Ireland

The Data Protection Act 2018 gives effect to the General Data Protection Regulation. The Regulation itself sets out who is caught. Ireland matters far more than its size suggests, because so many large technology companies put their European headquarters in Dublin. That makes the Irish Data Protection Commission their 'lead supervisory authority' under the one-stop-shop system. In that role the Commission closed 208 valid cross-border complaints in 2025, up 43 per cent on 2024. It also opened an inquiry of its own into X Internet Unlimited Company on 17 February 2026.

Industry by industry, checked 18 August 2026. BANKING, PAYMENTS, INSURANCE, SECURITIES: allowed with conditions. We found no Irish rule that data must stay in the country. The Central Bank of Ireland works through its Cross-Industry Guidance on Outsourcing and through the European Digital Operational Resilience Act. Both require you to know and disclose where your data sits. Neither requires you to keep it here. The Central Bank paused its own outsourcing register collection in 2025. It will resume in February 2027, with a reference date of 31 December 2026. ANTI-MONEY-LAUNDERING REGULATED FIRMS: a copy must stay in Ireland, and this is the real Irish restriction. Take a trust or company service provider authorised by the Minister for Justice. It must keep prescribed records 'at an office or other premises in the State' for at least six years. It must also tell the Minister the address where they are held. A cheque-cashing office registered with the Central Bank has the same duty. Breaking either is a crime. The equivalent duty for ordinary designated persons was removed in 2013. See the traps. ALL COMPANIES: a copy must stay in Ireland. You may keep accounting records outside Ireland. But you must send information and returns to Ireland, and keep them there. They must be good enough to show the assets, liabilities and profit or loss at intervals of no more than six months. HEALTH: allowed with conditions, and tightening. The Health Information Act 2026 lets the Health Service Executive share an Electronic Health Record with a country outside Europe only through a reciprocal arrangement. It must consult the Data Protection Commission first. That part of the Act is not yet in force. TELECOMS: allowed with conditions. Service providers must keep subscriber 'user data' for one year. Keeping traffic and location data is not general. It happens only if the Minister obtains a High Court order. GOVERNMENT AND PUBLIC SECTOR: allowed with conditions. The Data Sharing and Governance Act 2019 controls sharing between public bodies through written data-sharing agreements. We found no requirement in that Act that data stay in Ireland. MAPPING AND GEOSPATIAL, EDUCATION, DEFENCE, GAMING: we found no Irish rule that data must stay in the country, checked 18 August 2026. Confidence medium. The gambling regulator's record-keeping regulations were still out for public consultation until 20 August 2026 and have not been made.

The Irish regulator's own guidance sets out the order to work through. First, is the destination on the European Commission's list of countries decided to be safe enough. If not, use an approved safeguard. That usually means one of five things. The 2021 standard contract clauses. Company-wide binding rules. An approved code of conduct. An approved certification. Or a binding legal agreement between public bodies. Only then come the narrow exceptions in the Regulation. The regulator says those must not be your first port of call. Separately, Regulation (EU) 2018/1807 stops member states from requiring non-personal data to stay in the country, except on public security grounds. That is why Ireland's few in-country storage rules are all attached to specific record-keeping duties rather than to data in general. The one unstable piece is the European Union to United States Data Privacy Framework. It is still in force and legally valid today. But it is under appeal at the Court of Justice. And on 31 July 2026 the European Data Protection Board formally wrote to the Commission, asking it to look again at whether the decision holds. You can use it today. Never use it as your only route.

Here is the evidence that it is working, all from the regulator's own site. It received 16,160 new cases in 2025, a 45 per cent rise. It closed 11,734 cases. It received 6,521 valid breach notifications. It closed 275 electronic direct marketing investigations, an 88 per cent rise. It sent 50 warning letters about unsolicited marketing. Recent decisions include Permanent TSB on 8 May 2026 and Midlands Regional Hospital Tullamore on 15 June 2026. It has open inquiries of its own into X Internet Unlimited Company, from February 2026, and Children's Health Ireland, from August 2025. The Commission also went after a government department. In June 2025 it reprimanded the Department of Social Protection over facial recognition in the Public Services Card scheme. It fined the Department 550,000 euro (about 600,000 US dollars) and ordered it to stop using face data within nine months. Other regulators that matter. The Central Bank of Ireland supervises financial firms and their outsourcing. Coimisiún na Meán regulates video-sharing platforms under the Online Safety Code and is the Irish Digital Services Coordinator. The Gambling Regulatory Authority of Ireland was formally set up in March 2025. It published its first annual report and invited its first remote betting licence applications in February 2026. The Health Research Consent Declaration Committee sits under the Department of Health and publishes decisions. The National Cyber Security Centre exists and runs the national incident response team. It does not yet have powers under the European cybersecurity directive known as NIS2, because Ireland has not written that directive into Irish law.

MINIMUMS, all verified against the laws. Anti-money-laundering: a designated person must keep customer checks and transaction records for at least five years after the relationship or transaction ends. Trust and company service providers: at least six years, at premises in the State, with the address notified to the Minister for Justice. Cheque-cashing offices registered with the Central Bank: the same six years in the State. Breaking that carries a fine of up to 500,000 euro (about 550,000 US dollars) or three years in prison in the more serious cases. Companies: accounting records must be kept for at least six years after the end of the financial year they relate to. So must the information and returns that have to stay in Ireland where the books are abroad. Telecoms: subscriber 'user data' for one year, which the Minister can extend by regulation to a maximum of two years. Traffic and location data for twelve months, but only where a High Court judge has made an order on the Minister's application. MAXIMUMS. The general European rule is that you keep personal data no longer than you need it. Telecoms have a sharper rule. Traffic data must be erased or made anonymous once it is no longer needed to carry or bill for the communication. CONFLICT. Ireland settles a clash the same way the rest of Europe does. A keeping period set by law is a legal duty, which is a lawful reason to keep the data. It beats a deletion request for as long as the duty runs. The trap is the location, not the length. A six-year duty that also says 'in the State' is not satisfied by a cloud region abroad plus the ability to restore from it.

CLOCK ONE. You have 72 hours to tell the Data Protection Commission about a personal data breach that puts people at risk. The clock starts the moment you become aware of it. You must also tell the people themselves without undue delay where the risk to them is high. The Commission received 6,521 valid breach notifications in 2025. This is a well-worn path rather than a theoretical duty. CLOCK TWO. Providers of public electronic communications networks or services have their own duty under the 2011 ePrivacy Regulations. They must tell the Commission without undue delay, using a separate telecoms breach form. They must also keep an internal list of every breach, recording the facts, the effects and what they did about it. Your general privacy playbook does not cover this. The regulator flags it as separate. CLOCK THREE. One hour to remove terrorist content after you get a removal order from An Garda Síochána, the Irish police. That comes from the European terrorist content online rules. WHAT IS MISSING. The European cybersecurity directive known as NIS2 would add a 24-hour early warning and a 72-hour incident report for covered organisations. Ireland has not written it into Irish law, so those deadlines do not run here yet. The older 2016 duties still apply to operators of essential services already designated in Ireland.

TRAP 1. The Data Protection Act 2018 makes it an offence for a company to use a child's personal data for direct marketing, profiling or micro-targeting. It has been in the law since 2018. As of 18 August 2026 the Irish Statute Book's own table records it as 'Not yet commenced. Commencement order required under s. 1(3).' It is one signature away from being live. It does not bind anyone today. TRAP 2. The as-enacted text on the official statute website is not the law in force. The as-enacted version of the anti-money-laundering Act still says records must be kept 'at an office or other premises in the State'. Those words were removed by the Criminal Justice Act 2013, with effect from 14 June 2013. A plain text search of the government's own site turns up a rule that has not existed for thirteen years. Always check the consolidated Revised Act. TRAP 3. Ireland set its digital age of consent at 16. That is the highest the General Data Protection Regulation allows. A consent flow built for 13-year-olds fails here. TRAP 4. Criminal, not administrative. A trust or company service provider that fails to keep its records at Irish premises commits an offence. In the more serious cases it carries a fine or up to five years in prison. A cheque-cashing office faces up to 500,000 euro (about 550,000 US dollars) or three years. Separately, disclosing identifiable information collected by the Central Statistics Office is banned outright. TRAP 5. The fine cap for the public sector. Where the Commission fines a public authority or public body that is not acting as a business, the fine cannot exceed 1 million euro. That is why enforcement against Irish state bodies arrives as an order to stop rather than a large fine. The Department of Social Protection was ordered in June 2025 to stop using face data within nine months. TRAP 6. Health research in Ireland needs explicit consent from each participant before the research starts. That is on top of everything the General Data Protection Regulation requires. If you cannot get consent, you must apply to the Health Research Consent Declaration Committee for a declaration waiving it. There is no quiet 'legitimate interests' route.

WITH DATES, CONFIRMED. 17 August 2026: the first parts of the Health Information Act 2026 came into force. That includes the Health Service Executive's power to create an Electronic Health Record for every patient. Three sets of rules still need commencement orders. The duty on providers to share patient data. The rules on access and restrictions. And the rules on permitted uses and exchange with countries outside Europe. 31 July 2026: almost all of the Regulation of Artificial Intelligence Act 2026 came into force. Ireland's new artificial intelligence office, Oifig IS na hÉireann, was formally set up. One limb of the market surveillance definition is still not in force. 20 August 2026: the gambling regulator's consultation on record-keeping regulations for licence holders closed. Regulations are expected to follow. 12 January 2027: under the European Data Act, all cloud switching charges and fees for moving your data out must fall to zero. 28 February 2027: Central Bank of Ireland outsourcing registers must be submitted, with a data reference date of 31 December 2026. The Bank will contact firms in the last quarter of 2026. OVERDUE. The European cybersecurity directive known as NIS2 should have been in Irish law by 17 October 2024. A General Scheme was published in September 2024. No Bill appears in the Oireachtas legislation database as of 18 August 2026. The regulator's registration and incident reporting portals are still switched off. POWERS ALREADY HELD, which could change the answer with no consultation. 1. The Minister for Justice can apply, without notice and in private, to a designated High Court judge. The order can compel every telecoms and internet provider in Ireland to keep traffic and location data for twelve months. It is made public only afterwards. 2. A single commencement order would switch on the criminal ban on profiling and micro-targeting children that has been unused since 2018. 3. The Minister may make regulations setting technical requirements for how kept communications data is held. That is the natural place for any future in-country storage condition. 4. The Minister for Health may make regulations governing access to Electronic Health Records under the Health Information Act 2026.