--- title: "Ireland Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/ireland/ source_html: /jurisdictions/ireland/index.html description: "Ireland data protection and privacy regulation: 10 categories, 88 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 371c2a1c871c3cfa2fae6347ca86bd50b686b3419fde2c9e7ea2649a32e9a51d generator: "fe-fleet/md-twin@1.0" --- # Ireland Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Ireland Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/ireland/), [World Payments](https://payments.gi/jurisdictions/ireland/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 88 claims · 52 sources in the cumulative register Download report (PDF) Expand all Ireland's Data Protection Commission has closed out a run of cross-border enforcement decisions that reset the practical boundaries of transatlantic data transfers and behavioural advertising. Data collected 2026-10-18 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Sectoral Watch, AdTech & Commercial Privacy, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=IRELAND)[Build Report](/reports/?j=IRELAND)[Compare](/compare/?j=IRELAND) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Data Protection Commission (DPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 88 Claims 7 Tier-1 sources Traffic-light mix 3 green 7 amber (sums to 10 rendered categories; click to filter) No red categories; 18 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Ireland is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Ireland’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 1,428 Full executive summary 655 ###### Latest update · 18 October 2026 #### Lead Signal Ireland's Data Protection Commission has closed out one of the largest single GDPR fines issued to date, confirming on 21 September 2026 a EUR 403,000,000 penalty against Google Ireland Limited for infringing Articles 5, 6, 12 and 13 of the GDPR in its processing of location data between 25 May 2018 and 4 February 2020. The decision carries both a monetary sanction and a six-month compliance order, and it was reached by the DPC exercising its own-volition inquiry role as Google's Lead Supervisory Authority under the GDPR one-stop-shop mechanism. The scale and the procedural posture together place this decision among the defining enforcement events of the Irish regime this cycle. #### Other Developments The DPC has also closed two related health-sector matters within weeks of each other. Its decision on the Health Service Executive, dated 2 September 2026, fined the HSE EUR 645,000 in total over paper-record storage failures assessed under Article 5(1)(f) and Article 32(1), alongside a separate Article 5(1)(e) finding. A following decision concerning Children's Health Ireland, dated 1 October 2026, required completion of data protection impact assessments after security findings at Tallaght University Hospital. Taken together with the Google decision, three substantive DPC enforcement outcomes landed inside a six-week window. On the institutional side, the Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) was signed into law on 21 July 2026, establishing the AI Office of Ireland as an independent statutory body and the state's central coordinating authority for implementation of the EU AI Act. The Office became operational from approximately 1 to 2 August 2026, aligning with the AI Act's own general application date of 2 August 2026, and it operates under a distributed model in which sectoral regulators act as market-surveillance authorities. Separately, Coimisiún na Meán opened its first formal investigation under the Online Safety Code, into X, on 8 September 2026. The Code's age-assurance provisions require effective age verification, stating explicitly that self-declaration alone is not considered effective, and the Code also bans commercial reuse of age-assurance data and requires parental controls where under-16s are permitted to use a service. The Code's substantive provisions have applied since 19 November 2024 and 21 July 2025, with this investigation marking the first use of the Commission's enforcement powers under it. Finally, the DPC's own published AI Insights Report sets a markedly high bar for a common basis cited by AI developers for using personal data in model training: relying on legitimate interests to process private messages for that purpose requires, in the DPC's own words, 'a very considerably higher threshold' than for publicly available information, a threshold the Commission considers 'will be very difficult to achieve'. #### Cross-Monitor Connections The establishment of the AI Office of Ireland under the Regulation of Artificial Intelligence Act 2026, and its distributed-model coordination with sectoral market-surveillance authorities, is directly relevant to the artificial-intelligence monitor's coverage of EU AI Act national implementation. #### Outlook The DPC's enforcement tempo, having produced the Google decision and two health-sector decisions in close succession, sits alongside a live constitutional challenge to the Commission's own adjudicative process: the Irish Supreme Court granted the DPC permission to appeal preliminary issues in LinkedIn's challenge to its EUR 310m fine on 13 October 2026, with LinkedIn also seeking a cross-appeal. The outcome of that appeal has a bearing on how durable the DPC's recent run of high-value decisions proves to be, and is not yet resolved. 4 earlier updates not shown here. ###### Standing brief · as of 29 July 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Ireland's Data Protection Commission has closed out a run of cross-border enforcement decisions that reset the practical boundaries of transatlantic data transfers and behavioural advertising. The DPC, as lead supervisory authority for TikTok, found that the platform's transfers of EEA user data to China infringed Article 46(1) GDPR because TikTok failed to verify that its standard contractual clauses and supplementary measures were actually effective, and imposed €530 million in fines split between a €45 million penalty for Article 13(1)(f) transparency failures and €485 million for the Article 46(1) transfer failure. In a separate decision, the DPC found that Meta's supplementary measures layered on top of SCCs did not cure the deficiencies identified in Schrems II, reinforcing that a documented transfer impact assessment is now the operative expectation rather than an optional accountability exercise. The DPC also fined Meta Ireland €390 million after concluding that Meta could not rely on the "contract" legal basis under Article 6 GDPR to justify behavioural and personalised advertising. Set against this enforcement record, a challenger-level review of the underlying EU-US Data Privacy Framework adequacy decision has corrected an earlier overstatement: the adequacy finding permits EEA-to-US transfers only where the receiving US organisation has self-certified and maintains DPF compliance, and transfers to non-certified recipients still require SCCs or other Article 46 safeguards -- it is not an unconditional adequacy finding for the United States as a whole. That same review flags that the adequacy decision, while formally in force, faces a live supersession risk via the pending CJEU appeal in Latombe v Commission and a June 2026 noyb letter arguing that a US Supreme Court ruling undermines the FTC's independence, a pillar of the adequacy finding. #### Other Developments Ireland's baseline supervisory architecture remains unchanged and fully in force: the DPC continues to operate as Ireland's GDPR supervisory authority under Section 10 of the Data Protection Act 2018, which gives further effect to the GDPR domestically and repealed the earlier 1988/2003 Acts while preserving carve-outs for national-security, defence and international-relations processing. In the education sector, the DPC ordered the City of Dublin Education and Training Board to bring its processing into line with GDPR security-of-processing requirements after finding infringements of Articles 33(1), 34(1) and 34(4) for failing to notify a breach without undue delay, concluding that inquiry with a reprimand and a €125,000 fine. On direct marketing, the DPC pursued prosecutions in 2024 against a gym, a clinic, a fast-food company and Google over unsolicited marketing SMS messages. The DPC's 2024 annual reporting also surfaces recurring case-study themes in subject access requests and in rectification and erasure ("right to be forgotten") handling, alongside commentary on the DPC's evolving role under the EU AI Act as GDPR enforcement and AI governance increasingly overlap. On capacity, the DPC has grown to nearly 300 staff from 27 in 2014, though new Commissioner Niamh Sweeney has noted that this growth trajectory has plateaued. Structurally, Irish law requires DPC administrative fines to be confirmed by the courts before they can be collected, and as of 2026, 13 of the 15 large concluded DPC investigations are in litigation, with more than 40 active court cases pending -- a feature of the Irish enforcement pathway not shared by every GDPR supervisory authority. Overall, the DPC concluded four large-scale cross-border inquiries in 2024 resulting in fines exceeding €652 million, closed 2,357 formal complaints, and resolved a further 8,418 cases through amicable means. #### Cross-Monitor Connections The DPC's 2024 annual reporting flags a growing overlap between GDPR enforcement and the EU AI Act, including implications for how the Meta advertising decision constrains profiling-based ad personalisation; AI-Act-specific governance analysis of this overlap is routed to the artificial-intelligence monitor, with this monitor retaining the data-protection angle on profiling restrictions. Separately, the bespoke lawful ground the Data Protection Act 2018 creates for processing health data in insurance, pension and mortgage contexts carries a potential financial-crime and AML data-sharing overlap that is flagged at a general level for the financial-integrity monitor, without original financial-crime analysis performed here. #### Outlook Ireland's enforcement posture into the remainder of 2026 looks set to remain tightening rather than settling: Commissioner Sweeney has outlined enforcement priorities at the IAPP Global Summit that include continued reliance on corrective measures alongside fines and ongoing TikTok transfer litigation, against a backdrop of an EDPB-updated EU-US Data Privacy Framework FAQ (Version 2.0) published in January 2026. The most consequential open question for cross-border transfer practice is whether the DPF adequacy decision itself survives the pending Latombe appeal and the FTC-independence challenge raised by noyb -- a live risk vector that warrants closer monitoring than a straightforward "in force" reading would suggest. Several Data Protection Monitor sub-modules for Ireland -- including pseudonymisation and anonymisation practice, restriction and objection rights, data portability, joint-controller arrangements, dark patterns, and biometric and genetic data -- remain without DPC-specific sourcing in this research pass; that is recorded here as a coverage gap rather than as evidence of regulatory inactivity in those areas. Read full brief · 1428 words ###### Latest update · 18 October 2026 #### Regulatory Status Ireland's data protection and adjacent technology-regulation landscape has moved sharply into an active-enforcement posture. The Data Protection Commission's EUR 403,000,000 decision against Google Ireland Limited, confirmed 21 September 2026, was reached through the DPC's own-volition inquiry role as Google's Lead Supervisory Authority under the GDPR one-stop-shop mechanism, and found infringements of GDPR Articles 5, 6, 12 and 13 in Google's processing of location data between 25 May 2018 and 4 February 2020, with a six-month compliance order attached. Within the same six-week window, the DPC also concluded its Health Service Executive decision (2 September 2026, EUR 645,000 total for paper-record storage failures under Article 5(1)(f) and Article 32(1), plus an Article 5(1)(e) finding) and its Children's Health Ireland decision (1 October 2026, requiring completion of DPIAs following security findings at Tallaght University Hospital). On institutional architecture, the Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) was signed into law on 21 July 2026, establishing the AI Office of Ireland as an independent statutory body and the state's central coordinating authority for EU AI Act implementation, operating under a distributed model with sectoral regulators as market-surveillance authorities. The Office became operational from approximately 1 to 2 August 2026, aligning with the AI Act's own general application date. On children's safety, Coimisiun na Mean opened its first formal investigation under the Online Safety Code, into X, on 8 September 2026, testing a framework whose age-assurance provisions (effective age assurance required, self-declaration alone insufficient, commercial reuse of age-assurance data banned, parental controls required for under-16 services) have applied since 19 November 2024 and 21 July 2025. #### Outlook A constitutional challenge to the DPC's own adjudicative process is live: the Irish Supreme Court granted the DPC permission to appeal preliminary issues in LinkedIn's challenge to its EUR 310m fine on 13 October 2026, with LinkedIn also seeking a cross-appeal. The outcome bears directly on the durability of the DPC's recent enforcement run, and remains unresolved. 3 earlier updates not shown here. ###### Standing brief · as of 29 July 2026 #### Regulatory Status Ireland's Data Protection Commission, established under Section 10 of the Data Protection Act 2018, remains the GDPR's most consequential national enforcer given its lead-authority role over numerous multinational technology companies headquartered in Dublin. In 2024-2026 the DPC concluded four large-scale cross-border inquiries yielding fines exceeding €652 million, including €530 million against TikTok for Article 13(1)(f) transparency and Article 46(1) transfer failures, and €390 million against Meta for relying on an invalid 'contract' legal basis for behavioural advertising. A separate Meta decision found that supplementary transfer measures layered on SCCs did not cure Schrems II deficiencies. Ireland has also pursued education-sector enforcement, ordering the City of Dublin Education and Training Board to remedy security-of-processing and breach-notification failures under Articles 33 and 34 GDPR. On children's data, Ireland has set the GDPR Article 8 age of digital consent at 16, the maximum permitted, and published dedicated child-oriented processing guidance in December 2021. Structurally, Irish law requires DPC fines to be confirmed by the courts before collection, driving substantial litigation volume, while the Data Protection Act 2018 permits representative not-for-profit actions without a damages remedy. #### Outlook The most consequential open question for Ireland's cross-border transfer role is whether the EU-US Data Privacy Framework adequacy decision survives the pending CJEU Latombe appeal and a noyb challenge to FTC independence; the decision is formally in force but permits transfers only to DPF-self-certified US recipients, not an unconditional US adequacy finding. New Commissioner Niamh Sweeney has signalled continuity in enforcement priorities into 2026, including ongoing TikTok transfer litigation, against a backdrop of plateauing regulator headcount growth. Several sub-modules -- including pseudonymisation, restriction/objection, portability, joint-controller practice, dark patterns, and biometric/genetic data -- remain without DPC-specific sourcing this cycle and are carried forward as coverage gaps rather than signals of inactivity. Read full brief · 655 words Key regulatory facts for Ireland Regulatory Dimension Ireland Standing Position Jurisdiction Ireland (IE) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 88 sourced findings) Regulator & Framework Comprehensive, fully in-force omnibus framework with an active, well-resourced regulator and clear statutory authority. Lawful Processing & Special Data Core lawful-basis and special-category rules are fully in force and well documented; the pseudonymisation/anonymisation sub-module lacks a directly retrieved DPC-specific source in this run. Data Subject Rights Access/erasure/rectification and deadline mechanisms are well evidenced; restriction, objection and portability sub-modules rely on the general GDPR baseline without a directly retrieved DPC-specific source. Controller/Processor Duties DPO, accountability/DPIA, security and breach-notification sub-modules are strongly evidenced by enforcement activity; ROPA, joint-controller and retention sub-modules rely on the unevidenced general GDPR baseline. Primary Instruments Cited European Data Protection Board, DataGuidance / OneTrust, European Data Protection Board, Data Protection Commission, The Irish Times Last Confirmed / Updated 2026-11-04 (52 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Ireland: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Comprehensive, fully in-force omnibus framework with an active, well-resourced regulator and clear statutory authority. Primary framework GDPR (Regulation (EU) 2016/679) as implemented by the Data Protection Act 2018 Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Green Comprehensive, fully in-force omnibus framework with an active, well-resourced regulator and clear statutory authority. #### Sub-modules (5) #### Regulator And AuthorityGreen The DPC is Ireland's independent supervisory authority for GDPR, statutorily established under Section 10 of the Data Protection Act 2018. Claims (5): - The Data Protection Commission (DPC), established under Section 10 of the Data Protection Act 2018, is Ireland's supervisory authority responsible for the purposes of the GDPR. - Data Protection Commission is: Ireland's single national independent supervisory authority under the GDPR and Data Protection Act 2018, acting as Lead Supervisory Authority for numerous multinational technology companies under the one-stop-shop mechanism. - Data Protection Commission — Ireland's national independent authority responsible for upholding the GDPR, also functioning under the ePrivacy Regulations 2011 and the Law Enforcement Directive - Data Protection Commission — Ireland's national supervisory authority under GDPR; lead supervisory authority under the one-stop-shop mechanism for numerous multinational tech companies with EU establishment in Ireland - Data Protection Commission — DPC's own-volition inquiry role as Google's Lead Supervisory Authority under the GDPR one-stop-shop mechanism, exercised in the 21 September 2026 EUR 403m decision. #### Act And InstrumentsGreen The Data Protection Act 2018 gives further effect to the GDPR and repealed the 1988/2003 Acts (save national-security/defence/international-relations processing carve-outs). Claims (4): - The Data Protection Act 2018 gives further effect to the GDPR and, having commenced on 25 May 2018, repealed the Data Protection Acts of 1988 and 2003 except for provisions relating to processing for national security, defence, and international relations of the State. - Data Protection Act 2018 — GDPR in Ireland, including national derogations such as the digital age of consent - Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) — Signed into law 21 July 2026, establishing the AI Office of Ireland as an independent statutory body and Ireland's central coordinating authority for EU AI Act implementation; operational from approximately 1-2 August 2026, aligning with the AI Act's 2 August 2026 general application date. - Data Protection Commission — GDPR (Regulation (EU) 2016/679) directly applicable in Ireland since 25 May 2018, supervised by the DPC. #### Material ScopeGreen The GDPR's dual objective -- protecting the fundamental right to data protection while enabling free data flow -- defines material scope of application in Ireland. Claims (1): - The GDPR pursues a two-fold objective in Ireland's material scope: protecting the fundamental rights of natural persons regarding personal data, and allowing the free flow of personal data and digital-economy development. #### Territorial ScopeGreen Article 3(2) GDPR extends the Irish/EU regime extraterritorially to non-EU-established controllers targeting or monitoring EU data subjects. Claims (1): - GDPR Article 3(2) extends application to controllers/processors not established in the Union where processing relates to offering goods or services to, or monitoring, data subjects in the Union, thereby extending Irish/EU jurisdiction extraterritorially. #### Regulator Registration And FilingAmber Ireland imposes no general controller-registration requirement post-GDPR; the principal filing obligation is DPO-contact-detail publication/communication to the DPC under Article 37 GDPR. Claims (1): - Data controllers and processors are required to publish their DPO's contact details and communicate them to the DPC (and other relevant supervisory authorities), in lieu of a general controller-registration filing regime post-GDPR. Ireland's data protection regime is the EU's GDPR (Regulation (EU) 2016/679) as given further effect domestically by the Data Protection Act 2018, which commenced 25 May 2018 and established the Data Protection Commission (DPC) under Section 10 as the national supervisory authority. Ireland's status as host jurisdiction for the EU/EEA establishments of many major technology platforms makes the DPC a frequent lead supervisory authority under the GDPR's one-stop-shop mechanism. Periodic update · new data 2026-10-18 #### Regulator & Framework The Data Protection Commission's role as Ireland's supervisory authority was exercised at scale this period through its own-volition inquiry role as Google's Lead Supervisory Authority under the GDPR one-stop-shop mechanism, exercised in the decision of 21 September 2026 that fined Google Ireland Limited EUR 403,000,000 for infringing GDPR Arts 5, 6, 12 and 13 in its processing of location data. The decision imposed both the fine and a six-month compliance order, and stands as the clearest demonstration this period of the lead-authority function in practice. Separately, Ireland's institutional architecture for AI governance has been placed on statutory footing. The Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) was signed into law on 21 July 2026, establishing the AI Office of Ireland as an independent statutory body and the state's central coordinating authority for implementation of the EU AI Act. The Office became operational from approximately 1 to 2 August 2026, aligning with the AI Act's own general application date of 2 August 2026. This places a dedicated statutory coordinating body alongside the DPC within Ireland's wider data and technology regulatory architecture. #### Outlook With the AI Office of Ireland now on a statutory footing and operational, and the DPC continuing to exercise its lead-authority role at substantial scale, the coming period is one in which the relationship and division of labour between these two authorities, and between the AI Office and the sectoral market-surveillance authorities it coordinates, is likely to come into sharper focus. Sources and claims (12) - [European Data Protection Board](https://www.edpb.europa.eu/sites/default/files/ie_sa_gdpr_art_97questionnaire.pdf) — The Data Protection Commission (DPC), established under Section 10 of the Data Protection Act 2018, is Ireland's supervisory authority responsible for the purposes of the GDPR. - [DataGuidance / OneTrust](https://legacy.dataguidance.com/jurisdiction/ireland) — The Data Protection Act 2018 gives further effect to the GDPR and, having commenced on 25 May 2018, repealed the Data Protection Acts of 1988 and 2003 except for provisions relating to processing for national security, defence, and international relations of the State. - [European Data Protection Board](https://www.edpb.europa.eu/sites/default/files/ie_sa_gdpr_art_97questionnaire.pdf) — The GDPR pursues a two-fold objective in Ireland's material scope: protecting the fundamental rights of natural persons regarding personal data, and allowing the free flow of personal data and digital-economy development. - [European Data Protection Board](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf) — GDPR Article 3(2) extends application to controllers/processors not established in the Union where processing relates to offering goods or services to, or monitoring, data subjects in the Union, thereby extending Irish/EU jurisdiction extraterritorially. - [DataGuidance / OneTrust](https://legacy.dataguidance.com/jurisdiction/ireland) — Data controllers and processors are required to publish their DPO's contact details and communicate them to the DPC (and other relevant supervisory authorities), in lieu of a general controller-registration filing regime post-GDPR. - [Data Protection Commission](https://www.dataprotection.ie/en) — Data Protection Commission is: Ireland's single national independent supervisory authority under the GDPR and Data Protection Act 2018, acting as Lead Supervisory Authority for numerous multinational technology companies under the one-stop-shop mechanism. - [https://www.dataprotection.ie/en](https://www.dataprotection.ie/en) — Data Protection Commission — Ireland's national independent authority responsible for upholding the GDPR, also functioning under the ePrivacy Regulations 2011 and the Law Enforcement Directive - [The Irish Times](https://www.irishtimes.com/business/2026/09/21/irish-data-protection-watchdog-fines-google-403m-over-gdpr-breaches/) — Data Protection Act 2018 — GDPR in Ireland, including national derogations such as the digital age of consent - [Data Protection Commission](https://www.dataprotection.ie/en) — Data Protection Commission — Ireland's national supervisory authority under GDPR; lead supervisory authority under the one-stop-shop mechanism for numerous multinational tech companies with EU establishment in Ireland - [Data Protection Commission](https://www.dataprotection.ie/en/news-media/latest-news/data-protection-commission-fines-google-eu403-million-following-inquiry-googles-processing-location) — Data Protection Commission — DPC's own-volition inquiry role as Google's Lead Supervisory Authority under the GDPR one-stop-shop mechanism, exercised in the 21 September 2026 EUR 403m decision. - [Matheson](https://www.matheson.com/insights/irish-artificial-intelligence-act-2026-signed-into-law/) — Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) — Signed into law 21 July 2026, establishing the AI Office of Ireland as an independent statutory body and Ireland's central coordinating authority for EU AI Act implementation; operational from approximately 1-2 August 2026, aligning with the AI Act's 2 August 2026 general application date. - Primary statutory record — Data Protection Commission — GDPR (Regulation (EU) 2016/679) directly applicable in Ireland since 25 May 2018, supervised by the DPC. ### Ireland: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core lawful-basis and special-category rules are fully in force and well documented; the pseudonymisation/anonymisation sub-module lacks a directly retrieved DPC-specific source in this run. Primary framework GDPR Articles 6-9 as supplemented by the Data Protection Act 2018 Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Green Core lawful-basis and special-category rules are fully in force and well documented; the pseudonymisation/anonymisation sub-module lacks a directly retrieved DPC-specific source in this run. Periodic update · new data 2026-10-04 #### Lawful Processing & Special Data The Data Protection Commission's final decision of 21 September 2026 found that Google Ireland Limited infringed the GDPR in its processing of users' location data through the Web & App Activity, Location History and Location Accuracy features. The decision relied on several provisions of the GDPR, including Article 5, Article 6, Article 12 and Article 13, addressing the lawfulness and fairness of the processing, the lawful basis relied upon, and the transparency obligations owed to data subjects, for the period from 25 May 2018 to 4 February 2020. The Commission's own full published decision text, including its complete legal reasoning, was not independently retrieved this cycle; the Article references above are sourced from secondary legal commentary summarising the decision rather than from the Commission's own text directly. The Commission's finding that Google infringed the GDPR by processing location data unlawfully and unfairly is a significant application of the Article 5 fairness and lawfulness principles and the Article 6 lawful-basis requirement to a major technology company's default data-collection features, rather than to a discrete, opt-in processing activity. The involvement of Article 12 and Article 13 findings additionally points to transparency deficiencies in how the relevant location-data features were presented to users during the covered period. #### Outlook The underlying lawful-processing findings remain subject to the fine's own confirmation process: the fine requires confirmation by the Irish High Court, and an appeal from Google is considered likely. Until that process concludes, the Article 5, 6, 12 and 13 findings described above stand as the Commission's own determination but are not yet settled as a final matter of Irish law. The six-month corrective compliance order, with compliance due 21 March 2027, creates a separate, more immediate timeline for Google to adjust the underlying processing practices regardless of how the confirmation and appeal process proceeds. Periodic update · new data 2026-09-28 #### Lawful Processing & Special Data The DPC's 21 September 2026 decision against Google Ireland Limited found infringements of GDPR Articles 5, 6, 12 and 13 in respect of the lawfulness, fairness and transparency of location-data processing carried out through Web & App Activity, Location History and Location Accuracy features. Article 5 sets out the core processing principles, Article 6 the lawful bases for processing, and Articles 12 and 13 the transparency obligations owed to data subjects at the point personal data is collected. The DPC's finding that these provisions were infringed concerns whether Google gave users an adequate legal basis and adequate transparency for processing their location data through these specific product features. The inquiry that produced this finding was opened in February 2020 and ran for approximately six and a half years before conclusion in September 2026, reflecting the scale and complexity of establishing infringement across multiple interlinked product features. This finding sits within Ireland's broader enforcement context this cycle: the DPC's decision explicitly targets the lawful-basis and transparency dimensions of location processing, rather than, for example, a security or retention failure. The EUR403 million fine and accompanying six-month compliance order reflect a finding of substantive infringement on the lawfulness and transparency principles specifically. #### Outlook Whether Google intends to appeal the 21 September 2026 decision is understood from press reporting but has not been confirmed against a DPC or court filing this cycle. Any appeal would test the DPC's Article 5/6/12/13 findings on location-data lawfulness and transparency before the courts, and would be the clearest next signal for how durable this finding proves to be. D2 · Lawful Processing — Full Module Record 4 sub-modules · 48 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ireland: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Access/erasure/rectification and deadline mechanisms are well evidenced; restriction, objection and portability sub-modules rely on the general GDPR baseline without a directly retrieved DPC-specific source. Primary framework GDPR Articles 12-22 as administered by the Data Protection Act 2018 Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Access/erasure/rectification and deadline mechanisms are well evidenced; restriction, objection and portability sub-modules rely on the general GDPR baseline without a directly retrieved DPC-specific source. #### Sub-modules (5) #### Access RightGreen DPC 2024 case studies specifically address subject access request handling as a recurring compliance issue. Claims (2): - The DPC's 2024 case-study report addresses recurring issues in handling subject access requests, alongside deletion and rectification requests. - Meta Platforms Ireland Limited — Articles 12, 15 and 20 GDPR concerning handling of data access requests; fines proposed in the region of EUR 360-430 million; High Court upheld the DPC's power to impose such fines in a May 2026 judgment, though the final fine amount remains undetermined #### Rectification And ErasureGreen The same DPC case-study reporting addresses rectification and erasure ('right to be forgotten') requests. Claims (1): - DPC case studies published alongside the 2024 Annual Report specifically address rectification and erasure ('right to be forgotten') requests as a recurring compliance theme. #### Restriction And ObjectionRed No DPC-specific source on restriction (Art 18) or objection (Art 21) practice was retrieved in this pass; the general GDPR baseline applies. #### Data PortabilityRed No DPC-specific portability (Art 20) guidance or enforcement was retrieved in this pass; the general GDPR baseline applies. #### Deadlines And Response WindowsGreen Section 109 DPA 2018 empowers the DPC to facilitate amicable complaint resolution within a reasonable time, offering data subjects a faster route to remedy than full statutory inquiry. Claims (1): - Under Section 109 of the Data Protection Act 2018, the DPC takes steps to arrange or facilitate amicable resolution of complaints where there is a reasonable likelihood of the parties reaching resolution within a reasonable time, offering data subjects a comparatively fast route to vindication of rights. GDPR Articles 13-22 provide the framework for access, rectification, erasure, restriction, objection and portability rights, enforced in Ireland by the DPC. The DPC's 2024 case-study reporting highlights access, deletion and rectification requests as recurring themes, and Section 109 of the Data Protection Act 2018 provides an amicable-resolution route with a comparatively fast response window. Direct DPC-specific sourcing on restriction/objection and portability was not retrieved in this pass. Periodic update · new data 2026-09-14 #### Data Subject Rights The Data Protection Commission's draft decision found that Meta Platforms Ireland Limited infringed Articles 12, 15 and 20 GDPR in connection with the handling of data access requests. Fines in the region of EUR 360-430 million are proposed, and the High Court upheld the DPC's power to impose such a fine in a May 2026 judgment, though the final fine amount remains undetermined pending the DPC's own decision — this is a probable-confidence finding, and the matter is understood to still be subject to contestation by way of judicial review. The infringement findings concern how the company handled subject access requests and data portability requests, going to the core data-subject-rights framework under GDPR Articles 12 (transparent information), 15 (right of access) and 20 (right to data portability). This is one of the two largest live GDPR enforcement matters affecting Ireland this cycle, and its scale — a proposed fine in the hundreds of millions of euro — places it alongside the TikTok cross-border transfer matter as evidence of the DPC's continuing willingness to pursue high-value enforcement against major technology platforms headquartered in its jurisdiction. #### Outlook The fine quantum remains the central open question: the DPC's own final determination, once issued, will resolve whether the figure lands within the proposed EUR 360-430 million range or is adjusted following further process. Judicial review avenues remain available to Meta and may extend the timeline before the matter is fully resolved. Sources and claims (4) - [IAPP](https://iapp.org/news/a/key-takeaways-from-ireland-s-dpc-annual-report) — The DPC's 2024 case-study report addresses recurring issues in handling subject access requests, alongside deletion and rectification requests. - [IAPP](https://iapp.org/news/a/key-takeaways-from-ireland-s-dpc-annual-report) — DPC case studies published alongside the 2024 Annual Report specifically address rectification and erasure ('right to be forgotten') requests as a recurring compliance theme. - [European Data Protection Board](https://www.edpb.europa.eu/sites/default/files/ie_sa_gdpr_art_97questionnaire.pdf) — Under Section 109 of the Data Protection Act 2018, the DPC takes steps to arrange or facilitate amicable resolution of complaints where there is a reasonable likelihood of the parties reaching resolution within a reasonable time, offering data subjects a comparatively fast route to vindication of rights. - [https://www.linklaters.com/en/insights/data-protected/data-protected---ireland](https://www.linklaters.com/en/insights/data-protected/data-protected---ireland) — Meta Platforms Ireland Limited — Articles 12, 15 and 20 GDPR concerning handling of data access requests; fines proposed in the region of EUR 360-430 million; High Court upheld the DPC's power to impose such fines in a May 2026 judgment, though the final fine amount remains undetermined ### Ireland: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ DPO, accountability/DPIA, security and breach-notification sub-modules are strongly evidenced by enforcement activity; ROPA, joint-controller and retention sub-modules rely on the unevidenced general GDPR baseline. Primary framework GDPR Articles 5, 24-39 as administered by the Data Protection Act 2018 Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber DPO, accountability/DPIA, security and breach-notification sub-modules are strongly evidenced by enforcement activity; ROPA, joint-controller and retention sub-modules rely on the unevidenced general GDPR baseline. Periodic update · new data 2026-10-12 #### Controller/Processor Duties The Data Protection Commission published a final decision, dated 1 October 2026, following an inquiry into Children's Health Ireland concerning Tallaght University Hospital. The decision found infringements of the security-of-processing principle set out at Article 5(1)(f) and of the security-of-processing obligation set out at Article 32(1). As a remediation measure, the Commission ordered completion of data protection impact assessments covering two specific processing activities: healthcare-record processing and confidential-waste management. This is a tightening development for controller and processor accountability in Ireland. The decision concerns a public healthcare body's handling of sensitive health data, a category that attracts heightened scrutiny under the security-of-processing principle given the particular risk of harm from unauthorised access or disclosure. The confidential-waste management element of the order is notable in extending accountability obligations beyond active digital processing systems into the physical disposal of records, confirming that the Commission reads the security-of-processing obligation as covering the full lifecycle of personal-data handling, including destruction. The ordering of a data protection impact assessment as a remedial measure, rather than solely a financial penalty, reflects the Commission's accountability-first approach for this decision: rather than closing the matter with a sanction alone, the Commission has required the controller to undertake a forward-looking structured risk assessment covering the specific processing activities found deficient. This places an ongoing documentation and process obligation on Children's Health Ireland that will need to be discharged and is, in principle, capable of independent verification. #### Outlook The practical question for subsequent cycles is whether and when Children's Health Ireland completes the ordered data protection impact assessments on healthcare-record processing and confidential-waste management, and whether the Commission takes any further supervisory step in relation to compliance with that order. No further controller/processor-duties development beyond this decision was identified this cycle, so the near-term signal in this module is defined by completion of this specific remediation order rather than by any additional or forecast development. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Alongside the lawfulness and transparency findings, the DPC's 21 September 2026 decision against Google Ireland Limited found a distinct accountability-obligation infringement: a failure to demonstrate compliance with the lawfulness, fairness and transparency principle specifically in respect of Location Accuracy processing. This is an accountability finding under the GDPR's Article 5(2) accountability principle and related controller-obligation provisions, and it is analytically distinct from the substantive lawfulness findings addressed under lawful processing — this finding concerns Google's ability to demonstrate its compliance, not solely whether the underlying processing was lawful. The accountability infringement was found specifically in relation to the Location Accuracy feature, narrower in scope than the lawfulness findings which spanned Web & App Activity, Location History and Location Accuracy together. This distinction indicates the DPC's inquiry examined each product feature separately for both substantive lawfulness and accountability compliance, rather than reaching a single undifferentiated finding across the product suite. #### Outlook The accountability finding, being narrower and feature-specific, may be a discrete point of appeal or compliance-order focus separate from the broader lawfulness findings; whether the six-month compliance order the DPC imposed addresses the accountability gap specifically for Location Accuracy will be a marker of how the corrective order is structured. Periodic update · new data 2026-09-14 #### Controller/Processor Duties Two active DPC matters this cycle bear directly on controller and processor security and breach-notification duties. First, the DPC adopted a final decision on 10 June 2026 following an inquiry into a ransomware attack on the laboratory information system at a Midlands Regional Hospital, citing infringements of Articles 5 (principles relating to processing), 28 (processor obligations), 30 (records of processing), 32 (security of processing) and 34 (communication of a personal data breach to the data subject) GDPR. This is a probable-confidence finding sourced from the DPC's own decisions register, and the breadth of articles cited — spanning core principles, processor governance, documentation, technical security, and breach communication — indicates a systemic security-failure finding rather than a narrow technical lapse. Second, the DPC has commenced an inquiry following Permanent TSB's notification of a series of three data breaches relating to its Open 24 Contact Centre. This inquiry is understood to be ongoing, with no outcome yet determined this cycle; it is recorded here as an active development rather than a concluded enforcement matter. #### Outlook The Midlands Regional Hospital decision, now final, may generate follow-on guidance or precedent value for health-sector processors facing similar ransomware exposure. The Permanent TSB inquiry remains the item to watch: its outcome will indicate how the DPC treats a financial-sector processor facing a pattern of repeated breaches at a single contact-centre operation, rather than an isolated incident. D4 · Controller & Processor — Full Module Record 7 sub-modules · 44 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ireland: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer-mechanism enforcement (TikTok, Meta) and adequacy-received status are strongly evidenced; adequacy-granted and data-localisation sub-modules are EU-level/absent for this JID. Primary framework GDPR Chapter V (Articles 44-49) as administered by the DPC Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Transfer-mechanism enforcement (TikTok, Meta) and adequacy-received status are strongly evidenced; adequacy-granted and data-localisation sub-modules are EU-level/absent for this JID. Periodic update · new data 2026-09-14 #### Cross-Border & Adequacy The DPC's most consequential cross-border enforcement action this cycle is the High Court's upholding, on 30 June 2026, of a EUR 530 million administrative fine against TikTok. The DPC found infringements of Articles 46(1) (transfers subject to appropriate safeguards) and 13(1)(f) GDPR (information to be provided on transfers to third countries) concerning EEA user data being made accessible from China. This is described as the first such data-transfer fine issued by an EU Member State specifically concerning access arrangements involving China, and is a confirmed-tier finding carrying the highest materiality rating in this cycle's evidence set. A related DPC appeal was dismissed by the Supreme Court on 30 April 2026, removing one procedural obstacle to the fine's enforcement, though the ultimate outcome of TikTok's own response to the upheld fine and any associated suspension order remains pending. Separately, on the standing transfer-mechanism-administration side, the DPC maintains an updated (January 2026) published list of approved Binding Corporate Rules for which it acts as lead supervisory authority — a lower-materiality, probable-confidence administrative fact reflecting Ireland's continuing role as lead supervisory authority for a substantial cohort of multinational BCR arrangements given the concentration of tech-sector EU headquarters in the jurisdiction. #### Outlook The TikTok matter's next milestone is the outcome of TikTok's appeal against the fine and any associated data-transfer suspension order, which remains pending. Given the DPC's demonstrated willingness to pursue and defend China-linked transfer enforcement through to High Court and Supreme Court levels, this matter is likely to remain the DPC's highest-profile cross-border case for the remainder of 2026. Periodic update · new data 2026-09-05 #### Cross-Border & Adequacy The DPC's €530 million fine against TikTok in 2025, over the transfer of EEA user data to China, is this cycle's clearest cross-border-transfer signal. The finding is confirmed with reasonable corroboration, though TikTok is appealing the decision and no primary DPC decision text was independently retrieved this cycle. The fine sits within an established DPC enforcement pattern requiring documented Transfer Impact Assessments for every cross-border transfer mechanism relied upon by controllers and processors under DPC jurisdiction: Standard Contractual Clauses alone are treated as insufficient without a documented analysis of the receiving country's legal framework, mirroring the reasoning previously applied in the Schrems II line of cases and the earlier Meta transfer fine. For controllers relying on SCCs for transfers into jurisdictions without an adequacy decision, the TikTok fine functions as a fresh, high-value illustration of the DPC's willingness to enforce this standard even against a major global platform. #### Outlook The TikTok appeal outcome is the marker to watch: if it narrows or overturns the underlying transfer-adequacy reasoning, that would be a material development for how the DPC's Transfer Impact Assessment expectations are applied going forward; if it is dismissed or the fine substantially upheld, it reinforces the current strict-scrutiny posture for transfers to jurisdictions like China. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 65 words · 17 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ireland: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Telecoms/ePrivacy, education and insurance overlays are evidenced; financial-sector and credit-scoring sub-modules lack substantive DPC-specific sourcing in this run. Primary framework GDPR + sector overlays: S.I. No. 336/2011 (ePrivacy); Data Protection Act 2018 (insurance-related health-data ground) Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Telecoms/ePrivacy, education and insurance overlays are evidenced; financial-sector and credit-scoring sub-modules lack substantive DPC-specific sourcing in this run. Periodic update · new data 2026-09-14 #### Sectoral Watch Two sectoral matters intersect with the DPC's broader enforcement activity this cycle. In the financial sector, the DPC has commenced an inquiry into Permanent TSB following the bank's notification of a series of three data breaches relating to its Open 24 Contact Centre — a probable-confidence, ongoing matter with no outcome yet determined. In the health sector, the DPC concluded, on 10 June 2026, a final decision following an inquiry into a ransomware attack on the laboratory information system at a Midlands Regional Hospital, citing infringements across Articles 5, 28, 30, 32 and 34 GDPR. Taken together, these two matters show the DPC's sectoral enforcement reach extending into both financial-services contact-centre operations and health-sector laboratory information systems within the same cycle, indicating that sectoral breach exposure is not confined to any single industry vertical in Ireland's current enforcement environment. Both matters derive from the DPC's own decisions and guidance register, a Tier-1 primary source. #### Outlook The Permanent TSB inquiry is the sectoral matter with the least settled outcome and is the one most likely to generate a further material development in coming cycles, given it remains an open inquiry rather than a concluded decision. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 56 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ireland: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookies, direct marketing and cross-context (behavioural) advertising are well evidenced through enforcement; dark patterns, opt-out signals and clean rooms lack retrieved sourcing. Primary framework S.I. No. 336/2011 (ePrivacy) + GDPR Article 6 (legal basis for advertising/profiling) Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Cookies, direct marketing and cross-context (behavioural) advertising are well evidenced through enforcement; dark patterns, opt-out signals and clean rooms lack retrieved sourcing. Periodic update · new data 2026-10-12 #### AdTech & Commercial Privacy The Data Protection Commission's decision against Google Ireland Limited, dated 21 September 2026, is the dominant development in this module this cycle. The Commission imposed a fine of EUR403 million following an inquiry into Google's processing of location data, finding infringements of GDPR Articles 5, 6, 12 and 13 in relation to processing carried out between 25 May 2018 and 4 February 2020. Google has been ordered into compliance within six months of the decision, a deadline falling on 21 March 2027. This decision, confirmed directly from the Commission's own published materials, materially tightens the standard the Commission applies to consent validity and transparency obligations for location-data processing in an advertising-adjacent commercial context, touching Articles governing lawfulness of processing, transparency and the information that must be provided to data subjects. Separately, the Commission secured a criminal conviction against Brown Thomas Arnotts Limited on 7 September 2026, when the retailer pleaded guilty to five of twenty-one charges brought under Regulation 13 of the ePrivacy Regulations, S.I. No. 336/2011, for sending unlawful direct-marketing emails. The court applied the Probation of Offenders Act and ordered a EUR1,000 charitable donation together with EUR1,000 in costs. Regulation 13 requires a sender of direct-marketing electronic communications to hold the recipient's prior consent and to provide a valid means of opting out of further messages; the conviction confirms the Commission's continuing willingness to pursue criminal prosecution, rather than relying solely on administrative sanction, where direct-marketing consent and opt-out obligations are breached. Taken together, the two outcomes show the Commission exercising its full available toolkit in the adtech and commercial-privacy space within a single enforcement window: a very large administrative fine for a multinational platform's location-data practices, and a criminal prosecution, albeit resulting in a modest financial penalty, against a domestic retailer's direct-marketing practices. Both outcomes confirm active supervisory attention to consent mechanics, whether for behavioural/location-based advertising infrastructure or for direct electronic marketing communications. #### Outlook Google's compliance deadline of 21 March 2027 is the principal date to track for this module; whether the required changes to location-data processing practices are confirmed as implemented by that date will depend on subsequent Commission statements. The Brown Thomas Arnotts conviction, notwithstanding its modest penalty, signals that other operators conducting direct-marketing email campaigns in Ireland should expect that criminal prosecution under the ePrivacy Regulations remains an active and used enforcement route, not a merely theoretical one, for consent and opt-out breaches. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 41 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ireland: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Profiling restrictions and state-surveillance carve-outs are evidenced; ADM transparency, biometric regime and genetic data sub-modules lack directly retrieved DPC-specific sourcing. Primary framework GDPR Article 22 + EU AI Act (Regulation (EU) 2024/1689) Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Profiling restrictions and state-surveillance carve-outs are evidenced; ADM transparency, biometric regime and genetic data sub-modules lack directly retrieved DPC-specific sourcing. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The Regulation of Artificial Intelligence Act 2026 establishes the AI Office of Ireland as the central coordinating authority for EU AI Act implementation, operating under a distributed model in which sectoral regulators act as market-surveillance authorities for their respective domains. The Act was signed into law on 21 July 2026, and the Office became operational from approximately 1 to 2 August 2026, timed to align with the AI Act's own general application date of 2 August 2026. The distributed model means that algorithmic and AI-system oversight in Ireland is not concentrated in a single body but is instead coordinated centrally while enforcement responsibility sits with the sectoral regulator already responsible for the relevant domain. This is a structural choice about how AI oversight is organised in Ireland, distinct from the question of which substantive AI Act obligations apply and when. #### Outlook The distributed model's practical operation, specifically how the AI Office of Ireland coordinates with sectoral market-surveillance authorities on overlapping cases, is the detail most likely to clarify as the Office moves from establishment into operation. Periodic update · new data 2026-09-05 #### Algorithmic, Biometric & Surveillance Governance Many provisions of the EU AI Act become applicable from August 2026, with some high-risk AI requirements following on later transition dates. This is confirmed as a material EU-level development arriving within this cycle's window, converging with existing GDPR transparency and automated-decision-making obligations for controllers using AI systems in Ireland. No Irish-specific DPC enforcement action was identified alongside this development this cycle, and it is not yet confirmed whether the DPC has issued Ireland-specific coordination guidance for the August 2026 applicability date — that remains an evidentiary gap rather than an asserted absence. #### Outlook Watch for DPC guidance specifically addressing the AI Act/GDPR interface as the August 2026 applicability date approaches, and for the first enforcement actions or investigations that treat AI Act compliance and GDPR automated-decision-making obligations as a combined compliance question rather than two separate regimes. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 47 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ireland: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Age-of-consent and education-setting guidance are strongly evidenced; minor-profiling-ban and dependent-adult sub-modules lack directly retrieved DPC-specific sourcing. Primary framework GDPR Article 8 as implemented by the Data Protection Act 2018 Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Amber Age-of-consent and education-setting guidance are strongly evidenced; minor-profiling-ban and dependent-adult sub-modules lack directly retrieved DPC-specific sourcing. Periodic update · new data 2026-10-18 #### Children & Vulnerable Groups Coimisiun na Mean's Online Safety Code imposes specific obligations directed at protecting children online. Section 12.10 requires effective age assurance, stating explicitly that self-declaration alone is not considered effective. Section 14 requires parental controls to be made available where a service permits use by under-16s. Section 17.2 bans the commercial reuse of data collected for age-assurance purposes. Part A of the Code has applied from 19 November 2024, and Part B from 21 July 2025. On 8 September 2026, Coimisiun na Mean opened its first formal investigation under the Online Safety Code, into the platform X. This is the first occasion on which the Commission has used its investigatory powers under the Code since those provisions took effect, and it marks the transition of the children's-safety framework from a set of standing obligations into one with an active enforcement record. #### Outlook As the first formal Code investigation, the outcome of the inquiry into X is likely to be read as an indication of how the Commission intends to apply the age-assurance and parental-control provisions in practice, and of what evidentiary standard it will require platforms to meet to demonstrate effective age assurance. D9 · Children's Privacy — Full Module Record 5 sub-modules · 52 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Ireland: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Enforcement powers, penalty scale, and recent developments are extensively evidenced through primary regulator decisions and secondary reporting. Primary framework Data Protection Act 2018, Part 6 (Sections 109-141) + GDPR Articles 77-84 Supervisory authority [Data Protection Commission (DPC)](https://www.dataprotection.ie/) Traffic-light rationale — Green Enforcement powers, penalty scale, and recent developments are extensively evidenced through primary regulator decisions and secondary reporting. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Data Protection Commission's final decision of 21 September 2026 fined Google Ireland Limited EUR 403,000,000 for infringing GDPR Articles 5, 6, 12 and 13 in its processing of location data between 25 May 2018 and 4 February 2020, with the decision also imposing a six-month compliance order. Within the same period, the DPC concluded two further substantive matters in the health sector. Its decision on the Health Service Executive, dated 2 September 2026, fined the HSE EUR 645,000 in total over paper-record storage failures found to breach Article 5(1)(f) and Article 32(1), together with a separate Article 5(1)(e) finding. A subsequent decision concerning Children's Health Ireland, dated 1 October 2026, required completion of data protection impact assessments following security findings at Tallaght University Hospital. Against this run of enforcement outcomes sits an active procedural challenge to the Commission's own adjudicative process. The Irish Supreme Court, on 13 October 2026, granted the DPC permission to appeal preliminary constitutional-process issues arising from LinkedIn's challenge to the DPC's EUR 310m fine, with LinkedIn also seeking a cross-appeal. That challenge goes to how the DPC's own decision-making procedure is constituted, rather than to the substance of the LinkedIn fine itself, and its resolution is still pending. #### Outlook The concurrence of a high-value Google decision, two health-sector decisions, and a live Supreme Court appeal concerning the DPC's own adjudicative process makes the coming period one in which both the substance of Irish enforcement and the procedural legitimacy of how that enforcement is reached are under active examination at the same time. Periodic update · new data 2026-10-12 #### Enforcement & Redress Three material enforcement outcomes fall within this cycle's window, together describing an active enforcement posture by the Data Protection Commission. The largest is the EUR403 million fine against Google Ireland Limited, dated 21 September 2026, following an inquiry into location-data processing that found infringements of GDPR Articles 5, 6, 12 and 13 for processing carried out between 25 May 2018 and 4 February 2020, with compliance ordered within six months, by 21 March 2027. The second is the Commission's final decision, dated 1 October 2026, against Children's Health Ireland concerning Tallaght University Hospital, finding infringements of Articles 5(1)(f) and 32(1) and ordering completion of data protection impact assessments on healthcare-record processing and confidential-waste management. The third is the criminal conviction, dated 7 September 2026, of Brown Thomas Arnotts Limited on five of twenty-one charges under Regulation 13 of the ePrivacy Regulations, resulting in a EUR1,000 charitable donation and EUR1,000 in costs under the Probation of Offenders Act. The range of these three outcomes, from a nine-figure administrative fine against a multinational platform to a criminal prosecution carrying a four-figure financial consequence against a domestic retailer, illustrates the breadth of the Commission's enforcement toolkit operating concurrently within a single window. The Google and Children's Health Ireland decisions proceed through the Commission's own administrative inquiry and decision process, while the Brown Thomas Arnotts matter proceeded through the criminal courts, confirming that both routes remain live and actively used by the Commission depending on the nature of the underlying infringement. Each decision also carries its own redress or remediation dimension distinct from the headline penalty: Google faces a defined six-month compliance deadline for its processing practices; Children's Health Ireland has been ordered to complete specific data protection impact assessments; and the Brown Thomas Arnotts prosecution, while resulting in a modest financial penalty under the Probation of Offenders Act, establishes a criminal-law precedent for direct-marketing consent breaches rather than concluding with a civil remedy alone. #### Outlook The compliance and remediation deadlines attached to the Google and Children's Health Ireland decisions, 21 March 2027 and the data protection impact assessment completion respectively, are the concrete dates and milestones to track in forthcoming cycles. The Commission's concurrent use of administrative fines, administrative compliance orders and criminal prosecution within this single enforcement window confirms that its enforcement and redress function in Ireland currently spans the full range of available mechanisms, a posture that is likely, on current evidence, to continue rather than to be an isolated feature of this cycle alone. Periodic update · new data 2026-10-04 #### Enforcement & Redress The Data Protection Commission imposed a EUR 403 million administrative fine on Google Ireland Limited on 21 September 2026, closing a six-year inquiry into the company's location-data processing practices and marking the Commission's first enforcement action against Google specifically. The decision carries a six-month corrective compliance order, with compliance due by 21 March 2027, and the fine itself requires confirmation by the Irish High Court before it becomes final; an appeal from Google is considered likely given the scale of the fine and the novelty of its application to this company. This decision should be read against the Commission's standing position as Ireland's sole national independent supervisory authority under the GDPR and the Data Protection Act 2018, and its role as Lead Supervisory Authority for numerous multinational technology companies under the one-stop-shop mechanism. A January 2026 press report placed the Commission's cumulative GDPR fines since May 2018 at approximately EUR 4.04 billion, with eight of the ten largest GDPR fines ever issued attributed to the Commission; that aggregate figure pre-dates the Google fine and was not re-verified against the Commission's own statistics this cycle, so it should be read as held context rather than an updated total. The scale of the Google fine, among the largest GDPR fines issued to date, and its position as the Commission's first action against Google specifically, both reinforce the structural picture of the Commission as the principal enforcement venue for GDPR questions affecting major technology companies within its one-stop-shop remit. The six-year span between the start of the infringement period and the final decision illustrates the structural length of complex, cross-border GDPR inquiries against companies of this scale. #### Outlook Two distinct and separately dated processes now run in parallel. The confirmation and likely appeal process, whose timeline is not yet fixed, determines whether the EUR 403 million figure and the underlying findings stand as a final matter of Irish law. Separately, and regardless of how that process proceeds, the six-month corrective compliance order sets 21 March 2027 as the date by which Google must bring its location-data processing practices into line with the Commission's findings. The Commission's cumulative fine total, last reported at approximately EUR 4.04 billion in January 2026, will rise once this fine is incorporated into a future tally, though that updated aggregate was not itself calculated this cycle. Periodic update · new data 2026-09-28 #### Enforcement & Redress September 2026 produced two material DPC fines within a single month, a pace of enforcement activity that stands out against the regime's usual cadence. On 2 September 2026, the DPC fined the Health Service Executive EUR645,000 following an inquiry into personal data contained in paper records stored externally across twelve HSE facilities, with the order combining the financial penalty with a reprimand and corrective orders. Nineteen days later, on 21 September 2026, the DPC fined Google Ireland Limited EUR403 million following a six-year inquiry into location-data processing, with a six-month compliance order attached. The two decisions differ sharply in scale and subject matter — a domestic public health body's paper-records handling on one hand, and a multinational technology company's digital location-data processing architecture on the other — but their proximity in time is itself the material signal: it indicates the DPC's current enforcement output is not concentrated in any single sector or case type, and that multiple substantial inquiries were reaching conclusion within the same reporting window. The Google fine, in particular, followed an inquiry opened in February 2020, meaning its September 2026 conclusion reflects the closing of a multi-year investigation rather than a newly-initiated action. #### Outlook Whether Google intends to appeal the 21 September 2026 decision is understood from press reporting but has not been confirmed against a DPC or court filing this cycle; an appeal would be the clearest next-step development in that specific matter. More broadly, whether this cluster of two fines within a month represents a genuine step-change in DPC enforcement tempo, or the coincidental conclusion of two independently-timed inquiries, is a distinction that a further enforcement action within the next reporting period would help resolve. Periodic update · new data 2026-09-14 #### Enforcement & Redress Ireland's enforcement scale, viewed in aggregate, is the dominant fact of this cycle's data-protection picture. The DPC has issued EUR 4.04 billion in GDPR fines since May 2018 — a confirmed-tier finding — almost four times more than second-placed France, and including the largest single European GDPR fine of 2025, the EUR 530 million fine against TikTok. The DPC holds 8 of the top 10 GDPR fines ever issued anywhere in the EU, a further confirmed-tier finding underscoring the concentration of major GDPR enforcement activity in Ireland relative to every other Member State. This aggregate enforcement picture sits alongside, and is substantially driven by, the two largest live matters tracked elsewhere in this cycle's brief: the upheld TikTok cross-border transfer fine and the pending Meta data-access-rights fine. Ireland's enforcement posture continues to intensify materially, with these two matters together representing the two largest live GDPR enforcement matters in the EU this cycle, a confirmed-confidence judgment reflecting the DPC's sustained trajectory as the bloc's dominant GDPR enforcer. #### Outlook The aggregate fine total will move further once the Meta fine is finally quantified and once any adjustment to the TikTok fine following its appeal process is resolved. Ireland's position as the EU's leading GDPR enforcer by fine volume is unlikely to be displaced in the near term given the concentration of major technology-platform EU headquarters within its jurisdiction. Periodic update · new data 2026-09-05 #### Enforcement & Redress The DPC's cumulative GDPR fine total since 2018 stands at approximately €4.04 billion, the largest of any EU supervisory authority, confirmed via secondary aggregation reporting drawing on the DLA Piper January 2026 Data Breach Survey. Set against that headline figure, only approximately €20 million — about 0.5 percent — has actually been collected, with the balance suspended, under appeal, or in litigation, including the €1.2 billion Meta fine and the €746 million Amazon fine. The Amazon fine was annulled on procedural grounds by the Luxembourg Administrative Court in March 2026, though most of the underlying substantive violations were confirmed notwithstanding that procedural annulment — an important distinction between a fine being vacated and the underlying finding being vindicated. This cycle's most significant new enforcement data point is the €530 million TikTok fine issued in 2025 over EEA-to-China data transfers, now under appeal, which is confirmed via corroborated secondary reporting though no primary DPC decision text was independently retrieved. #### Outlook The persistently low fine-collection rate means headline enforcement totals should be read with caution when assessing near-term realised regulatory pressure; the TikTok appeal and the broader pattern of Meta- and Amazon-scale fines facing years of litigation both suggest that the practical deterrent effect of DPC enforcement lags materially behind its nominal scale. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 72 words · 16 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties