IrelandData Protection Act 2018 (Access Modification) (Health) Regulations 2022, Restriction of Access to Health Data in Ireland
In force since .
A data subject rights rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- You may restrict a person's General Data Protection Regulation (GDPR) Article 15 right of access to their health data in Ireland only to the extent necessary and proportionate, and only for as long as necessary to protect the health of the data subject.
- You must still grant access to so much of the health data sought as can be granted without causing serious harm to the physical or mental health of the data subject.
- If you withhold health data under Regulation 6 or 7, advise the data subject that, if they ask, you will offer access to a health practitioner they specify, and keep the data available for that purpose.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Penalty structure
GDPR Article 83(5)(b): the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, applies to infringement of the data subjects' rights in Articles 12 to 22, which include the Article 15 right of access that these Regulations qualify. The Regulations set no penalty of their own.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
What it makes you log
Logging duty
Regulations 4 to 9 set no duty to keep, retain or disclose logs or records.
- Kind
- None
- As of
What this law does
Regulation 4 lets the right of access under Article 15 of the General Data Protection Regulation (GDPR) be restricted in relation to a person's health data only to the extent necessary and proportionate, and only for as long as necessary to protect the health of the data subject.
Under Regulation 7, a controller that is not a health services provider may decide not to provide health data where it has reasonable grounds for believing that granting access would be likely to cause serious harm to the physical or mental health of the data subject. Regulation 5 still requires a controller to grant access to so much of the information sought as may be granted without causing serious harm to the physical or mental health of the data subject.
Regulation 8(1) lets a controller that is not a health services provider consult a health practitioner with experience and qualifications to advise on the data before deciding whether to provide it. Regulation 8(2) allows the controller to give the consulted health practitioner only so much of the data subject's health data as is necessary for the practitioner to advise.
Where a controller withholds health data under Regulation 6 or 7, Regulation 9 requires it to advise the data subject that, on request, it will offer access to a health practitioner the data subject specifies and keep the data available for that purpose. Regulation 2 revokes the Data Protection (Access Modification) (Health) Regulations 1989.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .