Ireland

The Data Protection Act 2018 gives effect to the General Data Protection Regulation, whose territorial scope in Article 3(2) is the operative test. Ireland matters far more than its size suggests because so many large technology companies place their European headquarters in Dublin, which makes the Irish Data Protection Commission their 'lead supervisory authority' under the one-stop-shop mechanism. The Commission concluded 208 valid cross-border complaints in that role in 2025, a 43 per cent increase on 2024. It also opened an own-volition inquiry into X Internet Unlimited Company under section 110 of the Data Protection Act 2018 on 17 February 2026.

Sector by sector, checked 18 August 2026. BANKING, PAYMENTS, INSURANCE, SECURITIES — conditional. No Irish localisation rule found. The Central Bank of Ireland regulates through its Cross-Industry Guidance on Outsourcing and through the European Digital Operational Resilience Act, both of which demand that you know and disclose where your data sits, not that you keep it here. The Central Bank paused its own outsourcing register collection in 2025 and will resume it in February 2027 with a reference date of 31 December 2026. ANTI-MONEY-LAUNDERING REGULATED FIRMS — mirror, and this is the real Irish wall. A trust or company service provider authorised by the Minister for Justice must retain prescribed records 'at an office or other premises in the State' for at least six years and must tell the Minister the address where they are held. A cheque-cashing office registered with the Central Bank carries an identical duty. Both are criminal offences if breached. Note that the equivalent duty for ordinary designated persons under section 55 was removed in 2013 — see the traps. ALL COMPANIES — mirror. Accounting records may be kept outside Ireland, but information and returns good enough to show the assets, liabilities and profit or loss at intervals of no more than six months must be sent to and kept at a place in Ireland. HEALTH — conditional, tightening. The Health Information Act 2026 lets the Health Service Executive share an Electronic Health Record with a non-European country only through a reciprocal arrangement, and only after consulting the Data Protection Commission. That section has not yet been commenced. TELECOMS — conditional. Service providers must retain subscriber 'user data' for one year. Retention of traffic and location data is not general: it happens only if the Minister obtains a High Court order. GOVERNMENT AND PUBLIC SECTOR — conditional. The Data Sharing and Governance Act 2019 controls sharing between public bodies through written data-sharing agreements. No localisation requirement found in the Act. MAPPING AND GEOSPATIAL, EDUCATION, DEFENCE, GAMING — no Irish localisation rule found, checked 18 August 2026, confidence medium. The gambling regulator's record-keeping regulations were still out for public consultation until 20 August 2026 and have not been made.

The Irish regulator's own guidance sets out the ladder: an adequacy decision under Article 45 first; then appropriate safeguards under Article 46, which in practice means the 2021 Standard Contractual Clauses, Binding Corporate Rules, an approved code of conduct, an approved certification, or a legally binding instrument between public bodies; and only then the narrow derogations in Article 49, which the regulator says must not be the first port of call. Regulation (EU) 2018/1807 separately forbids member states from imposing localisation on non-personal data except on public-security grounds, which is why Ireland's few residency rules are all attached to specific record-keeping duties rather than to data in general. The one genuinely unstable piece is the European Union to United States Data Privacy Framework: it is still in force and legally valid today, but it is under appeal at the Court of Justice and the European Data Protection Board formally wrote to the Commission on 31 July 2026 asking it to re-examine the decision's validity. Usable today, but never as your only mechanism.

Observable evidence of activity, all from the regulator's own site: 16,160 new cases received in 2025, a 45 per cent rise; 11,734 cases concluded; 6,521 valid breach notifications; 275 electronic direct marketing investigations concluded, an 88 per cent rise; 50 warning letters on unsolicited marketing. Recent decisions include Permanent TSB on 8 May 2026 and Midlands Regional Hospital Tullamore on 15 June 2026, and open own-volition inquiries into X Internet Unlimited Company (February 2026) and Children's Health Ireland (August 2025). The Commission also went after a government department: it reprimanded the Department of Social Protection over facial recognition in the Public Services Card scheme in June 2025, fined it 550,000 euro (about 600,000 US dollars) and ordered it to stop the biometric processing within nine months. Other regulators that matter. The Central Bank of Ireland supervises financial firms and their outsourcing. Coimisiún na Meán regulates video-sharing platforms under the Online Safety Code and is the Irish Digital Services Coordinator. The Gambling Regulatory Authority of Ireland was formally established in March 2025, published its first annual report and invited its first remote betting licence applications in February 2026. The Health Research Consent Declaration Committee sits under the Department of Health and publishes decisions. The National Cyber Security Centre exists and runs the national incident response team, but it does not yet have NIS2 powers because the directive has not been transposed.

FLOORS, all verified against the statutes. Anti-money-laundering: a designated person must keep customer due diligence and transaction records for not less than five years after the relationship or transaction ends. Trust and company service providers: not less than six years, at premises in the State, address notified to the Minister for Justice. Cheque-cashing offices registered with the Central Bank: the same six years in the State, with an offence carrying a fine of up to 500,000 euro (about 550,000 US dollars) or three years in prison on indictment. Companies: accounting records, and the information and returns that must be kept in Ireland where the books are abroad, must be preserved for at least six years after the end of the financial year they relate to. Telecoms: 'user data' for one year, extendable by ministerial regulation to a maximum of two years; traffic and location data for twelve months, but only where a High Court judge has made an order on the Minister's application. CEILINGS. The storage limitation principle in the General Data Protection Regulation is the general ceiling: keep it no longer than you need it. For telecoms there is a sharper rule — traffic data must be erased or made anonymous once it is no longer needed to carry or bill for the communication. CONFLICT. Ireland resolves a clash the same way the rest of Europe does: a specific statutory retention duty is a legal obligation, which is a lawful basis to keep the data, and it beats a deletion request for as long as the duty runs. The practical trap is the location, not the length — a six-year duty that also says 'in the State' cannot be satisfied by a cloud region abroad plus a restore capability.

CLOCK ONE — 72 hours to the Data Protection Commission from the moment you become aware of a personal data breach that poses a risk to individuals, plus notification to the individuals themselves without undue delay where the risk to them is high. The Commission received 6,521 valid breach notifications in 2025, so this is a well-trodden path rather than a theoretical duty. CLOCK TWO — providers of publicly available electronic communications networks or services have their own duty under the 2011 ePrivacy Regulations to notify the Commission without undue delay, using a dedicated telecoms breach form, and to keep an internal inventory of every breach recording the facts, the effects and the remedial action. Do not assume your general privacy playbook covers this; the regulator explicitly signposts it as separate. CLOCK THREE — one hour to remove terrorist content after receiving a removal order from An Garda Síochána, the Irish police, under the European terrorist content online rules. WHAT IS MISSING — the NIS2 cybersecurity directive would add a 24-hour early warning and a 72-hour incident report for in-scope entities. Ireland has not transposed it, so those clocks do not yet run here. The older NIS1 duties continue to apply to operators of essential services already designated in Ireland.

TRAP 1 — Section 30 of the Data Protection Act 2018 makes it an offence for a company to process a child's personal data for direct marketing, profiling or micro-targeting. It has sat on the statute book since 2018 and, as of 18 August 2026, the Irish Statute Book's own commencement table records it as 'Not yet commenced. Commencement order required under s. 1(3).' It is one signature away from being live. Anyone quoting it as binding Irish law today is wrong. TRAP 2 — The as-enacted text on the official statute website is not the law in force. The anti-money-laundering Act's section 55(4) still reads, in the as-enacted version, that records must be retained 'at an office or other premises in the State'. Those words were removed by the Criminal Justice Act 2013 with effect from 14 June 2013. A naive text search of the government's own site produces a localisation rule that has not existed for thirteen years. Always check the consolidated Revised Act. TRAP 3 — Ireland set its digital age of consent at 16, the top of the range the General Data Protection Regulation allows. A consent flow built for 13-year-olds fails here. TRAP 4 — Criminal, not administrative. A trust or company service provider that fails to keep its records at Irish premises commits an offence punishable on indictment by a fine or up to five years in prison. A cheque-cashing office faces up to 500,000 euro (about 550,000 US dollars) or three years. Separately, disclosing identifiable information collected by the Central Statistics Office is prohibited outright. TRAP 5 — The fine cap for the public sector. Where the Commission fines a public authority or public body that is not acting as a commercial undertaking, the fine cannot exceed 1 million euro. That is why enforcement against Irish state bodies arrives as orders to stop processing rather than as large fines — the Department of Social Protection was ordered in June 2025 to cease biometric processing within nine months. TRAP 6 — Health research in Ireland needs explicit consent from each participant before the research starts, on top of everything the General Data Protection Regulation requires. If you cannot get it, you must apply to the Health Research Consent Declaration Committee for a declaration waiving it. There is no quiet 'legitimate interests' route.

DATED AND CONFIRMED. 17 August 2026 — the first tranche of the Health Information Act 2026 came into operation. Sections 1 to 6, 10 to 12, 16, and 19 to 24 are live, including the Health Service Executive's power to create an Electronic Health Record for every patient. Sections 7 to 9 (the duty on providers to share patient data), 13 to 15 (access and restrictions) and 17 to 18 (permitted uses and exchange with countries outside Europe) still need commencement orders. 31 July 2026 — almost all of the Regulation of Artificial Intelligence Act 2026 came into operation, and Ireland's new artificial intelligence office, Oifig IS na hÉireann, was formally established. One limb of the market surveillance definition remains uncommenced. 20 August 2026 — the gambling regulator's consultation on record-keeping regulations for licence holders closed. Regulations are expected to follow. 12 January 2027 — under the European Data Act, all cloud switching charges and data egress fees must fall to zero. 28 February 2027 — Central Bank of Ireland outsourcing registers must be submitted, with a data reference date of 31 December 2026. The Bank will contact firms in the last quarter of 2026. OVERDUE. The NIS2 cybersecurity directive should have been in Irish law by 17 October 2024. A General Scheme was published in September 2024 but no Bill appears in the Oireachtas legislation database as of 18 August 2026, and the regulator's own registration and incident reporting portals are still switched off. DORMANT SWITCHES — powers already held that could change the picture with no consultation. 1. The Minister for Justice can apply, without notice and in private, to a designated High Court judge for an order compelling every telecoms and internet provider in Ireland to retain traffic and location data for twelve months. It is publicised only after the fact. 2. A single commencement order would switch on the criminal ban on profiling and micro-targeting children that has been dormant since 2018. 3. The Minister may make regulations setting technical requirements for how retained communications data is held, which is the natural home for any future in-country storage condition. 4. The Minister for Health may make regulations governing access to Electronic Health Records under the Health Information Act 2026.