Data & Privacy · Ireland
Data protection & privacy law in Ireland (2026)
Ireland shaded by its data & privacy status
Data protection in Ireland: comprehensive law.
FrameworkEU General Data Protection Regulation (Regulation (EU) 2016/679) together with Ireland's Data Protection Act 2018 (which gives further effect to the GDPR and transposes the Law Enforcement Directive), supplemented by the ePrivacy Regulations 2011 (S.I. No. 336/2011). Enforced by the Data Protection Commission (DPC).
Ireland has a fully in-force, comprehensive personal-data protection regime built on the directly applicable EU GDPR and the national Data Protection Act 2018, which fills over 50 Member-State derogations and transposes the Law Enforcement Directive. Confidentiality of electronic communications, cookies and electronic direct marketing are separately governed by the ePrivacy Regulations 2011. The Data Protection Commission is the independent national supervisory authority and, because most major US tech firms locate their EU headquarters in Ireland, it functions as the GDPR one-stop-shop lead supervisory authority for many high-profile cross-border cases.
GDPR & data protection in Ireland
In Ireland, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Data Protection Commission (DPC).
- Framework
- the GDPR (Regulation (EU) 2016/679) plus the national data-protection act
- Supervisory authority
- the Data Protection Commission (DPC)
- Applies to
- any organisation processing the personal data of people in Ireland, wherever the organisation is based
- Maximum fine
- €20 million or 4% of global annual turnover, whichever is higher
- Breach notification
- within 72 hours of becoming aware, to the supervisory authority
- DPO
- required for large-scale monitoring or large-scale special-category processing
The GDPR is bloc-wide; Ireland supplements it with a national data-protection act and its own supervisory authority.
GDPR in Ireland: FAQ
Yes. As an EU/EEA member, Ireland applies the GDPR (Regulation (EU) 2016/679) directly, enforced by the Data Protection Commission (DPC).
The Data Protection Commission (DPC).
Up to €20 million or 4% of global annual turnover, whichever is higher.
A DPO is required where you carry out large-scale monitoring or process special-category data at scale.
Personal-data breaches must be notified to the supervisory authority within 72 hours of becoming aware.
Key points
The Data Protection Act 2018 gives further effect to the GDPR in Ireland, exercises national derogations (e.g. age of digital consent set at 16, special-category and public-interest processing rules) and transposes the Law Enforcement Directive for processing by An Garda Síochána and other competent authorities.
The Data Protection Commission (DPC) is the independent national supervisory authority responsible for monitoring application of the GDPR, the Data Protection Act 2018, the ePrivacy Regulations 2011 and the LED. It is led by three Commissioners: Dr Des Hogan (Chairperson/CEO, since Feb 2024), Dale Sunderland and Niamh Sweeney (appointed Sept 2025).
Individuals enjoy the full GDPR rights (access, rectification, erasure, restriction, portability, objection, rights around automated decision-making). Controllers must observe lawful bases, transparency, purpose limitation, data-minimisation, security (Art. 32), 72-hour breach notification to the DPC, DPIAs for high-risk processing, and appointment of DPOs where required.
The European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. 336/2011) govern cookies and similar tracking technologies (opt-in consent) and unsolicited direct marketing by email, SMS and phone. Enforced by the DPC, with criminal offences prosecutable summarily.
Because Meta, Google, TikTok, Microsoft, Apple, LinkedIn, X and others place their EU establishment in Dublin, the DPC acts as GDPR lead supervisory authority for many cross-border cases. On 2 May 2025 it fined TikTok €530 million and ordered corrective measures over unlawful EEA-to-China data transfers and transparency failings under Articles 46(1) and 13(1)(f) GDPR.
The DPC also acts as the fundamental-rights supervisor for AI systems that process personal data and, from 2026, is a designated market-surveillance authority for certain high-risk AI systems (law enforcement, biometrics) under Ireland's implementation of the EU AI Act.
Timeline - major decisions & events
The DPC fined TikTok €530m and ordered corrective measures for unlawfully transferring EEA user data to China without ensuring EU-equivalent protection; TikTok appealed and the High Court stayed the decision on 2025-11-14 pending the outcome.
Data Protection Commission ↗The DPC launched a Section 110 inquiry into X Internet Unlimited Company over whether EU/EEA users' public posts were lawfully processed to train its Grok LLMs, a landmark probe of generative-AI training data.
Data Protection Commission ↗The DPC concluded inquiries into the September 2018 'View As' token breach affecting ~29 million accounts globally, fining Meta €251m for security and breach-notification failings under the GDPR.
Data Protection Commission ↗Following a 2019 inquiry, the DPC fined Meta €91m for storing user passwords in plaintext, breaching GDPR obligations on technical/organisational security measures and confidentiality.
Data Protection Commission ↗The DPC issued the largest-ever GDPR fine, €1.2bn, plus suspension and cessation orders against Meta for transferring EU data to the US under SCCs that failed the Schrems II standard.
Data Protection Commission ↗After an EDPB binding decision overrode the DPC's draft, Meta was fined €390m for unlawfully relying on 'contract' as the legal basis for behavioural advertising on Facebook and Instagram, breaching Article 6 GDPR.
Data Protection Commission ↗The DPC's then-largest fine penalised Meta's Instagram for exposing children's email addresses/phone numbers via business accounts and public-by-default settings for teen accounts.
Data Protection Commission ↗Arising from a complaint to the Irish DPC, the CJEU invalidated the EU-US Privacy Shield and tightened conditions on Standard Contractual Clauses, reshaping how Ireland-based tech firms transfer data abroad.
Data Protection Commission ↗Signed into law to give further effect to the GDPR (applicable 25 May 2018) and transpose the Law Enforcement Directive, the Act replaced the Data Protection Commissioner with the multi-member Data Protection Commission.
Irish Statute Book ↗Following Max Schrems' complaint to the Irish Data Protection Commissioner over Facebook transfers, the CJEU struck down the EU-US Safe Harbour framework, establishing Ireland as the front line of transatlantic data-transfer disputes.
CJEU ↗Transposed the 1995 EU Data Protection Directive into Irish law, modernising the 1988 regime with eight core principles covering fair processing, purpose limitation, security and data-subject access.
Irish Statute Book ↗Ireland's foundational data-protection statute, enabling ratification of the Council of Europe Convention 108, introducing data-handling principles and creating the Office of the Data Protection Commissioner (1989).
Irish Statute Book ↗Ireland - other topics
Data & Privacy in other countries
Last verified 9/29/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →