The legal framework
Protection rests on the Data Protection and Privacy Act 2019 and its 2021 regulations, overseen by the Personal Data Protection Office. Data collectors and processors must register with the Office, and the Act gives rights of access, correction and objection. These statutes follow the familiar pattern: lawful basis, purpose limitation, security, and rights of access, correction and objection.
Key points
| Rights | Access, correction, objection, and erasure under the more recent statutes |
|---|---|
| Registration | Data controllers must often register with the regulator |
| Breach notification | Required under most of these Acts |
| Cross-border transfers | Permitted subject to adequacy or safeguards |
| Regulator | Personal Data Protection Office |
| Sectoral rules | Telecommunications and financial regulators impose additional confidentiality duties |
| Applies to government | Unlike several regional statutes, it binds public bodies |
| Offences | Unlawful obtaining or disclosure is criminal |
| Consent | The primary lawful basis under the Act |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Complain to the Personal Data Protection Office; registration details are public.
- Where a public body is involved, consider the Human Rights Commission as well.
Cost and coverage
Complaints to the regulator are free.
Recent changes
Digital lending applications that harvest contact lists have become the most common subject of enforcement across the region, alongside unsolicited marketing.
Where to go
- Personal Data Protection Office — complaints and guidance.
- Telecommunications regulator for mobile and SMS abuse.
- Consumer protection body for related commercial disputes.
Worth knowing
Where a foreign platform is involved, the GDPR often applies in parallel if the company operates in Europe. Complaining in both places at once is legitimate and frequently faster. The Act binds government bodies, which is unusual in the region. That makes it a genuine route against public sector data misuse.
Official sources and links
- UN Human Rights Office — ratified treaties and country reviews
- ILO NATLEX — national legislation database