Does a small Irish business website need a privacy notice?

If your website has a contact form, a booking page, a newsletter sign-up, or analytics, you are processing personal data and you owe the people involved information about it. That obligation is Article 13 of the GDPR, and it does not depend on your size, your turnover or whether anybody has ever complained.

In August 2026 we fetched the public websites of 82 Irish businesses across two sectors, accountancy practices and artisan food producers, as part of ordinary research. Every check was a plain request for a public page, the same request a browser makes when anybody visits.

Thirty-four had no privacy notice at the homepage or at any of /privacy, /privacy-policy, /privacy-notice, /gdpr, /data-protection or /privacy-statement. Three more did have one, at /privacy or /privacy-policy, with nothing on the site linking to it.

Those last three come up again below, under when the notice has to be given.

Article 13 applies where you collect personal data from the person themselves, which is what a contact form is. It lists what you must tell them.

Who you are and how to contact you. Why you are processing the data and the lawful basis for it. Who else receives it. Whether it goes outside the EU, and on what safeguard. How long you keep it. Whether they have to give you the data, and what happens if they do not. Their rights, which are access, rectification, erasure, restriction, objection and portability. And the right to complain to the Data Protection Commission.

Others apply only in certain cases: the contact details of a Data Protection Officer if you have one; your legitimate interests, if that is the basis you rely on; the right to withdraw consent at any time, if consent is your basis; and, if you make decisions about people solely by automated means that have legal or similarly significant effects, that fact, the logic involved and the likely consequences for them. A business that meets none of the three Article 37 tests needs no DPO, and saying so plainly is better than inventing a role.

The Data Protection Commission's own guidance lists what every notice must say and what applies only in some cases, including how consent can be withdrawn and whether there is a legal obligation to provide the data. Read its version, not a template. A template written for another country's law can cite rules that do not apply here, and leave out the Data Protection Commission. Section 11 of the Data Protection Act 2018 makes the DPC the supervisory authority for Ireland.

Article 13(1) says the information must be provided at the time the data is obtained. Not afterwards, not on request, not in a confirmation email. At the time.

In practice that means the notice has to be reachable from the form, not merely present somewhere on the site. A link beside the submit button does it, because the person sees it at the moment they hand the data over. The transparency guidelines endorsed by the European Data Protection Board recommend that placement as best practice. It is also the thing the three businesses above were missing: their notice existed and the person filling in the form had no way of knowing.

Article 14 covers the other case, where you have somebody's data and did not get it from them. The timing there is different and more generous, and Article 14(3) sets it out. The notice is due within a reasonable period, and at the latest within one month. If you are going to use the data to contact the person, it is due at the latest when you first contact them. If you are going to disclose it to somebody else, it is due at the latest when you first disclose it.

The rule about contacting the person applies to sales outreach, including ours. If you build a prospect list from public sources and then email somebody on it, the notice is due by the first email or one month after you got their details, whichever comes first. Not the second email, not the follow-up.

A privacy notice does not stand in for cookie consent, although it still has to describe any personal data your cookies collect. In Ireland the rule for storing information on somebody's device, or reading information already stored there, is Regulation 5(3) of the ePrivacy Regulations, S.I. No. 336 of 2011. It requires consent, and clear and comprehensive information, before that happens, not a notice afterwards. Regulation 5(5) makes only two exceptions: storage or access for the sole purpose of sending a communication, and what is strictly necessary to provide a service the visitor explicitly asked for. The Data Protection Commission's cookie guidance says analytics cookies do need consent.

The practical consequence: Google Analytics cannot set its cookies until the visitor has agreed. A banner that says "by continuing you accept cookies" is not consent, and neither is one where the analytics cookies were set before it was answered.

Google's consent mode can load the analytics script before the visitor answers, with its cookies turned off. Set up that way, it stores nothing on the device until the visitor agrees, and until then, or after a refusal, it sends Google a cookieless record of each page view. That record carries the visitor's IP address and browser details, so it is personal data, and Article 13 applies to it: the notice has to say what is sent, to whom, and on what lawful basis.

This site has run Google Analytics that way since 28 September 2026. No analytics cookie is set until you choose Allow. Before you answer, Google Analytics waits up to a minute for your choice; with no answer, or after No thanks, it sends the cookieless record, which our privacy notice describes. To withdraw a yes, you clear this site's data in your browser, which brings the banner back; the privacy notice says the same.

Article 9 treats data concerning health as a special category, along with racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify a person, and data about a person's sex life or sexual orientation. Processing it is prohibited unless one of the conditions in Article 9(2) applies.

A physiotherapy clinic taking a booking is processing health data the moment the form asks what is wrong, and so is an eldercare service, a counselling practice, a dentist and a chiropractor. For those businesses the notice is not housekeeping: it is the document that explains a category of processing the Regulation starts by prohibiting.

Across the two sectors we checked, nineteen sites had a form on the page collecting details with no notice attached to it. That is the combination that turns a housekeeping problem into an Article 13 one: the moment somebody types into it, the information was owed and was not given.

You need a Data Protection Officer only if one of the three tests in Article 37 applies to you. Article 37 requires one only in three cases: you are a public authority; your core activities involve regular and systematic monitoring of people on a large scale; or they involve large-scale processing of special category data, or of data about criminal convictions and offences. The DPO guidelines give a single doctor processing patient data as an example of processing that is not on a large scale, and a hospital as one that is. In between, they weigh the number of people, the volume of data, how long it is kept and the area covered, not the number of locations. Appointing a DPO you do not need creates an obligation you then have to meet.

You do not need to register with the Data Protection Commission. Registration under the 1988 and 2003 Acts ended when the GDPR and the Data Protection Act 2018 replaced them, and the DPC says it is not possible to register with it as a controller or processor.

You do not need a cookie banner if nothing on your site stores or reads information on the visitor's device, apart from what is strictly necessary for the service they asked for. That test covers a pixel that sets or reads an identifier, "like" buttons, social sharing tools, local storage and fingerprinting as well as cookies. A site that meets it needs no banner.

And you do not need six pages. A notice a person can read is worth more than a notice a lawyer can defend, and Article 12(1) requires it to be concise, transparent, intelligible and in clear and plain language.

One page, at a stable address, linked from the footer of every page and from beside every form that collects anything. Written to the reader, as "you". Name the actual systems the data goes into, not "our service providers". Article 13 allows categories of recipient instead of names. But a category still has to say what kind of business gets the data and where it is, and a person who asks under Article 15 is entitled to the names. Naming the systems is also the hardest part to write without doing the work first.

Dated, and with the date meaning something: a notice that says "last updated" and has not changed since the site added a booking system is a notice that is now wrong.

And accurate about retention. "We keep your data as long as necessary" is not a period. "Enquiries are deleted after six months unless you become a client" is.

Our privacy notice, the data protection policy behind it and our retention schedule are published. The schedule names every category of record, the period, the trigger that starts the clock and the statute.