IrelandDisability Act 2005, Part 4, Genetic Testing and Processing of Genetic Data in Ireland
Disability Act 2005 (No. 14 of 2005), Part 4, ss. 41 and 42
In force since .
A sensitive categories rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Prohibition, Consent, Disclosure
- Audit expectation
- none
What it requires
- Do not process genetic data in Ireland in relation to a person's employment, a policy of insurance or life assurance, a policy of health insurance or health-related insurance, an occupational pension, a retirement annuity contract or other pension arrangement, or the mortgaging of property.
- Do not carry out genetic testing on a person in Ireland unless the testing is not prohibited by law and you have the person's consent to the processing of the genetic data the testing will produce, obtained in accordance with the General Data Protection Regulation (GDPR).
- Before you process genetic data in Ireland, take all reasonable steps to give the data subject all appropriate information about the purpose and possible outcomes of the processing and any potential implications for the data subject's health that may become known as a result.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 42(4) makes it an offence to contravene section 42(2) (the ban on processing genetic data for employment, insurance, pension or mortgage purposes) or section 42(3) (the information duty), with a class A fine on summary conviction or a fine not exceeding EUR 100,000 on conviction on indictment. Section 42(5) lets the court order connected personal data destroyed or erased.
Penalty structure
Section 42(4) makes a contravention of section 42(2) or (3) an offence, punishable on summary conviction by a class A fine (not greater than EUR 5,000 under the Fines Act 2010) and on conviction on indictment by a fine not exceeding EUR 100,000. Section 42(5) lets the court order connected personal data destroyed or erased. The GDPR Article 83 administrative fines are a separate regime.
- Rule
- Fixed only
- As of
- Currency
- EUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), which prosecutes summary offences under Part 4 of the Disability Act 2005 in place of the Data Protection Commissioner.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
What it makes you log
Logging duty
Sections 41 and 42 of the Disability Act 2005 set no duty to keep, retain or disclose logs or records.
- Kind
- None
- As of
What this law does
Under section 42(2) of the Disability Act 2005, a person must not process genetic data in relation to the employment of a person. Section 42(2) also bars processing genetic data in relation to a policy of insurance or life assurance, a policy of health insurance or health-related insurance, an occupational pension, a retirement annuity contract or other pension arrangement, or the mortgaging of property.
Genetic testing may not be carried out on a person unless the person has consented to the processing of the genetic data the testing will produce. A person may not process genetic data unless all reasonable steps have been taken to give the data subject all appropriate information about the purpose and possible outcomes of the proposed processing and any potential implications for the data subject's health.
A person who contravenes section 42(2) or (3) commits an offence, punishable on summary conviction by a class A fine and on conviction on indictment by a fine of up to EUR 100,000. Section 55(4)(c) lets the Data Protection Commissioner prosecute a summary offence under Part 4.
When LexLint raises it
When your app profile says your app makes employment decisions, handles health records, processes personal data, makes credit decisions or makes insurance decisions.
Back to the example · Lint your app
Page updated .