IrelandGDPR Articles 12-21 and Data Protection Act 2018 Sections 60-61, Data Subject Rights in Ireland
Regulation (EU) 2016/679, Arts. 12-21; Data Protection Act 2018, ss. 60-61
In force since .
A data subject rights rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Data subject rights, Governance
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Ireland within one month of receipt.
- You need not complete an access, rectification, restriction or objection request, or, for archiving in the public interest, also a portability request, where doing so would make that archiving, or scientific or historical research or statistics, impossible or seriously impair it, under Data Protection Act 2018 section 61.
- You may restrict a person's rights under General Data Protection Regulation (GDPR) Articles 12 to 22 to the extent necessary to establish, exercise or defend a legal claim, or where the personal data is an opinion about the person given to you in confidence, under Data Protection Act 2018 section 60(3).
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5)(b): the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, applies to infringement of the data subjects' rights in Articles 12 to 22, including the Article 22 right against solely automated decision making.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
Settledness
- As of
- Guidance link
- https://dataprotection.ie/en/dpc-guidance/case-studies/access-request-complaints/confidential-expressions-opinion-and-subject-access-requests
- Guidance body
- Data Protection Commission
- Open questions
- When is an opinion about a person given on the understanding that it would be treated as confidential, so that the right of access does not extend to it under Section 60 of the Data Protection Act 2018?
What record it asks for
Logging duty
GDPR Articles 12 to 21 set how and when a controller answers a rights request, and sections 60 and 61 restrict those rights for listed public-interest and research purposes. They state no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Ireland can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. The Data Protection Act 2018 narrows these rights in two ways that reach a private controller.
Section 61 restricts access, rectification, restriction and objection, and for archiving in the public interest also notification and portability, where exercising them would make archiving, scientific or historical research, or statistics impossible or seriously impair it. Section 60(3) restricts the rights in Articles 12 to 22 to the extent necessary for a legal claim or legal proceedings, or where the data are an opinion about the person given in confidence.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .