy for contact details.
2. Submit a written request. Email is usually sufficient. Clearly state which right you are exercising (e.g., "This is a Subject Access Request under Article 15 GDPR").
3. Prove your identity. The organisation may ask for ID to confirm you are who you say you are, but requests must be proportionate.
4. Wait up to one month. Responses are due within 30 calendar days, extendable by two further months for complex requests.
5. Escalate if unsatisfied. If the response is inadequate or missing, you can complain to the Data Protection Commission.

Sample Subject Access Request Template

You can adapt the following template:

"Dear [Organisation],
Under Article 15 of the GDPR, I am requesting a copy of all personal data you hold about me, including the purposes of processing, categories of data, recipients, retention periods, and any automated decision-making applied.
My details are: [full name, email, any reference number].
Please respond within one month.
Kind regards, [Your name]"

The Role of the Irish Data Protection Commission (DPC)

The Data Protection Commission, headquartered in Dublin with offices in Portarlington, is Ireland's independent supervisory authority for data protection. It is one of the most important regulators in the EU because of Ireland's concentration of tech multinationals.

The DPC's responsibilities include:

• Handling complaints from individuals
• Investigating data breaches and GDPR violations
• Issuing fines — up to €20 million or 4% of global annual turnover, whichever is higher
• Providing guidance to organisations and the public
• Acting as lead supervisory authority for cross-border cases involving Irish-headquartered companies

The DPC has issued some of the largest GDPR fines in history, including penalties against Meta, TikTok, and Instagram running into the hundreds of millions of euros.

How to File a Complaint with the DPC

If an organisation fails to properly respond to your request or you believe your rights have been infringed, you can lodge a complaint with the DPC free of charge. The process is straightforward:

1. Visit dataprotection.ie and use the online complaint form.
2. Include evidence: your original request, the organisation's response (or lack thereof), and any supporting documents.
3. The DPC will acknowledge receipt and may attempt amicable resolution before formal investigation.
4. You retain the right to seek a judicial remedy in the Irish courts if dissatisfied with the outcome.

GDPR Fines and Enforcement in Ireland

The table below summarises some of the most significant DPC enforcement actions in recent years, illustrating how seriously Irish regulators treat non-compliance.

Year	Organisation	Fine	Reason
2023	Meta (Facebook)	€1.2 billion	Unlawful EU–US data transfers
2023	TikTok	€345 million	Children's data processing violations
2022	Instagram	€405 million	Mishandling of children's accounts
2021	WhatsApp	€225 million	Transparency failures
2020	Twitter	€450,000	Delayed breach notification

Practical Steps to Protect Your Privacy in Ireland

Knowing your rights is one thing; actively safeguarding your personal data is another. Here are practical measures Irish residents can take right now.

1. Audit the Services You Use

Review which apps, websites, and services hold your personal data. Delete accounts you no longer use. Services like JustDeleteMe can speed up account removal.

2. Tighten Cookie and Tracking Settings

Under GDPR and the ePrivacy Directive, Irish websites must offer a genuine "reject all" option for non-essential cookies. Use it. Install a privacy-focused browser like Brave or Firefox with strict tracking protection enabled.

3. Use Encrypted DNS and Private Browsing Tools

Enable encrypted DNS (DNS over HTTPS) in your browser or router to prevent your internet provider from logging every site you visit. Combine this with ad and tracker blockers.

4. Choose Privacy-First Tools

When you need to share links online, choose services that respect GDPR and minimise data collection. For example, a privacy-focused URL shortener like Lunyb lets you create short links without the aggressive click-tracking and third-party data sharing you'll find in some competitors. You can read our honest review of Lunyb or compare it with alternatives in our Rebrandly review to see how privacy policies vary across link management providers.

5. Enable Two-Factor Authentication

Protect your accounts with 2FA — ideally using an authenticator app rather than SMS. This dramatically reduces the risk of unauthorised access following a data breach.

6. Be Mindful of Special Category Data

Avoid sharing health, biometric, or political data with services that don't clearly need it. If an organisation asks for sensitive information without a clear legal basis, challenge it.

GDPR for Irish Businesses: A Quick Overview

If you run a business in Ireland — from a sole trader in Kilkenny to a tech startup in Dublin's Docklands — GDPR applies to you the moment you process personal data. Core obligations include:

• Lawful basis: Identify a legal reason for every processing activity (consent, contract, legal obligation, vital interest, public task, or legitimate interest).
• Transparency: Publish a clear privacy notice.
• Records of processing activities: Required for most organisations.
• Data minimisation: Only collect what you truly need.
• Breach notification: Report certain breaches to the DPC within 72 hours.
• Data Protection Officer (DPO): Required for public bodies and organisations whose core activities involve large-scale monitoring or special category data.

Non-compliance can result in enforcement notices, bans on processing, reputational damage, and substantial fines.

Common Myths About GDPR in Ireland

Myth 1: "GDPR Only Applies to Big Tech"

False. GDPR applies to any organisation processing personal data, from a one-person consultancy to a GAA club with a member database.

Myth 2: "Consent Is Always Required"

False. Consent is one of six legal bases. Many processing activities rely on contract performance or legitimate interests instead.

Myth 3: "I Can Demand Deletion of Anything"

False. The right to erasure has limits. Tax records, legal obligations, and journalistic content may be exempt.

Myth 4: "Brexit Means UK Companies Don't Have to Comply"

False. UK companies offering goods or services to Irish residents must still comply with EU GDPR.

Frequently Asked Questions

How long does an Irish company have to respond to a Subject Access Request?

One calendar month from the date of receipt. This can be extended by a further two months for complex or numerous requests, but the organisation must inform you of the extension within the original month.

Can I be charged for making a GDPR request in Ireland?

The first copy must be free. Organisations may charge a reasonable administrative fee only if your request is "manifestly unfounded or excessive" — for example, if you repeatedly ask for the same data.

What happens if a company ignores my GDPR request?

You can file a complaint with the Irish Data Protection Commission at dataprotection.ie. The DPC can investigate, mediate, or issue enforcement notices and fines. You also retain the right to pursue compensation through the Irish courts.

Does GDPR cover data held outside the EU?

Yes. GDPR applies to any processing of EU residents' personal data, regardless of where the controller or processor is located. Transfers of data outside the EEA must rely on approved safeguards such as Standard Contractual Clauses or an adequacy decision.

What's the difference between a data controller and a data processor?

A controller decides the purposes and means of processing (e.g., an online retailer). A processor acts on the controller's instructions (e.g., a cloud hosting provider). Both have obligations under GDPR, but controllers bear primary responsibility for compliance.

Final Thoughts

GDPR gives people in Ireland remarkable control over their personal data — but those rights only matter if you use them. By understanding the eight core rights, knowing how to submit requests, and using privacy-respecting tools in your daily digital life, you shift the balance of power back toward yourself. And if an organisation refuses to play fair, the Irish Data Protection Commission has both the legal teeth and the track record to hold them to account.

Privacy is not a luxury — under Irish and EU law, it's a right. Exercise it.