- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionEuropeRegion DetailIrelandPublisherHouses of the Oireachtas (enacted); enforced by the Data Protection Commission
- VersioningVersionData Protection Act 2018 (Number 7 of 2018), as amendedEffective DateMay 25, 2018 (S.I. No. 174 of 2018)Issue DateMay 24, 2018
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Act is public legislation published on the Irish Statute Book and is included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- Ireland's Data Protection Act 2018 gives effect to the GDPR, transposes the Law Enforcement Directive, and establishes the Data Protection Commission.
- It has been in force since May 25, 2018 and binds every controller and processor subject to Irish data protection law.
- The Act does not restate the GDPR; it fills the choices left to member states on children, special category data, and restrictions on rights.
- Part 6 sets how complaints, inquiries, enforcement notices, administrative fines, and offences work before the DPC and the courts.
- SmartSuite Privacy Management holds the Irish choices the Act adds to the GDPR, each with an owner, evidence, and a review date.
Overview
The Data Protection Act 2018 is the Irish statute that gives effect to the General Data Protection Regulation (GDPR) in Ireland, transposes the Law Enforcement Directive (EU 2016/680) for police and criminal justice processing, and establishes the Data Protection Commission (DPC). It binds every controller and processor subject to Irish data protection law, public and private, and has been in force since 25 May 2018.
The Houses of the Oireachtas enacted the Act in May 2018, and the DPC is the supervisory authority that enforces it (sections 10 and 11). The Act does not restate the GDPR. It fills the places where the GDPR leaves choices to member states: the age of a child, the special categories of data, restrictions on rights, and national enforcement procedure.
Organizations apply it together with the GDPR. They check Part 3 for the Irish rules on children, special category data and restrictions, and Part 6 for how complaints, inquiries, enforcement notices, administrative fines and offences work before the DPC and the courts.
Why does it matter?
Ireland is the lead supervisory authority for many multinational organizations, so the way the Act sets up the DPC and its enforcement powers shapes how GDPR disputes are handled across the European Union. Its Irish-specific rules also decide who counts as a child, when special category data may be processed and when data subject rights can be restricted.
Key benefits include:
- A child is anyone under 18
For the GDPR in the State, a child is a person under 18 (section 29), while the age for consent to information society services is 16 (section 31).
- Specific grounds for sensitive data
Chapter 2 of Part 3 sets the grounds for special category and criminal conviction data, for example employment and social welfare law (section 46) and insurance and pensions (section 50).
- Restrictions on rights
Section 60 restricts GDPR Articles 12 to 22 and 34 where necessary and proportionate, for example for national security, criminal investigation, tax administration or legal claims.
- A named regulator with real powers
The DPC can serve information notices, enforcement notices and search warrants and carry out investigations (sections 130 to 140).
- Criminal offences
Unauthorized disclosure by a processor and disclosure of personal data obtained without authority are offences carrying up to €50,000 or five years on indictment (sections 144 and 145).
How does it work?
The Act has eight Parts. Part 2 creates the DPC (sections 9 to 27). Part 3 applies the GDPR (sections 28 to 61). Part 4 deals with the transfer from the old Data Protection Commissioner (sections 62 to 68). Part 5 covers law enforcement processing under the Directive (sections 69 to 104). Part 6 sets out enforcement (sections 105 to 156). Part 7 has miscellaneous provisions on courts and judicial independence, and Part 8 amends other Acts.
A controller or processor handling a complaint-driven or own-initiative inquiry faces the process in sections 108 to 116: the DPC decides whether there is an infringement, may exercise corrective powers under section 115 and notifies its decision under section 116. A controller or processor can appeal an administrative fine to the court within 28 days (section 142), and the Circuit Court confirms an unappealed fine (section 143).
Part 5 applies to processing by competent authorities for the prevention, investigation, detection or prosecution of criminal offences. It has its own principles (sections 71 to 74), controller and processor duties (sections 75 to 88), rights (sections 89 to 95) and transfer rules (sections 96 to 100).
Key Elements
- Child and consent rules (sections 29 to 33)
A child is under 18, the digital age of consent is 16, and the Act deals with micro-targeting and profiling of children (section 30), codes of conduct (section 32) and the right to be forgotten for children (section 33).
- Lawful processing for public tasks (sections 38 to 44)
Processing is lawful where necessary and proportionate for a function conferred by an enactment (section 38). Other sections cover further processing (section 41), research and statistics (section 42), freedom of expression (section 43) and public access to official documents (section 44).
- Special categories and criminal data (sections 45 to 55)
The Act sets national grounds and safeguards for health, employment, insurance, public health, archiving and criminal conviction data, and requires suitable and specific measures (section 36).
- Data subject rights and restrictions (sections 56 to 61)
Provisions cover examination results (section 56), automated decision making (section 57), direct marketing (section 58) and the restrictions of section 60.
- Data Protection Commission (Part 2)
The Commission has up to three Commissioners (section 15), is the supervisory authority for the GDPR and the Directive (section 11) and reports annually (section 24).
- Administrative fines and appeals (sections 141 to 143)
The DPC acts under the Act and GDPR Article 83. For a public authority or body that does not act as an undertaking, a fine cannot exceed €1,000,000 (section 141(4)).
What does it cover?
The Act applies to controllers and processors subject to Irish data protection law, across the public and private sectors, and to the DPC's functions as supervisory authority. Part 3 covers GDPR processing and Part 5 covers processing by competent authorities for law enforcement purposes. Rules on political communications, elected representatives and processing by courts appear in Parts 3 and 7.
What are its objectives?
The Act supports the GDPR with Irish rules and with national enforcement procedure.
Name the Data Protection Commission as the Irish supervisory authority and set its powers.
Fix the Irish choices the GDPR leaves open, including the age of a child and the grounds for special category data.
Restrict data subject rights only where necessary and proportionate for listed public interest objectives.
Give the DPC clear procedures for complaints, inquiries, enforcement notices and administrative fines.
Apply data protection rules to law enforcement processing through Part 5.
Framework in Context
The Act sits beneath the EU GDPR and beside the Data Protection Acts 1988 and 2003, which it partly repealed and which it can be cited with as the Data Protection Acts 1988 to 2018 (section 1(2)). Part 5 implements the Law Enforcement Directive, and the Act's section numbers are specific to Ireland.
Common Framework Mappings
Organizations map complementary privacy and security frameworks to harmonize controls, address overlapping regulatory obligations, support cross‑jurisdictional compliance, and simplify integrated risk management and audit activities.
Mapped frameworks include:
APEC Privacy Framework
California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
EU General Data Protection Regulation (GDPR)
ISO/IEC 27001
ISO/IEC 27002
ISO/IEC 27701
NIST Privacy Framework
UK Data Protection Act 2018
How SmartSuite Supports Data Protection Act 2018 (Ireland)
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the Irish choices the Act adds to the GDPR in one record: the age thresholds, the sections 45 to 55 grounds for special category data and the section 60 restrictions you rely on, each with an owner, evidence and a review date.
Processing Record with Section Basis
Record each processing activity with its GDPR Article 6 and 9 basis and the Irish section relied on, such as section 38 or section 46.
Children's Data Register
Flag services that reach children under 18, record the age-16 consent check for information society services and the owner of each check (sections 29 and 31).
Restriction and Exemption Log
Log each use of a section 60 restriction with the objective relied on, the necessity and proportionality note and the approver.
Data Subject Request Workflow
Run access, erasure and objection requests with deadlines, restriction decisions and audit trail, including section 56 and 57 cases.
DPC Contact and Inquiry File
Keep information notices, enforcement notices, responses and the 28-day appeal dates (sections 132, 133 and 142) in one case record.
Processor and Disclosure Controls
Track processors, their authorizations and the section 144 and 145 disclosure rules, and report open actions to the privacy owner.
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27002:2022 is the reference set of 93 information security controls in four themes, with attributes and implementation guidance, that supports an ISO/IEC 27001 ISMS.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
Frequently Asked Questions For Ireland Data Protection Act 2018
No. The GDPR applies directly in Ireland. The Act gives effect to it where the GDPR leaves choices to member states, sets up the Data Protection Commission and provides national enforcement procedure. It also implements the Law Enforcement Directive in Part 5.
For the GDPR, a child is a person under 18 (section 29). The age of digital consent for information society services is 16 (section 31). The Act also covers micro-targeting and profiling of children (section 30).
The DPC can handle complaints, open inquiries of its own volition (section 110), serve information notices of at least 28 days and enforcement notices (sections 132 and 133), investigate (sections 137 to 140) and decide to impose administrative fines under GDPR Article 83 (section 141). A fine can be appealed to the court within 28 days (section 142).
Yes. A processor, or its employee or agent, that discloses personal data without the controller's authority commits an offence (section 144). So does a person who obtains personal data without authority and discloses it, or sells it (section 145). On indictment the penalty is a fine up to €50,000, imprisonment up to five years, or both.
Yes. Where the DPC fines a public authority or body that does not act as an undertaking under the Competition Act 2002, the fine cannot exceed €1,000,000 (section 141(4)).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.