GDPR for a small Irish business, and what the Data Protection Commission deals with

The Data Protection Commission published its annual report for 2025 on 30 June 2026. The figures below are as the report gives them, with its printed page numbers.

The report says most access complaints have another dispute behind them, such as a falling-out between employer and employee, a dispute over money, or something that began as poor customer service (page 21).

Its example of correspondence sent to the wrong person is the wrong document put into an envelope addressed to an unrelated third party. It adds that you must keep a record of every breach, reported or not (Article 33(5)), and that the DPC has started checking whether organisations keep one (page 35).

The report gives three reasons for the site visits: to see whether the business was still trading, to explain its GDPR duties to a smaller business, and to collect documents before the DPC considered using its enforcement powers. The places visited included the business addresses a number of sole traders had registered with the Companies Registration Office (CRO) (page 24).

If a complaint cannot be settled by agreement, the DPC can order the business to comply with the request (an enforcement notice), or issue a reprimand (section 109(5) of the Data Protection Act 2018). Failing to comply with an enforcement notice without a reasonable excuse is an offence (section 133). The report describes a reprimand as a public record of non-compliance, which is taken into account if the DPC considers tougher enforcement later (page 26). See subject access requests.

The large fines are a separate matter. Of the €530,773,000 in fines the DPC imposed in 2025, €530 million was one decision against TikTok over transfers of users' data to China (page 7).

These apply whatever your size, unless the line says otherwise. Each links to the guide that covers it. All the deadlines are in the compliance clocks.

The record holds who you are, why you use the data, the kinds of people and data involved, who receives it, any transfers outside the EEA and, where possible, when data will be deleted and a description of your security measures (Article 30(1)). You must show it to the DPC if asked (Article 30(4)).

An organisation employing fewer than 250 persons does not have to record processing unless it is likely to result in a risk to people's rights and freedoms, is not occasional, or includes special category or criminal conviction data (Article 30(5)). The Article 29 Working Party, whose guidance the European Data Protection Board (EDPB) endorsed, reads those as three separate tests: any one of them brings the processing back into the record. It also reads the first as any risk, not only a high risk. Its example is a small organisation's employee data. That is processed regularly, which means it is not occasional and goes in the record.

In practice, staff records, the customer list or booking system, and anything involving health data go in. A one-off activity with no risk and no special category or criminal conviction data can stay out. The exemption covers the Article 30 record and nothing else. The breach log, the privacy notice, the processor contracts and the duty to be able to show you comply (Article 5(2)) apply at any size.

The DPC asks for the record. Its 2025 review of supermarkets and convenience stores found one based on a UK template that did not properly reflect processing specific to Ireland (page 80). An incomplete record was one of the failings in the University of Limerick decision (page 43).

You must appoint one in three cases (Article 37(1)): you are a public authority or body; your core activities require regular and systematic monitoring of people on a large scale; or your core activities consist of large-scale processing of special category or criminal conviction data. Otherwise it is optional.

The Article 29 Working Party's guidelines on DPOs treat paying employees and standard IT support as support functions, not core activities. They give a single doctor's patient data as an example of processing that is not on a large scale. Keeping staff and customer records does not, by itself, make processing a core activity. The same guidelines list email retargeting, data-driven marketing, loyalty programmes, behavioural advertising and CCTV among activities that may be regular and systematic monitoring. A business built on one of them at scale should check Article 37(1)(b). A clinic should check too. Health data is part of its core activity, so the question is scale, which the GDPR does not define.

Section 34 of the Data Protection Act 2018 lets the Minister require DPOs in more cases by regulation. The Irish Statute Book's directory for the Act, updated to 6 October 2026, lists no regulations made under it.

US organisations that take part in the EU-US Data Privacy Framework are covered by an EU decision that their protection of personal data is adequate (an adequacy decision): Commission Implementing Decision (EU) 2023/1795. It is on the Commission's list of adequacy decisions. On 3 September 2025 the General Court dismissed a challenge to it (Case T-553/23). An appeal to the Court of Justice was brought on 31 October 2025 (Case C-703/25 P), asking it to set that judgment aside and annul the decision. No judgment or Advocate General's opinion in the appeal had been published on EUR-Lex by 15 October 2026.

On 29 June 2026 the US Supreme Court, in Trump v. Slaughter, overruled the limits on the President's power to remove members of the Federal Trade Commission (FTC). On 31 July 2026 the Chair of the European Data Protection Board asked the Commission to assess closely whether that judgment affects how the decision works. The decision itself refers to the FTC's independence, including that its commissioners could be removed only for cause. The letter asks for an assessment. It does not suspend anything. Check that each US supplier's certification is active and covers the data, and use standard contractual clauses (Article 46) for any supplier that is not certified.

Regulation 13 of S.I. 336/2011 governs marketing by email, text and phone. Breaking it is a criminal offence, and the DPC can prosecute it itself in the District Court (Regulation 26(1)). Marketing email or texts to an individual need their consent first (13(1)). The Regulations count texts as electronic mail.

There are two exceptions. The first is an address that reasonably appears to be used mainly for the person's business, with a message about that business only (13(2)). The second is existing customers (13(11)). You can market your own similar products or services to them if they could object free of charge when you collected their details and in every message since, and the sale or your last marketing email to them was within the previous 12 months. Email to a company's own address is allowed until the company objects (13(4)).

Every marketing email needs a valid address for requests to stop (13(12)(c)). Each message is a separate offence and the sender has to prove consent (13(13)(b), 13(14)). On conviction in the District Court, where the DPC prosecutes, the penalty is a class A fine of up to €5,000 (13(15)(a); Fines Act 2010, section 3). On conviction on indictment, in a higher court, the maximum is €250,000 for a company and €50,000 for an individual (13(15)(b)). The DPC's 2025 report says the problems reported most were opt-outs that were ignored, broken or missing, and marketing without consent. It says opt-outs must be tested regularly (page 29).

Pulse Gym, trading as Energie Fitness Dublin 8, pleaded guilty on 27 May 2024 to a charge of sending unsolicited marketing texts. Its consent was in the terms members accepted when joining online, it could not produce a copy, and the opt-out had failed because of a fault in its service provider's software. Brown Thomas Arnotts faced 21 charges and on 7 September 2026 pleaded guilty to five sample charges. Three were for having no valid opt-out address, after a fault at its software provider made unsubscribing fail from time to time. Two were for marketing without valid consent. Some complainants had withdrawn their consent with the company directly and kept receiving marketing. Both businesses had been warned first, and in both cases the court applied the Probation Act. After the second, the DPC reminded organisations that they remain the accountable party for personal data processed for marketing.

The DPC's CCTV guidance, last updated in November 2023, says a sign at all entrances will normally be enough. The sign gives the purpose, who you are and how to contact you. The rest of the information Article 13 requires, including how long you keep footage, must be easy to reach. The law sets no fixed period for keeping footage, and footage may not be kept just in case. For a normal security system, the DPC says it would be difficult to justify keeping footage beyond one month. The exception is footage of an incident, such as a break-in, kept to investigate it. Check your recorder's default setting against that.

Using footage for a new purpose needs its own justification. The same guidance says CCTV justified for security or health and safety should not be used to monitor staff attendance or performance. Using footage in a disciplinary matter has to be shown to be necessary and proportionate, case by case (pages 14 and 15). The DPC's 2025 report describes a reprimand to the Irish Prison Service. It had used its CCTV to follow an employee's movements in a disciplinary matter the employee had already admitted. It could not show why that was necessary or proportionate, how it fitted its own CCTV policy, or what its lawful basis was (page 27).

For all other personal data, the rule is the same: keep it no longer than the purpose needs (Article 5(1)(e)). Your privacy notice gives the period, or how you decide it (Article 13(2)(a)). Your record of processing gives deletion time limits where possible (Article 30(1)(f)).

DPC decisions on organisations smaller than a bank or a large online platform, in date order. University of Limerick and the City of Dublin ETB are public bodies. They are included because what failed there (email security, the record of processing, reporting breaches) can fail in a small business too.

Security (Article 32) is among the failings in every one. Mailboxes taken over by phishing appear twice (Virtue, Limerick). A supplier appears twice: Slane had not checked the outside provider that designed and managed its website (due diligence) and had no Article 28(3) agreement with it, and Fastway's breach happened while a service provider modified its systems. The record of processing appears twice (Slane, Limerick), and late or missing breach reports twice (CDETB, Limerick). In this selection, outside the two health cases, the organisations that are not public bodies were fined €15,000 or less, or reprimanded without a fine.

A person who believes their data protection rights have been infringed can sue the business responsible for the data (the controller) or its supplier (the processor), under section 117 of the Data Protection Act 2018. The claim is treated as a tort, a civil wrong. The court can grant an injunction, a declaration or compensation, and damage includes non-material damage. Since 11 January 2024 these claims can be brought in the District Court as well as the Circuit Court and the High Court.

Article 82 of the GDPR gives the same right. In UI v Österreichische Post (C-300/21, 4 May 2023) the Court of Justice held that breaking the GDPR does not, on its own, give a right to compensation. But national courts may not require non-material damage to reach a certain degree of seriousness. A person who can show some harm does not have to show it was serious. Breaking the GDPR with no harm shown produces no damages by itself.

Two Irish judgments show the amounts involved. In Kaminski v Ballymaguire Foods (Circuit Court, 11 July 2023), an employer showed CCTV footage at a meeting of managers and supervisors about food safety practice, and a supervisor could be identified in it. The court awarded €2,000 for non-material damage. It said damages in many cases will probably be modest, and that some non-material damage could be valued below €500. Dillon v Irish Life Assurance (Supreme Court, 24 July 2025) was a claim over six letters sent in error to a third party. The court held that a claim for distress, upset and anxiety alone does not need authorisation from the Personal Injuries Assessment Board (now the Personal Injuries Resolution Board). It said such claimants cannot expect anything other than very, very modest awards. A claim for a medically recognised psychiatric injury does need that authorisation.

Two proposals would change parts of the above. Neither is law on 15 October 2026.

The Commission's Omnibus IV proposal of 21 May 2025 would extend the record-keeping exemption to organisations employing fewer than 750 persons, and keep the duty only where processing is likely to result in a high risk. The text agreed with the Council on 26 June 2026 sets the threshold at fewer than 1,000 persons, with a record still needed for any activity likely to result in a high risk. Parliament's committee approved that text on 2 July 2026, and Parliament's first-reading vote has an indicative date of 23 November 2026. Neither figure is law yet. Until the change is adopted, published and in force, Article 30(5) applies as written above.

Under the Digital Omnibus proposal of 19 November 2025, only a breach likely to result in a high risk would have to be reported to the regulator, where feasible no later than 96 hours after becoming aware of it, through a single EU entry point. A business could refuse an access request, or charge a reasonable fee for it, where the person is using the right for purposes other than protecting their data. The business would have to prove that (Article 12(5)). The privacy notice could be dropped where the relationship is clear and limited, the business is not data-intensive, and the person can be assumed to know already who it is and why it has their data. That would not apply if the data goes to other recipients, leaves the EEA, feeds automated decisions or is likely to be high risk (Article 13(4)). The proposal's example is a craftsman and their clients, and it says employment is not such a case. It would replace national DPIA lists such as Ireland's with EU lists, and move the cookie consent rule into the GDPR as a new Article 88a.

On 15 October 2026 the Digital Omnibus was awaiting a committee decision in Parliament. Today's rules all still apply: the 72 hours, reporting a breach unless it is unlikely to result in a risk, the access request rules, the privacy notice duty, Ireland's DPIA list and the cookie rule in Regulation 5.

Separately, the DPC published a consultation in November 2025 on the difficulties smaller enterprises have in complying, and says its next steps include tailored guidance and toolkits for them (page 81).

In the order the DPC's figures point to.