Who regulates what online in Ireland, and who can contact you

An ordinary Irish website aimed at consumers now falls under several separate sets of rules at once. They were written at different times, by different institutions, and they are enforced in different ways.

The DPC is the Irish supervisory authority for the GDPR, and its powers also cover the ePrivacy Regulations of 2011 and the Law Enforcement Directive. It publishes its decisions, including decisions against small organisations.

Its 2025 annual report records 16,160 new cases from individuals, a 45% increase on 2024, and 6,521 valid breach notifications, a 16% decrease. Almost half of those breaches were correspondence sent to the wrong recipient.

Coimisiún na Meán is Ireland's Digital Services Coordinator. It is also the authority that enforces the Digital Services Act, except for Articles 30, 31 and 32. Both roles come from section 8 of the Digital Services Act 2024.

It is enforcing. It opened an investigation into X in November 2025 concerning Article 20, the internal complaint-handling system. In December 2025 it opened investigations into TikTok and LinkedIn concerning Articles 16 and 25. In May 2026 it opened two investigations into Meta, in respect of Facebook and Instagram, concerning Articles 25 and 27 and the design patterns around choosing a non-profiling feed.

Every one of those is against a very large platform. Most of the obligations at issue are in Section 3 of Chapter III, which Article 19 switches off for a micro or small online platform. The exception is Article 16, the notice and action mechanism in the TikTok and LinkedIn investigations, which sits in Section 2 and binds every hosting service whatever its size. An Irish shop that is not an intermediary service at all is outside these rules.

The Competition and Consumer Protection Commission has four digital remits.

Under Part 3 of the Digital Services Act 2024 it is the competent authority for Articles 30 to 32, the online marketplace provisions. Under Regulation 4(1) of the Accessibility Regulations it is the market surveillance authority for every in-scope product. And under Regulation 4(2)(f) and (g) it is the compliance authority for e-books and for e-commerce services. It is also designated under the AI Act, as the market surveillance authority for high-risk AI built into toys, consumer protective equipment and domestic gas appliances.

For an Irish shop's website, the regulator of accessibility is the CCPC, not the National Disability Authority. The NDA's role under the Accessibility Regulations is advisory, under Regulation 4(4). Its monitoring role is under the separate public sector regime, S.I. No. 358 of 2020, and applies to public bodies.

Two of these regimes have no published Irish enforcement action that we could find as at 28 September 2026.

Under S.I. No. 636 of 2023, the Accessibility Regulations, we found no published direction, compliance notice or prosecution. The CCPC's accessibility pages carry guidance and a set of guidelines for microenterprises, but no enforcement outcomes. ComReg's information notice of June 2025 says it can take enforcement action, but reports none. The regulators are still at the guidance stage.

Under the AI Act, we found no published Irish enforcement action either. The AI Office was established in July 2026, and the high-risk regime does not apply until December 2027.

In both cases that is a statement about what has been published. Under the Accessibility Regulations, a direction starts with a notice of proposal and fourteen days for the business to respond. Nothing requires that notice to be published, so finding none published does not mean none was issued.

How each one can reach an Irish business with a website.

There is no need to memorise a table of regulators. What is worth remembering is the pattern: what your business does decides which rules apply to you, and the rules decide which bodies you deal with.

The free checks on this site are organised by activity. Each one asks what you do, then lists the duties that follow from your answers and the body that supervises each duty.

For the AI side specifically, who regulates AI in Ireland is set out separately. The Department's list names fifteen competent authorities, and S.I. No. 405 of 2026, made on 31 July 2026, designated the five that the original regulations had left out: Coimisiún na Meán, the Commission for Regulation of Utilities, the Health Service Executive, the National Transport Authority and the Workplace Relations Commission.