Ireland
Full entry AI-checked Checked 5 November 2026
Read this together with European Union, which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Data Protection Act 2018 | No. 7 of 2018 | In force | 25 May 2018 |
| ePrivacy Regulations 2011 | S.I. No. 336 of 2011, European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 | In force | 1 July 2011 |
| Regulation of Artificial Intelligence Act 2026 | No. 31 of 2026 | In force | 31 July 2026 |
- Data Protection Act 2018: Gives further effect to the GDPR and sets up the Data Protection Commission. Section 30, an offence for profiling or marketing to children, has never been commenced. The Law Reform Commission publishes an up-to-date consolidated text.
- ePrivacy Regulations 2011: Cookies (Reg. 5) and electronic marketing (Reg. 13), enforced by the Data Protection Commission.
- Regulation of Artificial Intelligence Act 2026: Signed into law on 21 July 2026. Gives further effect to the EU AI Act. S.I. No. 403 of 2026 commenced it on 31 July 2026, except the parts of s.78 that add Coimisiún na Meán and the Data Protection Commission to the authorities using its adjudication and fines system. S.I. No. 404 of 2026 made 31 July 2026 the establishment day of the AI Office of Ireland. Market surveillance authorities are named in S.I. No. 366 of 2025, as amended by S.I. No. 405 of 2026.
Regulators
Section titled “Regulators”- Data Protection Commission (DPC)
- AI Office of Ireland (Oifig IS na hÉireann), which coordinates the AI Act and is the single point of contact
What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The GDPR applies directly. The Data Protection Act 2018 sets up the Data Protection Commission (DPC) and adds national rules to the GDPR in Part 3. Part 5 covers processing for law enforcement. For cross-border processing, the DPC is the lead authority for organisations whose main EU establishment is in Ireland.
Sources: irishstatutebook.ie/eli/2018/act/7/enacted/en/html · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Lawful bases
Section titled “Lawful bases”The GDPR’s six lawful bases apply. Ireland adds that processing is lawful where necessary and proportionate for a function given by law or the Constitution (s.38). Using data for a new purpose is also lawful where needed for security, crime prevention or legal claims (s.41). Special category data can be processed on national grounds such as employment, legal claims, insurance and health (ss.45 to 54), with suitable and specific safeguards (s.36).
Sources: revisedacts.lawreform.ie/eli/2018/act/7/section/38/revised/en/html · irishstatutebook.ie/eli/2018/act/7/section/41/enacted/en/html · revisedacts.lawreform.ie/eli/2018/act/7/section/45/revised/en/html · revisedacts.lawreform.ie/eli/2018/act/7/section/36/revised/en/html
Consent age for online services
Section titled “Consent age for online services”When an online service offered directly to a child relies on consent, children can consent for themselves from 16. Below that, a parent must give or authorise consent. Preventative and counselling services don’t count as online services for this rule (s.31). The consolidated Act shows no change to the age.
Sources: irishstatutebook.ie/eli/2018/act/7/section/31/enacted/en/html · revisedacts.lawreform.ie/eli/2018/act/7/section/31/revised/en/html
Children
Section titled “Children”A child is anyone under 18 (s.29). Data collected through an online service offered to someone as a child must be erased on request without undue delay (s.33). The section 30 offence for direct marketing, profiling or micro-targeting of children has never been commenced. The DPC’s Fundamentals (December 2021) apply to services aimed at or likely to be used by children, with a floor of protection, no profiling or marketing unless clearly in the child’s best interests, and DPIAs.
Sources: irishstatutebook.ie/eli/2018/act/7/section/29/enacted/en/html · irishstatutebook.ie/eli/2018/act/7/section/33/enacted/en/html · revisedacts.lawreform.ie/eli/2018/act/7/section/1/revised/en/html · dataprotection.ie/en/dpc-guidance/fundamentals-child-oriented-approac…
Cookies and similar technologies
Section titled “Cookies and similar technologies”Storing or reading information on a device needs consent after clear and comprehensive information, except for sending a communication or what’s strictly necessary for a service the user asked for (Reg. 5). The DPC’s guidance asks for GDPR-standard consent, no pre-ticked boxes or consent by scrolling, consent for analytics, and a reject option as prominent as accept. A stored consent choice should last no more than six months. Ignoring a DPC enforcement notice is an offence.
Sources: irishstatutebook.ie/eli/2011/si/336/made/en/print · dataprotection.ie/en/dpc-guidance/guidance-cookies-and-other-tracking… · dataprotection.ie/sites/default/files/uploads/2020-04/Guidance note o…
Electronic marketing
Section titled “Electronic marketing”Marketing emails and texts to individuals need consent (Reg. 13). The soft opt-in covers your own similar products only if the sale was in the last 12 months, with a free, easy opt-out at collection and in every message. Live calls are allowed unless the person objected or is on the National Directory Database opt-out register, but calls to mobiles need consent. Work emails about the recipient’s work are allowed unless they object. Each unlawful message is a separate offence.
Sources: irishstatutebook.ie/eli/2011/si/336/made/en/print · dataprotection.ie/en/faqs/direct-marketing
Breach notification
Section titled “Breach notification”The GDPR rule applies. Report a breach to the DPC without undue delay and, where feasible, within 72 hours, using its online form, unless it’s unlikely to risk people’s rights, and tell the people affected without undue delay when the risk is high. Record every breach, including why you decided not to report one. Telecoms and internet providers also report under Reg. 4 of S.I. 336/2011, within 24 hours where feasible under EU Regulation 611/2013.
Sources: dataprotection.ie/en/organisations/know-your-obligations/breach-notif… · eur-lex.europa.eu/legal-content/EN/TXT/HTML · irishstatutebook.ie/eli/2011/si/336/made/en/print · eur-lex.europa.eu/legal-content/EN/TXT/HTML
Registration and fees
Section titled “Registration and fees”There’s no registration and no annual fee, as the 2018 Act repealed the old register (s.7). Organisations that appoint a data protection officer must send the DPO’s contact details to the DPC through its online form. The DPC may set fees, with the Minister’s consent, only for authorising transfer clauses, approving binding corporate rules, or manifestly unfounded or excessive requests (s.28).
Sources: revisedacts.lawreform.ie/eli/2018/act/7/section/7/revised/en/html · revisedacts.lawreform.ie/eli/2018/act/7/section/28/revised/en/html · dataprotection.ie/en/dpos/who-needs-dpo
Data protection officer
Section titled “Data protection officer”The GDPR cases apply, namely public bodies and core activities with large-scale systematic monitoring or large-scale special category or criminal data. The Minister can require DPOs in more cases by regulation (s.34), but the consolidated Act records none. Appointing a DPO when not required is one of the listed “suitable and specific measures” (s.36). Send your DPO’s contact details to the DPC.
Sources: dataprotection.ie/en/dpos/who-needs-dpo · irishstatutebook.ie/eli/2018/act/7/section/34/enacted/en/html · revisedacts.lawreform.ie/eli/2018/act/7/section/36/revised/en/html · revisedacts.lawreform.ie/eli/2018/act/7/revised/en/html
International transfers
Section titled “International transfers”The GDPR transfer rules apply. Use an adequacy decision first, then safeguards such as standard contractual clauses or binding corporate rules, then the listed exceptions. The Minister can restrict transfers of some data categories for important public policy reasons where there’s no adequacy decision (s.37), but the consolidated Act records no such regulations. Contact the DPC before applying for approval of binding corporate rules.
Sources: dataprotection.ie/en/organisations/international-transfers/transfers-… · irishstatutebook.ie/eli/2018/act/7/section/37/enacted/en/html · revisedacts.lawreform.ie/eli/2018/act/7/revised/en/html
Impact assessments
Section titled “Impact assessments”The GDPR rule applies. The DPC’s list (November 2018) always requires a DPIA for systematic and extensive profiling with significant effects, large-scale special category or criminal data, and large-scale monitoring of public places. Ten more types need one where screening shows likely high risk, such as profiling children for marketing, tracking location or behaviour, large-scale profiling, biometric or genetic data with other criteria, and combining datasets. Re-assessing a DPIA after three years, or sooner if things change, is good practice (Article 29 Working Party, cited by the DPC).
Sources: dataprotection.ie/en/organisations/know-your-obligations/data-protect… · dataprotection.ie/sites/default/files/uploads/2018-11/Data-Protection…
Automated decisions and AI
Section titled “Automated decisions and AI”GDPR Art. 22 applies. Ireland also allows solely automated decisions authorised by law if they grant the person’s request, or if the person can make representations, ask for human review and appeal (s.57). The EU AI Act applies directly. The Regulation of Artificial Intelligence Act 2026 set up the AI Office of Ireland, which has coordinated it since 31 July 2026. Sector regulators supervise, such as the DPC for certain banned practices and high-risk uses, and the Workplace Relations Commission for AI at work.
Sources: irishstatutebook.ie/eli/2018/act/7/section/57/enacted/en/html · aioffice.gov.ie/about-us · enterprise.gov.ie/en/what-we-do/innovation-research-development/artif… · aioffice.gov.ie/national-competent-authorities · enterprise.gov.ie/en/legislation/regulation-of-artificial-intelligenc… · enterprise.gov.ie/en/legislation/si-no-404-of-2026.html
Penalties
Section titled “Penalties”GDPR fines reach €20 million or 4% of worldwide turnover, capped at €1 million for public bodies that don’t act as undertakings (s.141). Appeal within 28 days to the Circuit Court (fines up to €75,000) or the High Court; an unappealed fine needs Circuit Court confirmation (ss.142, 143). ePrivacy marketing offences go to court, with fines up to €5,000 per message summarily or €250,000 for a company on indictment. Most AI Act fines are set by independent adjudicators and take effect once the High Court confirms them (2026 Act, Part 6); the Central Bank and the CCPC use their own procedures.
Sources: revisedacts.lawreform.ie/eli/2018/act/7/section/141/revised/en/html · irishstatutebook.ie/eli/2018/act/7/section/142/enacted/en/html · irishstatutebook.ie/eli/2018/act/7/section/143/enacted/en/html · irishstatutebook.ie/eli/2011/si/336/made/en/print · irishstatutebook.ie/eli/2010/act/8/section/3/enacted/en/html · irishstatutebook.ie/eli/2026/act/31/section/105/enacted/en/html · irishstatutebook.ie/eli/2026/act/31/section/114/enacted/en/html · irishstatutebook.ie/eli/2026/act/31/section/133/enacted/en/html · irishstatutebook.ie/eli/2026/act/31/section/136/enacted/en/html
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/ie.yaml.