Data protection & privacy law in Ireland (2026)

Legal framework

EU General Data Protection Regulation (Regulation (EU) 2016/679) together with Ireland's Data Protection Act 2018 (which gives further effect to the GDPR and transposes the Law Enforcement Directive), supplemented by the ePrivacy Regulations 2011 (S.I. No. 336/2011). Enforced by the Data Protection Commission (DPC).

GDPR & data protection in Ireland

In Ireland, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Data Protection Commission (DPC).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Data Protection Commission (DPC)

Applies to

any organisation processing the personal data of people in Ireland, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Ireland supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Ireland

1. 01Primary law

   The Data Protection Act 2018 gives further effect to the GDPR in Ireland, exercises national derogations (e.g. age of digital consent set at 16, special-category and public-interest processing rules) and transposes the Law Enforcement Directive for processing by An Garda Síochána and other competent authorities.

   irishstatutebook.ie revisedacts.lawreform.ie dataprotection.ie

2. 02Supervisory authority

   The Data Protection Commission (DPC) is the independent national supervisory authority responsible for monitoring application of the GDPR, the Data Protection Act 2018, the ePrivacy Regulations 2011 and the LED. It is led by three Commissioners: Dr Des Hogan (Chairperson/CEO, since Feb 2024), Dale Sunderland and Niamh Sweeney (appointed Sept 2025).

   dataprotection.ie dataprotection.ie

3. 03Data-subject rights and controller obligations

   Individuals enjoy the full GDPR rights (access, rectification, erasure, restriction, portability, objection, rights around automated decision-making). Controllers must observe lawful bases, transparency, purpose limitation, data-minimisation, security (Art. 32), 72-hour breach notification to the DPC, DPIAs for high-risk processing, and appointment of DPOs where required.

   enterprise.gov.ie dataprotection.ie

4. 04ePrivacy / electronic marketing

   The European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. 336/2011) govern cookies and similar tracking technologies (opt-in consent) and unsolicited direct marketing by email, SMS and phone. Enforced by the DPC, with criminal offences prosecutable summarily.

   dataprotection.ie irishstatutebook.ie

5. 05One-stop-shop lead authority for Big Tech

   Because Meta, Google, TikTok, Microsoft, Apple, LinkedIn, X and others place their EU establishment in Dublin, the DPC acts as GDPR lead supervisory authority for many cross-border cases. On 2 May 2025 it fined TikTok €530 million and ordered corrective measures over unlawful EEA-to-China data transfers and transparency failings under Articles 46(1) and 13(1)(f) GDPR.

   dataprotection.ie edpb.europa.eu

6. 06Adjacent EU frameworks the DPC applies

   The DPC also acts as the fundamental-rights supervisor for AI systems that process personal data and, from 2026, is a designated market-surveillance authority for certain high-risk AI systems (law enforcement, biometrics) under Ireland's implementation of the EU AI Act.

   dataprotection.ie dataprotection.ie

GDPR in Ireland: FAQ

Timeline of decisions

1. 2 May 2025Enforcement · official
   DPC fines TikTok €530 million over EEA data transfers to China

   The DPC fined TikTok €530m and ordered corrective measures for unlawfully transferring EEA user data to China without ensuring EU-equivalent protection; TikTok appealed and the High Court stayed the decision on 2025-11-14 pending the outcome.

   Data Protection Commission

2. 11 Apr 2025Enforcement · official
   DPC opens inquiry into X over Grok AI training

   The DPC launched a Section 110 inquiry into X Internet Unlimited Company over whether EU/EEA users' public posts were lawfully processed to train its Grok LLMs, a landmark probe of generative-AI training data.

   Data Protection Commission

3. 17 Dec 2024Enforcement · official
   DPC fines Meta €251 million over 2018 Facebook breach

   The DPC concluded inquiries into the September 2018 'View As' token breach affecting ~29 million accounts globally, fining Meta €251m for security and breach-notification failings under the GDPR.

   Data Protection Commission

4. 27 Sept 2024Enforcement · official
   DPC fines Meta €91 million over insecure password storage

   Following a 2019 inquiry, the DPC fined Meta €91m for storing user passwords in plaintext, breaching GDPR obligations on technical/organisational security measures and confidentiality.

   Data Protection Commission

5. 22 May 2023Enforcement · official
   DPC fines Meta €1.2 billion and halts US data transfers

   The DPC issued the largest-ever GDPR fine, €1.2bn, plus suspension and cessation orders against Meta for transferring EU data to the US under SCCs that failed the Schrems II standard.

   Data Protection Commission

6. 4 Jan 2023Decision · official
   DPC fines Meta €390 million over ad legal basis

   After an EDPB binding decision overrode the DPC's draft, Meta was fined €390m for unlawfully relying on 'contract' as the legal basis for behavioural advertising on Facebook and Instagram, breaching Article 6 GDPR.

   Data Protection Commission

7. 15 Sept 2022Enforcement · official
   DPC fines Instagram €405 million over children's data

   The DPC's then-largest fine penalised Meta's Instagram for exposing children's email addresses/phone numbers via business accounts and public-by-default settings for teen accounts.

   Data Protection Commission

8. 16 Jul 2020Decision · official
   CJEU Schrems II judgment (C-311/18)

   Arising from a complaint to the Irish DPC, the CJEU invalidated the EU-US Privacy Shield and tightened conditions on Standard Contractual Clauses, reshaping how Ireland-based tech firms transfer data abroad.

   Data Protection Commission

9. 24 May 2018Law · official
   Data Protection Act 2018 enacted; DPC established

   Signed into law to give further effect to the GDPR (applicable 25 May 2018) and transpose the Law Enforcement Directive, the Act replaced the Data Protection Commissioner with the multi-member Data Protection Commission.

   Irish Statute Book

10. 6 Oct 2015Decision · official
    CJEU Schrems I invalidates Safe Harbour (C-362/14)

    Following Max Schrems' complaint to the Irish Data Protection Commissioner over Facebook transfers, the CJEU struck down the EU-US Safe Harbour framework, establishing Ireland as the front line of transatlantic data-transfer disputes.

    CJEU

11. 10 Apr 2003Law · official
    Data Protection (Amendment) Act 2003

    Transposed the 1995 EU Data Protection Directive into Irish law, modernising the 1988 regime with eight core principles covering fair processing, purpose limitation, security and data-subject access.

    Irish Statute Book

12. 13 Jul 1988Law · official
    Data Protection Act 1988, Ireland's first privacy law

    Ireland's foundational data-protection statute, enabling ratification of the Council of Europe Convention 108, introducing data-handling principles and creating the Office of the Data Protection Commissioner (1989).

    Irish Statute Book

Sources

1. 1.irishstatutebook.ie/eli/2018/act/7/enacted/en/html
2. 2.revisedacts.lawreform.ie/eli/2018/act/7/revised/en/html
3. 3.dataprotection.ie/en/who-we-are
4. 4.dataprotection.ie/en/who-we-are/what-we-do
5. 5.dataprotection.ie/en/who-we-are/data-protection-legislation
6. 6.dataprotection.ie/en/news-media/latest-news/irish-data-protection-commission-fines-tikt
7. 7.edpb.europa.eu/news/news/2025/irish-supervisory-authority-fines-tiktok-eu530-million
8. 8.enterprise.gov.ie/en/data-protection/
9. 9.irishstatutebook.ie/eli/2011/si/336/made/en/print
10. 10.dataprotection.ie/en/faqs/general/what-dpcs-role-regulate-artificial-intelligence
11. 11.dataprotection.ie/en/individuals/know-your-rights