The legal framework
Ireland applies the GDPR through the Data Protection Act 2018. Because many large technology companies have their EU headquarters in Dublin, the Irish Data Protection Commission acts as lead supervisory authority for their European operations, and has issued some of the largest fines in the EU.
Because the European Union has legislated on this subject, the national rule is not autonomous: the General Data Protection Regulation (EU) 2016/679 applies directly, and national law only adapts it on the points the Regulation leaves open.
Key points
| Rights | Access, rectification, erasure, restriction, portability, objection |
|---|---|
| Timeframe | One month, extendable by two for complex requests |
| Regulator | Data Protection Commission, lead authority for many multinationals |
| Fines | Up to €20m or 4 % of global turnover |
| One-stop shop | Complaints can be lodged with your own national authority even against an Irish-established company |
| ePrivacy | Separate regulations govern cookies and electronic marketing |
| Lead authority | The DPC supervises many global technology companies headquartered here |
| Caseload | Cross-border complaints can take years to resolve |
| Amicable resolution | The DPC attempts this before a formal inquiry |
| Courts | A data protection action can be brought in the Circuit Court |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- State clearly what outcome you want: deletion, correction, or an inquiry.
- For a modest claim, the Circuit Court route can be faster than waiting for the regulator.
Cost and coverage
Free.
Recent changes
The Irish DPC's decisions against major platforms have shaped European practice on consent, behavioural advertising and international transfers.
Where to go
- Data Protection Commission — online complaint form.
- Company data protection officers.
- Digital Rights Ireland and other civil society organisations.
Worth knowing
If a service is established in Ireland, you can still complain to the regulator where you live: it must forward the case under the one-stop-shop mechanism. Because Ireland is the lead authority for so many platforms, complaints about large companies are handled as cross-border cases and take much longer.
Official sources and links
- Citizens Information — official plain-language guide to rights and entitlements
- Irish Statute Book — legislation as enacted