Ireland. Comprehensive data protection. Act
DPA 2018Data Protection Act 2018 (No. 7 of 2018)
§1Summary
- Synopsis
Ireland's DPA 2018 establishes the Data Protection Commission, gives further effect to the GDPR and transposes the Law Enforcement Directive. As lead authority for most big-tech EU establishments, the DPC handles many cross-border cases.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 16. Fines on public bodies capped at €1m unless acting commercially; representative actions by non-profits; criminal offences including for directors; DPC has multiple commissioners since 2024.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover; public bodies €1m
§3Dates
- Key dates
- Adopted
- In force
- Several sections commenced by order; s.30 (ban on profiling children for marketing) not commenced
§4Text and authority
- Text
- Authoritative text irishstatutebook.ie
- Authority
- Data Protection Commission (DPC)
§5Where it applies
- Domestic law of
- Ireland
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Ireland's NIS2 transposition (National Cyber Security Bill) was not published as of Oct 2026; Ireland referred to CJEU July 2026.