IrelandData Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018, Safeguards and Explicit Consent for Health Research in Ireland
Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314 of 2018) regs. 3, 3A and 5, as amended by S.I. No. 18 of 2021
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, DPIA, Governance
- Audit expectation
- none
What it requires
- If you process personal data for health research in Ireland, take the safeguards listed in Regulation 3(1) of the Health Research Regulations 2018, including ethical approval of the research by a research ethics committee and controls to log who consulted, altered, disclosed or erased the personal data.
- Where your assessment of the health research indicates a high risk to the rights and freedoms of individuals, carry out a data protection impact assessment.
- Obtain each data subject's explicit consent before the health research begins, record and retain it, and give the data subject a copy, unless Regulation 3A (an approved low-risk retrospective chart review) or a declaration by the Committee under Regulation 5 removes the requirement.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Penalty structure
GDPR Article 83(5)(a): the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, applies to infringement of the basic principles for processing, including the Article 9 special category conditions.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
What it makes you log
What the log must hold
Actor identity, Access record
Logging duty
Regulation 3(1)(c)(v) makes controls to log whether and by whom personal data have been consulted, altered, disclosed or erased one of the safeguards a controller must ensure for health research. It sets no log fields, retention period or audit, and names no one entitled to demand the log.
- Kind
- Explicit
- As of
- Provision
- S.I. No. 314 of 2018, reg. 3(1)(c)(v)
- Trigger
- personal_data_processing
What this law does
A controller that processes personal data for health research in Ireland must ensure that the suitable and specific safeguards listed in Regulation 3(1) of the Health Research Regulations 2018 are taken. Those safeguards include ethical approval of the health research by a research ethics committee. Those safeguards include controls to log whether and by whom the personal data have been consulted, altered, disclosed or erased.
Where the controller's assessment of the research indicates a high risk to the rights and freedoms of individuals, the safeguards include a data protection impact assessment. Subject to Regulations 3A and 3B, the controller must obtain the data subject's explicit consent, record and retain it, and give the data subject a copy, before the health research begins.
The explicit consent requirement does not apply to a retrospective chart review study that a research ethics committee has approved and stated in writing to be low risk to the rights and freedoms of individuals.
A controller proposing to process personal data for health research that began on or after may apply to the Committee for a declaration where the public interest in carrying out the research significantly outweighs the public interest in requiring the data subject's explicit consent.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .