#
Comprehensive, fully in-force omnibus framework with an active, well-resourced regulator and clear statutory authority.
Sub-modules (5)
Regulator And AuthorityGreen
The DPC is Ireland's independent supervisory authority for GDPR, statutorily established under Section 10 of the Data Protection Act 2018.
Claims (2):
- The Data Protection Commission (DPC), established under Section 10 of the Data Protection Act 2018, is Ireland's supervisory authority responsible for the purposes of the GDPR.
- Data Protection Commission is: Ireland's single national independent supervisory authority under the GDPR and Data Protection Act 2018, acting as Lead Supervisory Authority for numerous multinational technology companies under the one-stop-shop mechanism.
Act And InstrumentsGreen
The Data Protection Act 2018 gives further effect to the GDPR and repealed the 1988/2003 Acts (save national-security/defence/international-relations processing carve-outs).
Claims (1):
- The Data Protection Act 2018 gives further effect to the GDPR and, having commenced on 25 May 2018, repealed the Data Protection Acts of 1988 and 2003 except for provisions relating to processing for national security, defence, and international relations of the State.
Material ScopeGreen
The GDPR's dual objective -- protecting the fundamental right to data protection while enabling free data flow -- defines material scope of application in Ireland.
Claims (1):
- The GDPR pursues a two-fold objective in Ireland's material scope: protecting the fundamental rights of natural persons regarding personal data, and allowing the free flow of personal data and digital-economy development.
Territorial ScopeGreen
Article 3(2) GDPR extends the Irish/EU regime extraterritorially to non-EU-established controllers targeting or monitoring EU data subjects.
Claims (1):
- GDPR Article 3(2) extends application to controllers/processors not established in the Union where processing relates to offering goods or services to, or monitoring, data subjects in the Union, thereby extending Irish/EU jurisdiction extraterritorially.
Regulator Registration And FilingAmber
Ireland imposes no general controller-registration requirement post-GDPR; the principal filing obligation is DPO-contact-detail publication/communication to the DPC under Article 37 GDPR.
Claims (1):
- Data controllers and processors are required to publish their DPO's contact details and communicate them to the DPC (and other relevant supervisory authorities), in lieu of a general controller-registration filing regime post-GDPR.
Regulator & Framework
The Data Protection Commission's role as Ireland's supervisory authority was exercised at scale this period through its own-volition inquiry role as Google's Lead Supervisory Authority under the GDPR one-stop-shop mechanism, exercised in the decision of 21 September 2026 that fined Google Ireland Limited EUR 403,000,000 for infringing GDPR Arts 5, 6, 12 and 13 in its processing of location data. The decision imposed both the fine and a six-month compliance order, and stands as the clearest demonstration this period of the lead-authority function in practice.
Separately, Ireland's institutional architecture for AI governance has been placed on statutory footing. The Regulation of Artificial Intelligence Act 2026 (No. 31 of 2026) was signed into law on 21 July 2026, establishing the AI Office of Ireland as an independent statutory body and the state's central coordinating authority for implementation of the EU AI Act. The Office became operational from approximately 1 to 2 August 2026, aligning with the AI Act's own general application date of 2 August 2026. This places a dedicated statutory coordinating body alongside the DPC within Ireland's wider data and technology regulatory architecture.
Outlook
With the AI Office of Ireland now on a statutory footing and operational, and the DPC continuing to exercise its lead-authority role at substantial scale, the coming period is one in which the relationship and division of labour between these two authorities, and between the AI Office and the sectoral market-surveillance authorities it coordinates, is likely to come into sharper focus.
Sources and claims (6)
- ProbableEuropean Data Protection Board — The Data Protection Commission (DPC), established under Section 10 of the Data Protection Act 2018, is Ireland's supervisory authority responsible for the purposes of the GDPR.observed
- ProbableDataGuidance / OneTrust — The Data Protection Act 2018 gives further effect to the GDPR and, having commenced on 25 May 2018, repealed the Data Protection Acts of 1988 and 2003 except for provisions relating to processing for national security, defence, and international relations of the State.observed
- ProbableEuropean Data Protection Board — The GDPR pursues a two-fold objective in Ireland's material scope: protecting the fundamental rights of natural persons regarding personal data, and allowing the free flow of personal data and digital-economy development.observed
- ProbableEuropean Data Protection Board — GDPR Article 3(2) extends application to controllers/processors not established in the Union where processing relates to offering goods or services to, or monitoring, data subjects in the Union, thereby extending Irish/EU jurisdiction extraterritorially.observed
- ProbableDataGuidance / OneTrust — Data controllers and processors are required to publish their DPO's contact details and communicate them to the DPC (and other relevant supervisory authorities), in lieu of a general controller-registration filing regime post-GDPR.observed
- Probableunavailable — Data Protection Commission is: Ireland's single national independent supervisory authority under the GDPR and Data Protection Act 2018, acting as Lead Supervisory Authority for numerous multinational technology companies under the one-stop-shop mechanism.