Cybersecurity - Ireland

Ireland missed the 17 October 2024 NIS2 transposition deadline; the General Scheme of the National Cyber Security Bill 2024 was published 30 August 2024 and the Bill remains a government legislative priority expected to pass in 2026.

The National Cyber Security Centre will be the lead national competent authority and national CSIRT for NIS2, responsible for managing large-scale cybersecurity incidents and crises.

Designated sectoral regulators include ComReg (communications), the Central Bank of Ireland (finance), the Commission for Regulation of Utilities (energy), the Irish Aviation Authority and the National Transport Authority.

Once transposed, in-scope essential/important entities must file an early warning to the NCSC within 24 hours of awareness of a significant incident, with follow-up reports and notification of affected service recipients without undue delay. Registration/reporting portals remain inactive until the Bill is enacted.

Under GDPR, controllers must notify the Data Protection Commission within 72 hours of becoming aware of a personal-data breach that poses a risk to individuals, and notify affected individuals without undue delay where the risk is high.

The EU Digital Operational Resilience Act applies directly since 17 January 2025, imposing ICT risk management, resilience testing, third-party oversight, and major ICT-incident reporting (initial notification within hours, with intermediate and final reports) on banks, insurers and other financial entities; the Central Bank of Ireland is the supervisor.