GDPR and the Irish DPC: A Practical Compliance Guide for Businesses
On this page
GDPR is the reason your inbox fills with privacy policy updates, and in Ireland the regulator behind it is the Data Protection Commission (DPC), based at 6 Pembroke Row, Dublin 2. The DPC is not a paper tiger: recent actions include a EUR 403 million fine against Google over its processing of location data, and a final decision on 1 October 2026 following an inquiry into Children’s Health Ireland over the physical safety and security of children’s health records at Tallaght University Hospital. This guide is the plain-English version of what Irish businesses must do. It is not legal advice, but it is the map.
The basics every Irish business needs
- Know your lawful basis. GDPR Article 6 lists six: consent, contract, legal obligation, vital interests, public task, and legitimate interests. Every processing activity needs one, documented.
- Publish a privacy notice. Who you are, what data you collect, why, the legal basis, who it is shared with, how long you keep it, and the rights people have. Plain language, linked in your footer and forms.
- Collect consent properly. Where consent is your basis, it must be specific, informed, freely given, and as easy to withdraw as to give. Pre-ticked boxes are not consent.
- Manage cookies. Cookie banners must offer a real choice, not just an accept button, and analytics cookies generally require consent before they load.
- Keep records. GDPR Article 30 requires records of processing activities for most businesses, even SMEs with employees or regular customer data.
- Respect rights. Access, correction, deletion, objection, and portability. Have a simple internal process, because a 30-day deadline applies.
- Report breaches in 72 hours. Article 33: report to the DPC within 72 hours of becoming aware where the breach risks people’s rights, and document every breach regardless.
- Write contracts with processors. Any supplier touching your data (hosting, email, analytics, AI tools) needs a data processing agreement.
The DPC in 2026: what it is watching
On 25 September 2026 the DPC published its AI Insights Report, detailing its supervision of AI products and services between 2021 and 2025, with a significant increase in AI-related engagements driven by generative AI. The message for Irish businesses is clear: AI use is not a GDPR loophole. If AI tools process customer data, the same rules apply to the same data.
The DPC also runs an awareness-raising campaign for SMEs, so the regulator is actively targeting the small business end of the market, not just the platforms.
The GDPR-to-AI checklist
- Do not feed customer data into AI tools without a lawful basis and a data processing agreement.
- Check whether the tool trains on your inputs, and switch that off where possible.
- Tell customers, in plain language, when AI is involved in processing their data.
- Apply the EU AI Act on top of GDPR as its obligations phase in by risk category.
Practical first steps
Do these in order: write down what data you hold and why, publish a proper privacy notice, fix your cookie banner, check your processors’ contracts, and document your breach procedure. That covers the majority of SME exposure. For the technical layer, our website security guide covers the safeguards that keep personal data where it belongs.
Frequently asked questions
Who enforces GDPR in Ireland?
The Data Protection Commission (DPC), Ireland's supervisory authority, based in Dublin. It investigates complaints, runs inquiries, and issues fines for breaches of the GDPR and the Data Protection Act 2018.
Does GDPR apply to small businesses?
Yes. If you process personal data of customers, staff, or website visitors in the EU, GDPR applies regardless of size. The obligations scale with what you do, but the basics are mandatory for everyone.
What is a lawful basis and why does it matter?
You need one of the six GDPR Article 6 lawful bases for every processing activity: consent, contract, legal obligation, vital interests, public task, or legitimate interests. No lawful basis, no processing.
How long do I have to report a data breach?
72 hours from becoming aware, where the breach risks people's rights and freedoms, under GDPR Article 33. Document every breach even when you do not report it.
Do I need to appoint a Data Protection Officer?
Most SMEs do not. A DPO is mandatory for public bodies, large-scale monitoring, or large-scale special category data processing. The DPC publishes guidance on when it applies.
What happens if the DPC investigates my business?
It can require information, run an inquiry, and issue corrective measures and fines. The DPC has fined companies hundreds of millions of euro, including Google EUR 403 million over location data processing, so compliance is not optional.