The Data Protection Act 2018: what Ireland's own law adds to the GDPR, and the parts a small business meets

The GDPR, Regulation (EU) 2016/679, has applied directly in Ireland since 25 May 2018. It leaves some choices to each country and allows national law to add conditions and restrictions. The Data Protection Act 2018 (No. 7 of 2018) is where Ireland makes them. Its long title says it gives further effect to the GDPR and gives effect to the Law Enforcement Directive, Directive (EU) 2016/680.

The Data Protection Commission's own summary is that the GDPR applies by default to the majority of personal data processing, and that further rules on certain issues, such as the reasons for which and the extent to which people's rights may be restricted, are set out in the Act.

The Act is dated 24 May 2018 and, apart from a handful of provisions, came into operation on 25 May 2018 (S.I. No. 174 of 2018). One section has never come into operation: section 30, which would make it an offence for a company or corporate body to process a child's personal data for direct marketing, profiling or micro-targeting. The Irish Statute Book's directory for the Act, updated to 21 October 2026, lists it as not yet commenced. The sections below are read from the Law Reform Commission's revised text of the Act, updated to 16 July 2026, which carries the amendments made since 2018.

Section 10 established the Data Protection Commission, An Coimisiún um Chosaint Sonraí, on the establishment day, which S.I. No. 175 of 2018 set as 25 May 2018. Section 11 makes it Ireland's supervisory authority for the GDPR and for the Law Enforcement Directive. Section 12(7) says it is independent in performing its functions, and section 14 transferred to it all the functions of the old Data Protection Commissioner. It has up to three members, each called a Commissioner for Data Protection (section 15).

Part 6 of the Act gives it its powers over a business. It handles complaints, and where it considers the parties reasonably likely to reach an amicable resolution it can help them reach one (section 109). Where they cannot, it can reject or dismiss the complaint, give advice, serve an enforcement notice, issue a reprimand or open an inquiry (section 109(5)). It can also open an inquiry of its own accord (section 110). Its authorised officers can enter, at any reasonable time, a place where personal data is processed, search and inspect it, and require documents and records, though they need the occupier's consent or a warrant to enter a home (section 130). It can demand information by an information notice and order steps by an enforcement notice, and both can be appealed (sections 132 and 133).

Fines are decided under Article 83 of the GDPR (section 141). An appeal against a fine goes to the Circuit Court where the fine is €75,000 or less, and to the High Court where it is more (section 142). A fine that is not appealed goes to the Circuit Court for confirmation, which the court gives unless it sees good reason not to (section 143). How the DPC has used its powers against smaller organisations is in the GDPR guide for a small Irish business.

Article 8 of the GDPR covers an online service offered directly to a child where the service relies on consent. Below the age the law sets, the consent has to be given or authorised by the person with parental responsibility, and the business has to make reasonable efforts to verify that it was. The GDPR sets that age at 16 and lets each country lower it, to no less than 13. Section 31 keeps it at 16 in Ireland. It also says that, for this purpose, an online service does not include preventative or counselling services.

The Data Protection Commission's leaflet on children's data sets out the limit of the rule: it applies where the service relies on consent. A service that relies on another legal basis does not need a parent's consent for a child under 16.

Two other sections reach further. Section 29 says that wherever the GDPR refers to a child, in Ireland that means a person under 18. Section 33 requires a business to erase, on request and without undue delay, personal data collected when it offered a person an online service of the kind Article 8(1) covers, unless one of the exceptions in Article 17(3) applies.

Article 8 and section 31 matter to a small business only if it offers an online service directly to children and relies on their consent. The offence in section 30 is not in force.

The GDPR allows personal data to be used for a purpose other than the one it was collected for where the new purpose is compatible with the old one, where the person consents, or where a national law that is a necessary and proportionate measure for one of the objectives in Article 23(1) allows it (Article 6(4)).

Section 41 adds grounds in Irish law. Personal data, special category data included, may be used for another purpose to the extent that is necessary and proportionate to prevent a threat to national security, defence or public security; to prevent, detect, investigate or prosecute criminal offences; or for the purposes in section 47, which are legal advice, legal claims and proceedings, and establishing, exercising or defending legal rights. It is without prejudice to further processing that is already lawful under the GDPR.

One place a small business meets section 41 is a request from An Garda Síochána for CCTV footage for an investigation. The CCTV guide covers how the DPC recommends handling one.

Article 9 of the GDPR forbids using special category data, which includes health and genetic data and biometric data used to identify a person, unless one of its conditions applies, and several of those conditions rely on EU or national law. Section 45 makes the processing lawful where section 41 or sections 46 to 54 authorise it, or where Article 9 otherwise does. The special category guide covers Article 9 itself. These are the Irish conditions:

The condition that recurs through the Act is suitable and specific measures to safeguard people's rights. Section 36(1) lists what they may include: explicit consent; limits on who in the workplace can see the data; strict time limits for erasing it; specific training for the people who handle it; and, depending on the risk, logs of who consulted, changed, disclosed or erased it, a data protection officer where the GDPR does not already require one, health data handled only by a health practitioner or someone with an equivalent duty of confidentiality, pseudonymisation and encryption.

Section 36(2) lets a Minister make measures mandatory by regulation. The only regulations made under it are the health research regulations and their amendments. The Data Protection Commission's list of processing that needs an impact assessment includes, as item 10, large scale processing where the Act requires these measures; the DPIA guide covers when that applies.

Data about criminal convictions and offences has a section of its own. Section 55 always requires an Article 6 basis and suitable and specific measures. Within that, it allows the data to be processed under the control of official authority, or where the person gives explicit consent, where it is necessary and proportionate for a contract with them, for legal advice or legal claims, to prevent injury or other damage to a person or loss of or damage to property, or where regulations or other Irish law permit it. The directory lists no regulations under section 55(3), which would cover fraud, bribery and corruption, and the security of networks and information systems.

Article 22(2)(b) of the GDPR lets national law permit decisions based solely on automated processing. Section 57 does so only where the decision is authorised or required by or under an enactment, and it either grants what the person asked for or comes with arrangements for them to make representations, ask for human intervention and appeal. It gives no route to a business that decides to automate a decision on its own initiative. The Article 22 guide covers the rules that apply then.

Section 58 says that, for the right to object to direct marketing in Article 21, direct marketing includes direct mailing. Mailing by political parties and their members, candidates and office holders in the course of electoral activities, and by the Electoral Commission, is excluded.

Article 23 of the GDPR lets national law restrict people's rights. Section 60 does that in Ireland, and sections 61 and 162 add more. Section 60 restricts the rights in Articles 12 to 22, and the duty in Article 34 to tell people about a breach, in the cases section 60(3) sets out. These are the ones a business can rely on:

Section 162 applies to any business: it takes data processed for legal advice, and data over which legal privilege could be claimed in legal proceedings, outside the rights in Articles 12 to 22 and the duty in Article 34.

The rest of section 60(3) concerns the State: cabinet confidentiality, parliamentary privilege, national security, defence and international relations, money owed to the State or a local authority, and the work of the Data Protection Commission, the Information Commissioner and the Comptroller and Auditor General. Section 60(5) allows regulations restricting the rights where applying them would be likely to cause serious harm to the person's physical or mental health; S.I. No. 121 of 2022, the access modification regulations for health data, is made under it. The regulations made under section 60(6) each name a public body, an inquiry, a tribunal or a scoping exercise. Section 61 restricts some rights for archiving, research and statistics.

The Data Protection Commission says that a business restricting someone's access must say why and state the provisions it relies on. The subject access request guide works through the restrictions a business can use, and how to answer the rest of a request.

Article 79 of the GDPR gives every person the right to an effective judicial remedy against a controller or processor. Section 117 is how that works in Ireland. A person who considers that their rights have been infringed by processing that does not comply with the law can bring a data protection action against the business responsible for the data (the controller) or a supplier handling it for that business (the processor). The action is treated as an action in tort. The court can grant an injunction or a declaration, and compensation, and damage includes material and non-material damage.

As enacted, section 117 gave these actions to the Circuit Court, concurrently with the High Court. Since 11 January 2024 the District Court can hear them as well (section 77 of the Courts and Civil Law (Miscellaneous Provisions) Act 2023). Compensation in the District Court or the Circuit Court cannot exceed that court's limit in tort. In those two courts the case can be heard in the district or circuit where the business has an establishment or where the person habitually lives. A not-for-profit body the person mandates under Article 80(1) can bring the action on their behalf.

Beside the DPC's fines, the Act creates criminal offences. These are the ones that can reach an ordinary business:

These parts of the Act are written for somebody else, and a small business can set them aside. The GDPR guide for a small Irish business takes the duties that remain in turn.