IrelandGDPR Chapter V, Cross-Border Transfer of Personal Data from Ireland
Regulation (EU) 2016/679, Arts. 44-49
In force since .
A cross border transfer rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Transfer
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Ireland outside the European Economic Area.
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5)(c): the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, applies to infringement of the Chapter V transfer rules in Articles 44 to 49.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
Settledness
- As of
- Guidance link
- https://www.dataprotection.ie/en/organisations/international-transfers/transfers-personal-data-third-countries-or-international-organisations
- Guidance body
- Data Protection Commission
- Open questions
- What supplementary measures must an exporter adopt for a transfer under Standard Contractual Clauses when its assessment of the destination country's law and practice finds the protection is not essentially equivalent to that in the European Economic Area?
What it makes you log
Who may demand the log
Regulator
Logging duty
For a transfer that relies on the compelling legitimate interests derogation, the controller or processor documents its assessment and the suitable safeguards in its Article 30 records.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 49(6)
- Trigger
- personal_data_processing
Why the legislator wanted it
- As of
- Quote
- Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.
- Source link
- https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng
- Source kind
- Recital
- Purpose
- accountability_demonstration
- regulator_supervision
What this law does
Transferring personal data of a person in Ireland outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier.
The DPC additionally operates the one-stop-shop coordination role given Ireland's concentration of EU-headquartered controllers, but this is an institutional and procedural role in cross-border enforcement coordination, not an added transfer restriction.
Section 37 of the Data Protection Act 2018 lets the Minister, in the absence of an adequacy decision under Article 45, make regulations restricting the transfer of categories of personal data to a third country or an international organisation for important reasons of public policy.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .