The legal clocks that can start running against an Irish business, and what starts each one

Every row below is a deadline that starts running on an event: a request arriving, a breach coming to light, a whistleblowing report being made. The table gives where it comes from, what starts it, the deadline, who owes it, and whether it binds a business in Ireland on 15 October 2026.

It covers data protection and electronic marketing, security incident reporting, and whistleblowing. Tax, employment, company filing, consumer refund and accessibility deadlines are not in it, nor is serious incident reporting under the AI Act, which reaches providers of high-risk AI systems. One row is regulator guidance, not law, and says so.

Check the column headed "Who owes it". Eleven of the nineteen rows apply only to a defined group, and a business outside that group can set them aside.

When a person asks to use one of their data rights, you must tell them what you have done about it without undue delay, and at the latest one month from receipt (Article 12(3)). The rights are in Articles 15 to 22: access, correction (rectification), erasure, restriction, portability, objection and rights about automated decisions. The month can be extended by two further months where necessary, given how complex and numerous the requests are. You can only do that by telling the person within the first month, with the reasons. If you decide not to act, the same month applies (Article 12(4)). Give the reasons, and tell the person they can complain to the DPC and go to court.

The month is the ceiling, not the target. The European Data Protection Board (EDPB) says in its access guidelines that if the information can be given in less than a month, it should be. Correcting and erasing data have their own deadline: Articles 16 and 17(1) require them without undue delay. The month is the limit for telling the person what was done, not extra time in which to do it.

The clock starts at receipt, not when somebody reads the request. The Board says the time limit starts when the request reaches you through one of your official channels, even if nobody has noticed it yet. A request sent another way you provide, such as your general email address, generally counts too. The Board says you cannot extend the period because the request went there. It recommends confirming receipt in writing, with the dates the month runs from and to. If you have reasonable doubts about who is asking, and ask for more information without undue delay, the clock may be paused (suspended) until you have it.

The Board counts the month using the EU rules on periods, dates and time limits (Regulation 1182/71). A request received on 5 March is due by 5 April at the latest. One received on 31 August, with no 31 September, is due by 30 September. Where the last day falls on a weekend or a public holiday, you have until the following working day.

The DPC's 2025 annual report records 1,280 complaints about the right of access and calls alleged non-compliance with access requests the primary source of complaints to it. It adds that a review of those complaints indicates the majority have underlying issues at their core, such as a deteriorating relationship between employer and employee.

A second one-month clock runs when you get personal data about a person from somebody else, such as through a referral or a list. You must tell the person how you are using their data within a reasonable period, and at the latest within one month (Article 14(3)). Tell them sooner if you use the data to contact them or pass it on. The duty does not apply in some listed cases, including where the person already has the information (Article 14(5)).

Set these up before a request arrives. Publish one address for requests, watched by a named person with a deputy. Make a rule that a request reaching any other address you publish, such as a general info address, is logged and passed on the day it arrives. Prepare a written acknowledgement that gives the date the month ends. Keep a log of the date each request arrived. Have a short identity question ready to send at once where there is reasonable doubt about who is asking, because the clock is paused only if you ask without undue delay. Keep a list of the systems that hold personal data. The guide to access requests covers the reply itself.

The business responsible for the data (the controller) must tell the DPC about a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33(1)). It does not have to if the breach is unlikely to result in a risk to people's rights and freedoms. A notification made after 72 hours must give the reasons for the delay.

Awareness is the trigger. The EDPB treats a controller as aware once it has a reasonable degree of certainty that a security incident has led to personal data being compromised. A short investigation to establish that can come first, and should begin as soon as possible. The 72 hours is the outer limit where feasible. The first requirement is to act without undue delay.

A business that handles data for another (a processor) has no fixed hours of its own. It must tell the business it works for (the controller) without undue delay (Article 33(2)). The EDPB treats the controller as aware, in principle, once the processor has told it. It says the contract between them can require early notification. Setting a number of hours in the processor agreement fixes that.

Telling the people affected has a higher bar. You must tell them without undue delay where the breach is likely to result in a high risk to them (Article 34(1)). You need not tell them if the data was made unreadable, for example by encryption, or if later measures mean the high risk is no longer likely (Article 34(3)). Where telling each person would take disproportionate effort, a public announcement takes its place. Every breach, whether you report it or not, also goes in the internal record that Article 33(5) requires.

Providers of publicly available electronic communications services run a faster clock. The Irish ePrivacy Regulations, S.I. No. 336 of 2011, now take their definitions from the Electronic Communications Code Regulations, S.I. No. 444 of 2022. Under those, the term means telecoms and internet access providers, and also providers of interpersonal communications services, such as email or messaging services offered to the public. A chat feature that is a minor part of another service is not one.

Such a provider must report every personal data breach within 24 hours of detecting it, where feasible (Regulation (EU) No 611/2013). If the facts are not all in, a fuller second notification follows within three days of the first. The Irish duty to tell the DPC is in Regulation 4(6) of S.I. No. 336 of 2011, and the DPC takes these reports on a separate form. The provider must also tell the subscriber or person affected, without undue delay, where the breach is likely to adversely affect their personal data or privacy (Regulation 4(6)(b), and Article 3 of Regulation 611/2013). That is a lower bar than the GDPR's high risk. The notice is not needed if the provider satisfies the DPC that the data was made unreadable, for example by encryption.

Set these up before a breach happens. Name a person who decides whether to notify, and a deputy, because the hours do not stop while somebody is away. Put a number of hours in your processor agreements. Keep a record of what personal data you hold and where. The first 72 hours sets out the order of work.

When somebody objects to direct marketing, Article 21(3) says their personal data shall no longer be processed for that purpose. It sets no period. The month in Article 12(3) is for telling them what you did, not time to keep marketing to them.

Emailing or texting past customers without their consent relies on Regulation 13(11) of S.I. No. 336 of 2011. Its definition of electronic mail includes a text message (SMS). The conditions are: the marketing is for your own similar products, the customer had a chance to object when their details were collected and has one in every message, and there is a clock. The sale must have been no more than 12 months before the message, or the details must have been used for marketing within that 12-month period. The DPC reads it the same way. Its e-receipts guidance says a customer who does not unsubscribe may be treated as opted in for twelve months from the most recent marketing email. Its 2020 FAQ adds that the first marketing message must be sent within 12 months of the sale.

The six months for cookie consent is the DPC's, not the law's. Its April 2020 guidance says that if you store a record of a visitor's consent, you should ask them to confirm it again no more than six months later. Its footnotes say the legislation sets no period, and that a longer one needs objective justification. The cookie article covers the rest of that guidance.

An employer with 50 or more employees must run internal channels for staff to report wrongdoing (section 6(3) of the Protected Disclosures Act 2014, inserted in 2022). It has applied since 1 January 2023, and since 17 December 2023 to private employers with 50 to 249 employees. The 50-employee threshold does not apply to public bodies, or to employers covered by the EU laws listed in Parts I.B and II of the Act's Annex: financial services and markets, money laundering and terrorist financing, transport safety, and offshore oil and gas safety.

Section 6A sets the two clocks. First, acknowledge the report in writing no more than 7 days after receiving it. Then give feedback within a reasonable period of no more than 3 months. That runs from the date the acknowledgement was sent or, if none was sent, from the end of those 7 days. Give further feedback every 3 months on written request until the procedure is closed. The Act counts days, not working days.

Failing to establish, maintain and operate the channels is itself an offence under section 14A(1)(e), punishable on indictment by a fine of up to €250,000, imprisonment of up to 2 years, or both.

Below 50 employees, and outside those sectors, there is no duty to set up channels. But section 6(11) applies the clocks in section 6A to a report made to an employer, without repeating the 50-employee threshold. The Act does not say expressly whether a smaller employer that receives a report is bound by the clocks. The safe course is to meet them: 7 days and 3 months.

What to set up before a report arrives: an impartial designated person with a deputy, an acknowledgement drafted in advance, and a diary date for the feedback set the moment the acknowledgement goes.

The reporting duties in the Cyber Resilience Act (Article 14) have applied since 11 September 2026. Most of the rest of the Act applies from 11 December 2027. The duties start when a manufacturer becomes aware of a weakness that attackers are actively using in a product with digital elements (an actively exploited vulnerability), or of a severe incident affecting a product's security. The manufacturer then files three reports: an early warning within 24 hours, a notification within 72 hours, and a final report. For a vulnerability, the final report is due no later than 14 days after a fix or workaround (a corrective or mitigating measure) is available. For an incident, it is due within one month after the notification. The manufacturer must also tell the users affected, and where appropriate all users, about the vulnerability or incident and, where necessary, the measures they can take to reduce the impact (Article 14(8)).

The duty also covers products placed on the market before 11 December 2027, so versions already sold are covered (Article 69(3)). Reports go through the single reporting platform run by ENISA, the EU's cybersecurity agency. The National Cyber Security Centre (NCSC) says only notifications made through the platform count. It says no advance registration is needed: the account is created with the first report. The NCSC's page also puts the notification at 48 hours after the early warning. The Regulation sets 72 hours from becoming aware. A notification within 48 hours of an early warning that was itself on time meets both.

Micro and small manufacturers are not subject to administrative fines for missing the 24-hour early warning (Article 64(10)(a)). The early warning is still owed, and there is no such relief for the later reports.

The Act reaches manufacturers. It reaches open-source software stewards in part: they owe the vulnerability reports to the extent they take part in development, and the incident reports where a severe incident affects systems they provide for that development. Products under the medical device, in vitro diagnostic and vehicle type-approval rules, certified aviation products and marine equipment are outside it. Cloud services designed and developed outside the responsibility of a product manufacturer are outside the Act's scope (recital 12). Whether software you sell as an online service (SaaS) is caught turns on what is installed at the customer's end. The Cyber Resilience Act guide sets out the scope test.

Set these up before one happens: a person who owns the 24-hour clock, with a deputy; a list of the products in scope, including versions you no longer sell; and a security contact that somebody watches.

NIS2 sets three filings for a significant incident: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report not later than one month after the notification. Article 23 is addressed to EU countries (Member States): each must make sure the organisations in scope report. The clocks reach a business through the national law that puts the Directive into effect (transposes it).

Article 26 decides which country's law that is. For most organisations, it is the country where they are established. For a provider of public electronic communications networks or services, it is each country where it provides its services. For cloud, data centre, managed service and similar digital providers, online marketplaces, search engines and social networks, it is the country where their main establishment is. An Irish business in scope that falls under another Member State that has transposed the Directive can be bound by that law today.

Ireland has not yet made NIS2 part of Irish law, though the deadline was 17 October 2024. On 8 July 2026 the European Commission referred Ireland, with Spain, France and the Netherlands, to the Court of Justice and asked for financial sanctions. As at 15 October 2026 no bill to transpose it has been published in the Oireachtas. The Government's National Cyber Security Strategy 2030 says the Department of Justice, Home Affairs and Migration is working with the Office of Parliamentary Counsel and the Attorney General's Office to prepare a draft of the National Cyber Security Bill, whose primary purpose is to transpose NIS2. The Law Society Gazette reported on 7 October 2026 that the bill was included for priority publication in the Government's autumn legislative programme. The NCSC says its NIS2 reporting portal will open once the legislation is implemented.

The first NIS Directive still applies, through S.I. No. 360 of 2018. A designated operator of essential services must report an incident with a significant impact on an essential service to the computer security incident response team (CSIRT) within 72 hours of becoming aware of it. The same 72 hours bind an online marketplace, search engine or cloud computing service with its main establishment or a representative in Ireland that is not a micro or small enterprise, for an incident with a substantial impact. Both must then notify the CSIRT again within 72 hours of the incident being resolved. Failing to make either notification is an offence.

Trust service providers, which NIS2 will cover regardless of size, already have a 24 hour clock of their own under the eIDAS Regulation as amended in 2024. Where a security breach or disruption has a significant impact on the trust service or on the personal data kept in it, the provider must tell the supervisory body and the identifiable people affected without undue delay, and within 24 hours. For a non-qualified provider the 24 hours run from becoming aware; for a qualified one, from the incident.

Once it is Irish law, the Directive will cover medium-sized and larger organisations of the types listed in its Annexes I and II, and some types of any size, such as trust service providers. A small business outside those types will not owe the Article 23 clocks. What can reach it is the supply chain: organisations in scope must address the security of their supply chain, including their relationships with direct suppliers (Article 21(2)(d)). What those customers ask and where the Irish law stands each have their own guide.

DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied since 17 January 2025. Article 19 requires financial entities to report major IT and communications incidents (major ICT-related incidents). In Ireland they report to the Central Bank, through its portal. Delegated Regulation (EU) 2025/301 sets the times. The initial notification is due within four hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. An intermediate report is due within 72 hours of the initial notification, and a final report no later than one month after the last intermediate report. If an incident is classified as major more than 24 hours after awareness, the entity has four hours from classification.

An entity that cannot meet one of those time limits must tell the regulator (the competent authority), with the reasons, without undue delay and no later than the time limit itself. Where a deadline falls on a weekend or a bank holiday, the entity may file by noon on the following working day. That weekend rule does not cover the initial notification or intermediate report of credit institutions, central counterparties, trading venue operators, or entities that are essential or important under NIS2. The regulator can also withdraw it for those two filings from other entities it considers significant or systemic.

Clients have a clock of their own. Where a major ICT-related incident affects their financial interests, the entity must tell them without undue delay, as soon as it becomes aware of it, along with the measures taken to limit the harm (Article 19(3)).

Irish credit unions are outside DORA until 17 January 2028, under S.I. No. 20 of 2025. Insurance, reinsurance and ancillary insurance intermediaries that are micro, small or medium-sized enterprises are outside it altogether, under Article 2(3)(e).

A business that supplies IT services to a financial entity is not under these clocks. What reaches it is the contract: Article 30(2)(f) requires the contract to oblige the provider to help when an ICT incident related to its service occurs, at no additional cost or at a cost determined in advance.