Meet Irish DPA 2018 and GDPR obligations with less manual effort

The Data Protection Act 2018 is Ireland's main national data protection law. It gives further effect to the GDPR in Ireland, transposes the EU Law Enforcement Directive for policing and criminal justice processing, and replaced the Data Protection Commissioner with the Data Protection Commission. Most of the Act came into force on 25 May 2018, the same day the GDPR began to apply.

Any controller or processor established in Ireland must comply with the Act alongside the GDPR. This includes Irish businesses of every size, public bodies, and the many multinational technology companies whose EU main establishment is in Ireland, which makes the Data Protection Commission their lead supervisory authority. Competent authorities processing data for law enforcement purposes are covered by Part 5 instead of the GDPR.

The Act supplements the GDPR rather than replacing it. The GDPR applies directly in Ireland, and the Act fills in areas the GDPR leaves to member states, such as the digital age of consent (16), conditions for processing special category and criminal offence data, restrictions on data subject rights, and the Data Protection Commission's procedures. To comply in Ireland you need to meet both the GDPR and the Act.

The Data Protection Commission can impose administrative fines under Article 83 of the GDPR, applied through Part 6 of the Act. Fines on public authorities that do not act as undertakings are capped at €1,000,000 under section 141. The Act also creates criminal offences, such as unauthorised disclosure by a processor, punishable on indictment by a fine of up to €50,000, up to 5 years' imprisonment, or both.

The digital age of consent in Ireland is 16. Section 31 of the Data Protection Act 2018 sets 16 as the age for the purposes of Article 8 of the GDPR, so information society services relying on consent to process the data of a child under 16 need consent from a person with parental responsibility. For other purposes under the GDPR, section 29 defines a child as a person under 18.

The GDPR sets the main rules on when a data protection officer is required, for example for public bodies and large scale monitoring or sensitive data processing. Section 34 of the Act allows regulations to require DPOs in further cases, and section 88 requires controllers processing for law enforcement purposes under Part 5 to designate one. Check whether your processing falls into any of these categories.

Largely, but not completely. The 2018 Act repealed most of the Data Protection Acts 1988 and 2003, but section 8 keeps the older Acts in place for certain processing, such as processing for national security, defence and international relations, and for complaints and investigations about matters that arose before 25 May 2018. Most organisations now work under the GDPR and the 2018 Act.

Yes. OneClickComply supports the Irish Data Protection Act 2018 today. It shares controls with GDPR and ISO 27001, so evidence you collect once counts towards each. OneClickComply does not certify compliance, but our in-house auditors can guide you through Irish specific requirements.