By country

GDPR Policy Generator Ireland

GDPR under the Data Protection Act 2018, the ePrivacy Regulations 2011, and the DPC as lead authority for much of big tech.

Generate your GDPR policy Read the GDPR policy guide

For organisations led by the DPC, the compliance record is examined in unusual depth, because Irish inquiries frequently become EU-wide decisions through the Article 60 cooperation procedure.

Ireland matters out of proportion to its size because so many multinationals have their EU main establishment there, making the Data Protection Commission the lead supervisory authority under the one-stop-shop. Its decisions set the tone for the whole bloc, and its cookie guidance is among the most detailed published by any authority.

Domestically, GDPR is applied through the Data Protection Act 2018, and cookies are governed by the ePrivacy Regulations 2011 (S.I. 336/2011), which the DPC enforces separately. Its cookie sweep found the usual failures - pre-set non-necessary cookies, implied consent from continued browsing, and reject options that were harder to reach than accept.

Ireland also set the digital age of consent at sixteen, which is at the upper end of the EU range and matters for any consent-based service used by teenagers.

What a GDPR policy in Ireland has to cover

Article 30 records covering all cross-border processing supervised by the DPC
Documented main-establishment analysis supporting the one-stop-shop claim
Transfer impact assessments for each non-adequate destination
DPIAs for processing on the DPC’s mandatory list
A breach procedure notifying the DPC within 72 hours

How Ireland actually moves personal data

EU-wide processing run from Dublin

If your main establishment is Irish, the DPC is your lead authority for cross-border processing - which changes who you notify, who you correspond with, and who you name.

Cookie consent under S.I. 336/2011

The DPC treats a six-month consent lifetime as a reasonable ceiling and expects a reject control on the first layer of the banner.

Transfers to the United States

Post-Schrems II, Irish-established exporters carry the transfer assessment burden that produced the landmark decisions. The Data Privacy Framework covers certified importers only.

Health research and special categories

The Health Research Regulations impose consent and safeguard requirements beyond GDPR for health research conducted in Ireland.

Under-sixteens

With the digital age of consent at sixteen, consent-based services need verifiable parental consent for a wider age band than in most member states.

Third parties the draft will ask you about

Stripe · Realex/Global Payments · An Post · AWS eu-west-1 (Dublin) · Microsoft 365 · Google Workspace · Mailchimp · Salesforce

The rules that apply

GDPR + Data Protection Act 2018

The Irish implementation, including the digital age of consent set at sixteen and restrictions specific to health and research processing.

ePrivacy Regulations 2011 (S.I. 336/2011)

Regulation 5 requires consent before storing or accessing information on a device, enforced by the DPC with its own guidance and sweeps.

The Data Protection Commission

Lead supervisory authority for organisations with an Irish main establishment, and the named complaint route for Irish residents.

Consumer Rights Act 2022

A consolidated Irish consumer regime covering goods, services and digital content, including the fourteen-day withdrawal right and remedies hierarchy.

Online Safety and Media Regulation Act 2022

Coimisiún na Meán oversight for video-sharing and designated online services, layered on top of the Digital Services Act.

What the generated GDPR policy contains

Article 13 and 14 transparency notice
The full disclosure set, split by whether the data came from the person or from somewhere else.
Lawful basis register
Every processing activity mapped to one of the six bases, with the legitimate interests assessment written down where you rely on that basis.
Records of processing (Article 30)
The internal register a supervisory authority can ask for at any time, covering purposes, categories, recipients, transfers and retention.
Data subject rights procedure
How a request arrives, how identity is verified, who handles it, and the one-month clock with its two-month extension.
International transfer mechanism
Adequacy, SCCs with a transfer impact assessment, or the UK IDTA/addendum - named per destination, not asserted in general.
Breach detection and 72-hour notification
The internal escalation path, the assessment test, and the template for notifying the regulator and, where required, the individuals.
Processor and sub-processor controls
Article 28 terms, the sub-processor list, and the change-notification commitment your customers will ask for.

Irish compliance essentials

Establish your lead authority position
Document where cross-border processing decisions are taken, because it determines who supervises you.
Configure the banner to DPC guidance
Reject on the first layer, no pre-checked boxes, consent lifetime around six months.
Set the age gate to sixteen
And build a verifiable parental consent route for anyone below it where you rely on consent.
Document transfer assessments
The Irish exporter cases remain the reference point for what an assessment has to engage with.

Where this usually goes wrong

Assuming the DPC is your lead authority without an Irish establishment

The one-stop-shop follows the main establishment, meaning the place where decisions about processing are actually taken - not where a subsidiary is registered.

Cookies set before the banner is answered

The DPC sweep report singled this out, along with banners that treated continued browsing as consent.

Digital age of consent set to thirteen

Ireland uses sixteen. Services that gate at thirteen are non-compliant for Irish teenagers.

Confusing the DPC with the ICO

They are separate regulators under separate statutes. An Irish policy that names the ICO is describing a different legal system.

Frequently asked questions

Is the DPC my regulator if I sell into Ireland?

Only if you have an Irish main establishment. Otherwise Irish residents can complain to the DPC, but your lead authority is wherever your EU main establishment sits - and if you have none, every authority can act.

What is the digital age of consent in Ireland?

Sixteen. Below that, a consent-based information society service needs consent from a parent or guardian.

Do Irish cookie rules differ from GDPR?

They come from a different instrument - the ePrivacy Regulations 2011 - but use the GDPR consent standard. The DPC enforces them directly and has published detailed guidance on banner design.

Does GDPR apply to a business outside the EU?

Yes, where you offer goods or services to people in the EU or monitor their behaviour. Article 3(2) is about where the person is, not where you are - and Article 27 may also require you to appoint an EU representative.

What is the difference between EU GDPR and UK GDPR?

The text is nearly identical, but they are separate laws with separate regulators, separate fine ceilings in different currencies, and separate transfer regimes. A business serving both needs both named, not "GDPR" as shorthand.

Do I need a Data Protection Officer?

Only where your core activities involve large-scale regular monitoring or large-scale special-category data, or you are a public authority. Many businesses do not need one - but if you do not have one, say who is accountable instead.

Is a GDPR policy the same as a privacy policy?

No. The privacy policy is the outward-facing notice. The GDPR policy set is the internal machinery - lawful basis register, ROPA, rights procedure, breach plan - that lets you answer a regulator when they ask how the notice is honoured.