GDPR fines in Ireland: what the Data Protection Commission has done to small organisations, from its own published record

This is our own compilation, read on 30 October 2026 from dataprotection.ie and nothing else. It covers every entry on the Data Protection Commission's (DPC) decisions page, 66 entries holding 64 decisions because two are listed twice, dated from August 2019 to June 2026; its table of fines; the 196 case studies in its three case-study booklets (May 2018 to May 2023, 2024 and 2025); and the enforcement and marketing sections of its annual reports for 2018 to 2025.

We counted an organisation as small when the DPC's own text shows it to be: a charity with a turnover under €700,000, a consultancy that told the DPC it had four employees, a credit union with five permanent staff. We left out public bodies, universities, hospitals, banks, insurers, telecoms companies and online platforms, and any organisation whose size the DPC's text does not give. We counted a case when the outcome was a fine, a reprimand or an order to bring processing into compliance. Only what the DPC published is counted. Complaints it settled without publishing them are not here.

As the DPC published it on 30 October 2026:

Each described by sector and size as the DPC's decision gives them. The sources at the foot link each decision under its inquiry reference.

All three broke Article 32(1), the duty to take technical and organisational measures that give a level of security appropriate to the risk. Both fines were about security: the credit union's was for Article 5(1)(f), the principle that personal data is kept secure, and the charity's was for its infringements of Articles 5(1)(f) and 32(1). The credit union's other failings, the missing supplier checks and contract and the incomplete record, brought a reprimand, not a fine.

Two of the three inquiries began with the organisation's own breach report. The third began with a report from the body that received the data. Article 33 asks for a report to the DPC without undue delay, and where feasible within 72 hours of becoming aware of a breach; the first 72 hours sets out what to do in them.

The fines were sized to the organisation. In the charity's decision the DPC gave its turnover and said a fine cannot be effective if it has no significance relative to the revenue of the controller. Both decisions set the ceiling for an Article 5(1)(f) infringement at €20,000,000 or 4% of turnover, whichever is higher, and both say that ceiling is not a starting point. In the consultancy's case the DPC chose a reprimand over a fine, citing recital 148 of the GDPR, which allows a reprimand in place of a fine for a minor infringement.

Three more decisions concern private organisations smaller than a bank or a platform, but the DPC's text does not show them to be small. A company operating five nursing homes was fined €100,000 after phishing took over a manager's mailbox. A courier company was fined €15,000 after unauthorised access while a service provider changed its systems. A private healthcare group with over 500 staff was fined €460,000 after ransomware. All three were also reprimanded. They are not counted above. The guide to GDPR for a small Irish business lists them by name, with two public bodies whose failings a small business can share.

The case studies cover many more organisations of the kind a small business would recognise: golf and sporting clubs, a hotel, a city-centre bar, a motor dealership, charities, a hospice, a medium-sized law firm. None of the 196 ends in a fine outside the marketing prosecutions, and the only reprimands are the four cross-border decisions. Three by sector, with what the DPC did:

The DPC prosecutes unsolicited marketing emails and texts under Regulation 13 of the ePrivacy Regulations. In each summary read for this page, the prosecution followed an earlier warning or an earlier prosecution. The summaries do not give the size of the businesses, so none is counted above.

In 2024 the DPC prosecuted eight companies. In every case the court directed a charitable contribution in place of a conviction and fine, €9,725 across all eight, and the companies were instructed to pay the DPC's legal costs. All eight had received a prior warning. The sectors included an advertising agent, a telecommunications network, hospitality and travel, cosmetics and fitness. In 2025 the DPC issued 50 warning letters about marketing messages.

Three earlier cases, by trade. A pizza and pasta company, warned in 2013, pleaded guilty to one offence in 2020 after four complaints about texts: the court applied the Probation of Offenders Act on a €200 donation, and the company agreed to pay the DPC's costs. An online fashion retailer, warned in April 2018, pleaded guilty to one charge in 2019 after a customer it had failed to unsubscribe complained again: the Probation of Offenders Act, on a €600 donation. In 2022 a company prosecuted once before, in 2019, was convicted on three charges and fined €6,000 in total, with €1,000 towards the DPC's costs. It had taken two people off its marketing lists but not off a Gmail contact list it also sent from. The rules themselves are in email marketing rules for Irish businesses.

The published record is a small part of the DPC's work. Its 2023 annual report says its complaint-handling units concluded 3,218 cases that year through amicable resolution or the actions in section 109 of the Data Protection Act 2018; the three booklets hold 196 case studies covering 2018 to 2025. A decision about a small organisation that does not state its size is outside this count by our rule, and the near misses above show how much that rule leaves out.

A fine also does not become payable when it is announced. The DPC's fines page says a fine must be confirmed by the Circuit Court if there is no appeal, and cannot be collected while an appeal runs. The appeal route and the DPC's other powers are in the Data Protection Act 2018.