IrelandGDPR Article 82, Data Protection Act 2018 Section 117, and DPC Enforcement in Ireland
Regulation (EU) 2016/679, Arts. 82-83; Data Protection Act 2018 §117
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, where the District Court, the Circuit Court or the High Court awards compensation in a data protection action, under General Data Protection Regulation (GDPR) Article 82 and Data Protection Act 2018 Section 117.
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ); Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5) sets the higher fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements including the Article 9 special category rules, the Article 12 to 22 data subject rights, and the Chapter V transfer rules. The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25 to 39 controller and processor obligations, including the Article 33 and 34 breach notification duties. Data Protection Act 2018 section 141(4) caps the administrative fine the Commission may impose on a public authority or public body that does not act as an undertaking within the meaning of the Competition Act 2002 at EUR 1,000,000.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
Enforcement record
Counts the large scale statutory inquiries the Data Protection Commission finalised in calendar year 2025 (4), per the Commission's own press release announcing its 2025 Annual Report, published . The fines imposed that year included two fines totalling EUR 530 million against TikTok Technology Limited over transfers of EEA user data to China, and a EUR 550,000 fine against the Department of Social Protection over biometric facial matching in the Public Services Card registration process; the release's own stated total of fines for the year is just over EUR 530.77 million. Public enforcement actions only, counted from the Commission's own announcement rather than a private tracker; the release does not restate a cumulative total since 2018. This is the regime's own enforcement record, not specific to this instrument.
- As of
- Currency
- EUR
- Source link
- https://www.dataprotection.ie/en/data-protection-commission-publishes-2025-annual-report
- Fines per year
- 530,770,000
- Actions per year
- 4
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Guidance link
- https://www.dataprotection.ie/en/dpc-guidance/blogs/right-compensation-and-liability
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Guidance body
- Data Protection Commission
- Open questions
- Which Irish rules on the extent of financial compensation fix the amount payable for non-material damage under Article 82 of the GDPR, given that the Court of Justice in Case C-300/21 leaves the extent of compensation to the domestic rules of each Member State?
What it makes you log
Logging duty
Article 82 and section 117 give a right to compensation and a data protection action, and Article 83 sets fines. They state no duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation.
- Kind
- None
- As of
What this law does
The DPC is Ireland's supervisory authority, established under Part 2 of the DPA 2018 and enforcing under Part 6, with General Data Protection Regulation (GDPR) Article 83 administrative fines. Article 82 arms an individual with a direct private right of action.
Section 117 of the DPA 2018 lets a data subject bring a data protection action for an injunction, a declaration or compensation for damage in the District Court, the Circuit Court or the High Court, the compensation recoverable in each of the two lower courts being capped at the limit of that court's jurisdiction in tort. A not-for-profit body mandated by a data subject can bring a data protection action on the data subject's behalf under Section 117(7) of the DPA 2018 and Article 80(1).
The Representative Actions for the Protection of the Collective Interests of Consumers Act 2023 lets a body designated a qualified entity by the Minister for Enterprise, Trade and Employment bring representative actions covering DPA 2018 claims, and the Minister reviews a designation at least once every five years and may revoke it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .