Operates a social platform, in Ireland

S.I. No. 360/2018, Regs. 17 and 21 · Read the law's page

• Take appropriate and proportionate technical and organisational measures, having regard to the state of the art, to manage the risks to the network and information systems you use and to prevent or minimise the impact of an incident on the continuity of your service.
• As a relevant digital service provider, additionally take into account the security of your systems and facilities, incident handling, business continuity management, monitoring, auditing and testing, and compliance with international standards, and keep documentation sufficient for the competent authority to verify your compliance.
• This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2 that has its main establishment or a designated representative in the State and is not a micro or small enterprise, Regulation 20(1)) and a designated operator of essential services in the energy, transport, health, drinking water supply and distribution, or digital infrastructure sectors under Schedule 1 (Regulation 17 does not apply in the banking and financial market infrastructure sectors); the operator-of-essential-services class is reached by declaring that you operate an essential service.

S.I. No. 360/2018, Regs. 18 and 22 · Read the law's page

• Notify the State's CSIRT without delay and in any event not later than 72 hours after becoming aware of an incident with a significant impact on the continuity of your essential service, or a substantial impact on your digital service, including an incident affecting a third-party digital service provider you rely on.
• Notify the CSIRT again as soon as practicable once the incident has been resolved, and in any event not later than 72 hours after that time (Regulations 18(9) and (10), 22(10) and (11)).
• This binds a relevant digital service provider (an online marketplace, online search engine or cloud computing service under Schedule 2 that has its main establishment or a designated representative in the State and is not a micro or small enterprise, Regulation 20(1)) and a designated operator of essential services under Schedule 1; the operator-of-essential-services class is reached as on this jurisdiction's companion security-requirements row.

S.I. No. 567 of 2021, regs. 18-24 · Read the law's page

• These rules reach a provider of an information society service of which the main or one of the main purposes is to store and give the public access to a large amount of copyright-protected works or other protected subject matter uploaded by its users, which it organises and promotes for profit-making purposes. They do not reach, among others, not-for-profit online encyclopedias, not-for-profit educational and scientific repositories, open source software-developing and -sharing platforms, providers of electronic communications services, online marketplaces, business-to-business cloud services or cloud services that allow users to upload content for their own use.
• Obtain an authorisation from the rightholders, such as a licensing agreement, before you give the public access to copyright-protected works or other protected subject matter uploaded by your users. Where you obtain one, it also covers acts of your users who are not acting on a commercial basis or whose activity does not generate significant revenues.
• If no authorisation is granted, make best efforts to obtain one, make best efforts, in accordance with high industry standards of professional diligence, to ensure the unavailability of specific works for which rightholders have given you relevant and necessary information, and, on receiving a sufficiently substantiated notice from rightholders, act expeditiously to disable access to or remove the notified works and make best efforts to prevent their future uploads. You are liable for unauthorised acts of communication to the public unless you can demonstrate all three.
• On request, give rightholders adequate information on the functioning of your practices for cooperating with them, and, where you have concluded a licensing agreement, sufficiently specific information on the use of content covered by it, without having to give detailed and individualised information on each work unless a contractual agreement provides for it.
• Do not let your cooperation with rightholders prevent the availability of works uploaded by users that do not infringe copyright and related rights, including works covered by an exception or limitation, and tell your users in your terms and conditions that they can use works under the exceptions or limitations provided for in European Union law.
• Put in place an effective and expeditious complaint and redress mechanism available to your users in disputes over the disabling of access to, or removal of, works they uploaded, process complaints without undue delay, and subject decisions to disable access or remove content to human review.
• If your services have been available to the public in the European Union for less than 3 years and your annual turnover is below EUR 10 million, you are only obliged to comply with the provision regulation 20(3) names as subparagraph (a) of paragraph (2) and to act expeditiously, on a sufficiently substantiated notice, to disable access to or remove the notified works; if your average monthly unique visitors, calculated on the previous calendar year, exceed 5 million, you must also demonstrate best efforts to prevent further uploads of the notified works for which rightholders have provided relevant and necessary information.
• Do not rely on the limitation of liability in section 40 of the Copyright and Related Rights Act 2000 for acts of communication to the public that fall within these Regulations.

Online Safety and Media Regulation Act 2022 (No. 41 of 2022); Online Safety Code (Coimisiun na Mean, October 2024)

• If you operate a video-sharing platform or other online service designated under the Online Safety Code, include in your terms and conditions measures protecting children and the public from harmful content.
• If you operate a video-sharing platform or other online service designated under the Online Safety Code, assess and mitigate the risks posed by your content-delivery and recommendation mechanisms.
• Do not rely on simple self-declaration for age verification.

Online Safety and Media Regulation Act 2022, No. 41 of 2022 · Read the law's page

• This Act binds the regulator rather than an app directly: it dissolved the Broadcasting Authority of Ireland, established Coimisiún na Meán (the Media Commission), and empowers it to designate video sharing platforms with an establishment in Ireland and to adopt legally binding online safety codes.
• If your video sharing platform has an establishment in Ireland and is designated, follow the online safety code that applies to it, including its rules protecting minors from harmful content.

Digital Services Act 2024 (No. 2 of 2024), Part 3 · Read the law's page

• If you are a provider of an online platform whose main establishment is in Ireland, whose legal representative under Article 13(1) of the Digital Services Regulation is in Ireland, or which must designate a legal representative under Article 13(1) and has not done so, comply with Articles 30, 31 and 32 of the Digital Services Regulation: the Competition and Consumer Protection Commission is the competent authority for them.
• Comply with a compliance notice served on you for an infringement of Article 30, 31 or 32 by the date the notice specifies, which may not be earlier than the end of the 14 days in which you may appeal the notice to the District Court.
• If the Competition and Consumer Protection Commission gives you a notice under section 54 of the Digital Services Act 2024 during an investigation, take the measures it requires to avoid or reduce a risk of serious harm by the date the notice states.
• If the Competition and Consumer Protection Commission gives you a notice under section 73 to end an infringement of Article 30, 31 or 32, take the steps the notice states within the period it states.
• If you provide an online platform allowing consumers to conclude distance contracts with traders, pay the levy that a levy order made by the Competition and Consumer Protection Commission under section 45A of the Digital Services Act 2024 imposes on you, and keep and make available to it the records the levy order requires.
• Do not give the Competition and Consumer Protection Commission information that you know to be false or misleading when complying with a requirement imposed by or under a levy order.
• If you have entered into a commitment agreement with the Competition and Consumer Protection Commission under section 79, comply with it.

Digital Services Act 2024 (No. 2 of 2024), s. 5 and Part 2 · Read the law's page

• If you are an intermediary service provider whose main establishment is in Ireland, whose legal representative under Article 13(1) of the Digital Services Regulation is in Ireland, or which must designate a legal representative under Article 13(1) and has not done so, comply with every provision of the Digital Services Regulation other than Articles 30, 31 and 32 and Section 5 of Chapter III: Coimisiún na Meán supervises each of them under the investigation and sanction powers in Part 8B of the Broadcasting Act 2009.
• Comply with a compliance notice served on you for an infringement of Articles 11, 12, 13(4), 14(1), (2), (5) and (6), 15(1), 16(1), 21(1) and (4), 24(2), 25 or 26(1)(a) to (d) of the Digital Services Regulation by the date the notice specifies, which may not be earlier than the end of the 14 days in which you may appeal the notice to the District Court.
• If Coimisiún na Meán gives you a notice under section 139ZZB of the Broadcasting Act 2009 to end a contravention that is an infringement of the Digital Services Regulation, take the steps the notice states within the period it states.
• If Coimisiún na Meán gives you a notice under section 139ZLB of the Broadcasting Act 2009 during an investigation, take the measures it requires to avoid or reduce a risk of serious harm by the date the notice states.
• In a Digital Services investigation, do not obstruct an authorised officer, comply with the officer's requirements, and do not give the officer information that is false or misleading in a material respect; rectify any failure to comply and any such information.
• If you provide a very large online platform or a very large online search engine, provide access to data to a vetted researcher where Coimisiún na Meán has issued a reasoned request under Article 40(4) of the Digital Services Regulation for that researcher.
• If you have entered into a commitment agreement with Coimisiún na Meán under section 139ZZGB of the Broadcasting Act 2009, comply with it.

Broadcasting Act 2009 (No. 18 of 2009), ss. 139ZG(1), 139ZGA and 139ZW(1AA) and (3A) · Read the law's page

• If you are a hosting service provider, comply with Articles 3(3) and (6), 4(2) and (7), 5(1), (2), (3), (5) and (6), 6, 7, 10, 11, 14(5), 15(1) and 17 of Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online: section 139ZG(1) of the Broadcasting Act 2009 makes an infringement of any of them a contravention that Coimisiún na Meán may investigate and sanction.
• If Coimisiún na Meán gives you written notice requiring information on whether you are a hosting service provider, or a hosting service provider that is or has been exposed to terrorist content, provide the information the notice specifies, in the form and manner it specifies, within 20 working days of the date of the notice or within a further period agreed in writing before those 20 days expire.

Online Safety Code (Coimisiún na Meán), secs. 12.1, 12.6-12.9, 15, 16 and 17.3 · Read the law's page

• If you provide a video-sharing platform service that Coimisiún na Meán has designated as a video-sharing platform service under the jurisdiction of the State, comply with the Online Safety Code, which states that its entirety is binding on the services it regulates.
• Include in your terms and conditions restrictions that preclude users from uploading or sharing restricted video content and restricted indissociable user-generated content: content by which a person bullies or humiliates another person, promotes or encourages behaviour that characterises a feeding or eating disorder, promotes or encourages self-harm or suicide, or makes available knowledge of methods of self-harm or suicide, where the content meets the risk test; content containing incitement to violence or hatred on a ground referred to in Article 21 of the Charter of Fundamental Rights of the European Union; and content the dissemination of which constitutes a public provocation to commit a terrorist offence, an offence concerning child pornography as the Code words it, or an offence concerning racism and xenophobia.
• Apply those terms and, where appropriate and after issuing a prior warning, suspend for a reasonable period of time the service to users you have determined to have frequently infringed them, assessing each case in a timely, diligent and objective manner and having due regard to the rights and legitimate interests of all parties, including the fundamental rights of users; these suspension rules apply only insofar as the consequences for the user are not covered by measures adopted pursuant to Articles 23 and 35(1)(b) of Regulation (EU) 2022/2065.
• Establish and operate transparent and user-friendly mechanisms for users to report or flag restricted video content and restricted indissociable user-generated content, and systems that explain to users what effect has been given to reports and flags.
• When you inform a notifier of your decision about reported or flagged content, tell them they can use your complaint handling procedures if they are dissatisfied, and give users clear and transparent information about those procedures.
• Establish and operate transparent, easy-to-use and effective procedures for handling and resolving complaints by users about the implementation of your age assurance, content rating, parental controls and reporting and flagging measures, other than complaints about decisions listed in Article 20(1), points (a) to (d) of Regulation (EU) 2022/2065; make information on them prominent, accessible and easily identifiable, and handle complaints in a diligent, timely, non-discriminatory and effective manner.
• Give the Commission a report on your handling of communications from users raising complaints or other matters every 3 months, or at such other intervals as it specifies.

S.I. No. 474 of 2025 · Read the law's page

• If you are a sponsor or a provider of political advertising services within Regulation (EU) 2024/900 on the transparency and targeting of political advertising, comply with the obligations that Regulation imposes on you: An Coimisiún Toghcháin supervises them, except that Coimisiún na Meán supervises compliance of providers of intermediary services, audiovisual media services, sound broadcasting services, designated relevant online services and hosting services with Articles 7 to 17, and the Data Protection Commission supervises Articles 18 and 19, on targeting and ad amplification techniques.
• Comply with a compliance notice served on you under regulation 16 by the date it specifies, which may not be earlier than the end of the 28 days in which you may appeal it to the District Court.
• If you are a political advertising publisher required to prepare a management report, make the information included in it by virtue of Article 14(1) of Regulation (EU) 2024/900 available to An Coimisiún Toghcháin within the 28 days immediately following the inclusion of that information in the report.

Defamation Act 2009 (No. 31 of 2009), s. 45, inserted by the Defamation (Amendment) Act 2026 (No. 2 of 2026), s. 22 · Read the law's page

• If you provide a mere conduit, caching or hosting service, comply with an identification order of the Circuit Court requiring you to give the applicant the information as to the identity, address or other contact information of an anonymous publisher that the order specifies, subject to any conditions the order sets.

Head 15, General Scheme, National Cyber Security Bill 2024 · Read the law's page

• Notify the CSIRT without undue delay of any incident with a significant impact on the provision of your service: an early warning within 24 hours of becoming aware of it, an incident notification within 72 hours of becoming aware of it, an intermediate report on relevant status updates when the CSIRT requests one, and a final report not later than one month after submitting the incident notification (Head 15).
• Where the incident is still ongoing when the final report falls due, submit a progress report at that time and a final report within one month of handling the incident (Head 15).
• If you are a trust service provider, notify the CSIRT of a significant incident affecting your trust services without undue delay and in any event within 24 hours of becoming aware of it, in place of the later incident notification (Head 15).
• Where appropriate, notify the recipients of your service of significant incidents likely to adversely affect that service, and tell recipients potentially affected by a significant cyber threat any measures or remedies they can take in response.
• As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached as on this jurisdiction's companion risk-management row.

Head 29, General Scheme, National Cyber Security Bill 2024 · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the network and information systems you use for your operations or services, with your management board approving and overseeing those measures.
• As drafted, it would reach your service where you are an essential or important entity under the Bill's Schedules I and II, which name an online marketplace, online search engine or cloud computing service among the digital providers it reaches expressly; the wider sector classes it also reaches (energy, transport, banking, health, drinking water and digital infrastructure, and public administration) are reached too, by declaring that you are an essential or important entity.