#
DPO, accountability/DPIA, security and breach-notification sub-modules are strongly evidenced by enforcement activity; ROPA, joint-controller and retention sub-modules rely on the unevidenced general GDPR baseline.
Sub-modules (7)
Accountability And DpiaGreen
The DPC has been particularly active in issuing DPIA and accountability guidance.
Claims (1):
- The DPC has been particularly active in issuing guidance on Data Protection Impact Assessments and other accountability topics such as cookies and breach notification.
Dpo RequirementsGreen
Article 39 DPO obligations are in force; the DPC reports over 1,500 new DPOs appointed in Ireland post-GDPR.
Claims (1):
- Under Article 39 GDPR, appointed Data Protection Officers must monitor internal compliance, act as contact point for data subjects exercising rights, and liaise with the supervisory authority; the DPC has reported more than 1,500 new DPOs appointed in Ireland following the GDPR's introduction.
Ropa RequirementsRed
No DPC-specific ROPA (Article 30) enforcement or guidance beyond a general reference to published Article 30 guidance was retrieved with sufficient substantive detail in this pass.
Absence provenance: unavailable. Searched: unavailable.
Joint Controller ArrangementsRed
No DPC-specific joint-controller arrangement guidance or enforcement was retrieved in this pass.
Absence provenance: unavailable. Searched: unavailable.
Security MeasuresGreen
The CDETB inquiry resulted in an order to bring processing into compliance with GDPR security-of-processing requirements.
Claims (1):
- Following an inquiry into City of Dublin Education and Training Board, the DPC ordered the controller to bring its processing into compliance with the security requirements of the GDPR.
Breach NotificationGreen
The CDETB inquiry found infringements of Articles 33(1), 34(1) and 34(4) GDPR for failure to notify the DPC and affected data subjects of a breach without undue delay.
Claims (1):
- The DPC found CDETB infringed Article 33(1) GDPR by failing to notify the DPC of a personal data breach without undue delay, and Articles 34(1) and 34(4) GDPR by failing to notify affected data subjects when required.
Retention And DisposalRed
No DPC-specific retention/disposal guidance or enforcement decision was retrieved in this pass.
Absence provenance: unavailable. Searched: unavailable.
Controller/Processor Duties
The Data Protection Commission published a final decision, dated 1 October 2026, following an inquiry into Children's Health Ireland concerning Tallaght University Hospital. The decision found infringements of the security-of-processing principle set out at Article 5(1)(f) and of the security-of-processing obligation set out at Article 32(1). As a remediation measure, the Commission ordered completion of data protection impact assessments covering two specific processing activities: healthcare-record processing and confidential-waste management.
This is a tightening development for controller and processor accountability in Ireland. The decision concerns a public healthcare body's handling of sensitive health data, a category that attracts heightened scrutiny under the security-of-processing principle given the particular risk of harm from unauthorised access or disclosure. The confidential-waste management element of the order is notable in extending accountability obligations beyond active digital processing systems into the physical disposal of records, confirming that the Commission reads the security-of-processing obligation as covering the full lifecycle of personal-data handling, including destruction.
The ordering of a data protection impact assessment as a remedial measure, rather than solely a financial penalty, reflects the Commission's accountability-first approach for this decision: rather than closing the matter with a sanction alone, the Commission has required the controller to undertake a forward-looking structured risk assessment covering the specific processing activities found deficient. This places an ongoing documentation and process obligation on Children's Health Ireland that will need to be discharged and is, in principle, capable of independent verification.
Outlook
The practical question for subsequent cycles is whether and when Children's Health Ireland completes the ordered data protection impact assessments on healthcare-record processing and confidential-waste management, and whether the Commission takes any further supervisory step in relation to compliance with that order. No further controller/processor-duties development beyond this decision was identified this cycle, so the near-term signal in this module is defined by completion of this specific remediation order rather than by any additional or forecast development.
2 earlier distinct update(s)
Controller/Processor Duties
Alongside the lawfulness and transparency findings, the DPC's 21 September 2026 decision against Google Ireland Limited found a distinct accountability-obligation infringement: a failure to demonstrate compliance with the lawfulness, fairness and transparency principle specifically in respect of Location Accuracy processing. This is an accountability finding under the GDPR's Article 5(2) accountability principle and related controller-obligation provisions, and it is analytically distinct from the substantive lawfulness findings addressed under lawful processing — this finding concerns Google's ability to demonstrate its compliance, not solely whether the underlying processing was lawful.
The accountability infringement was found specifically in relation to the Location Accuracy feature, narrower in scope than the lawfulness findings which spanned Web & App Activity, Location History and Location Accuracy together. This distinction indicates the DPC's inquiry examined each product feature separately for both substantive lawfulness and accountability compliance, rather than reaching a single undifferentiated finding across the product suite.
Outlook
The accountability finding, being narrower and feature-specific, may be a discrete point of appeal or compliance-order focus separate from the broader lawfulness findings; whether the six-month compliance order the DPC imposed addresses the accountability gap specifically for Location Accuracy will be a marker of how the corrective order is structured.
Controller/Processor Duties
Two active DPC matters this cycle bear directly on controller and processor security and breach-notification duties. First, the DPC adopted a final decision on 10 June 2026 following an inquiry into a ransomware attack on the laboratory information system at a Midlands Regional Hospital, citing infringements of Articles 5 (principles relating to processing), 28 (processor obligations), 30 (records of processing), 32 (security of processing) and 34 (communication of a personal data breach to the data subject) GDPR. This is a probable-confidence finding sourced from the DPC's own decisions register, and the breadth of articles cited — spanning core principles, processor governance, documentation, technical security, and breach communication — indicates a systemic security-failure finding rather than a narrow technical lapse.
Second, the DPC has commenced an inquiry following Permanent TSB's notification of a series of three data breaches relating to its Open 24 Contact Centre. This inquiry is understood to be ongoing, with no outcome yet determined this cycle; it is recorded here as an active development rather than a concluded enforcement matter.
Outlook
The Midlands Regional Hospital decision, now final, may generate follow-on guidance or precedent value for health-sector processors facing similar ransomware exposure. The Permanent TSB inquiry remains the item to watch: its outcome will indicate how the DPC treats a financial-sector processor facing a pattern of repeated breaches at a single contact-centre operation, rather than an isolated incident.
Sources and claims (4)
- ProbableIAPP — Under Article 39 GDPR, appointed Data Protection Officers must monitor internal compliance, act as contact point for data subjects exercising rights, and liaise with the supervisory authority; the DPC has reported more than 1,500 new DPOs appointed in Ireland following the GDPR's introduction.observed
- ProbableDataGuidance / OneTrust — The DPC has been particularly active in issuing guidance on Data Protection Impact Assessments and other accountability topics such as cookies and breach notification.observed
- ProbableEuropean Data Protection Board — Following an inquiry into City of Dublin Education and Training Board, the DPC ordered the controller to bring its processing into compliance with the security requirements of the GDPR.observed
- ProbableEuropean Data Protection Board — The DPC found CDETB infringed Article 33(1) GDPR by failing to notify the DPC of a personal data breach without undue delay, and Articles 34(1) and 34(4) GDPR by failing to notify affected data subjects when required.observed