{"text_format":"2","workbook":"xlsx","n_sheets":2,"sheets":["Coversheet","Global Data Privacy Guide"],"not_rendered":{"charts":0,"images":1,"macros":0,"external_links":0,"defined_names":0,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"run_cost":"one","rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Coversheet","index":0,"n_rows":12,"n_cols":3,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[]
[null,"Prepared By:","Contributors:"]
[null,"Arthur Cox","Colin Rooney"]
[]
[]
[]
["Global Data Privacy Guide"]
[]
["Report Generated: 11/19/2025"]
[]
["View your report results on next tab"]

{"sheet":"Global Data Privacy Guide","index":1,"n_rows":29,"n_cols":2,"rows_kept":29,"cut":false,"hidden":false,"merged":[]}
["Question","Ireland"]
["Key Legislation Overview"]
["1. What is the key legislation?","Since May 25, 2018, radical changes to data privacy laws in the European Union have come into effect. The \nGeneral Data Protection Regulation (\"\nGDPR\") has impacted businesses, regardless of whether they have a corporate presence in the EU or use EU-based assets to process data (which was the former test for EU data protection rules application). If a business offers goods or services to EU-based customers or monitors their behavior, it potentially is within the scope of the \nGDPR (\nplease see below for more details).\nThe extra-territorial reach means that, in practice, many businesses operating internationally need to adopt European data privacy standards, which are becoming the default global standards. The increased sanctions under the \nGDPR (up to 4% of global revenue or EUR 20 million, whichever is higher), together with general public expectations about data privacy, mean that compliance with data privacy laws cannot be treated as a minor regulatory issue. Potential fines and other penalties under the \nGDPR will put data privacy and cybersecurity at the same level as antitrust or anti-bribery and corruption programs on the corporate compliance agenda. This will require board-level awareness and leadership and the combined input from a range of professionals, including legal, IT, finance, procurement and vendor management and HR.\nThe \nGDPR is directly effective in all EU Member States without the need for further national legislation. However, the \nGDPR has specific areas in which the Member States are either permitted or required to enact national legislation to give effect to its provisions, for example, in relation to the procedure for imposing an administrative fine; the processing of special categories of personal data; the age of consent for processing personal data in the context of online services; and the restrictions and limitations on the application and exercise of data subject rights. \nMoreover, \nDirective 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (\nDirective on Privacy and Electronic Communications) (“\ne-Privacy Directive”) contains provisions regarding the protection of privacy on the Internet.\nIn Ireland, the \nGDPR is implemented by the D\nata Protection Act 2018, as amended, although the \nData Protection Acts 1988 to 2003 remain in force in certain respects. The \nData Protection Acts are complemented by \nS.I. No. 336 of 2011 - the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011, which transposes the \ne-Privacy Directive into Irish law.\n"]
["2. What are the key decisions applying that legislation?"," \n Court of Justice of the European Union (\"CJEU\"), No. C-311/18, Judgment of the Court, Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems, July 16, 2020 \n \n The CJEU upheld the validity of the European Commission's standard contractual clauses (\" SCCs \"), while indicating that, in order to use them, it is up to the data controller, where applicable in cooperation with the recipient of the transferred data, to assess whether, in practice and for the transfer envisaged, these SCCs ensure that the transferred data enjoy a level of protection essentially equivalent to that ensured in the European Union. If the effect of these clauses is limited or completely excluded by the legislation of the third country applicable to the transfer of such data, the data controller must implement additional measures to ensure the required level of data protection or notify the competent data protection authority of its intention to continue transferring data without these safeguards. \n The CJEU analyzed U.S. legislation on access to data from internet service providers and telecommunications companies by U.S. intelligence services ( Section 702 FISA and Executive Order 12 333 ). It concluded that the interference with the privacy of individuals whose data is processed by U.S. companies and operators subject to this legislation is disproportionate in relation to the requirements of the Charter of Fundamental Rights . In particular, the Court ruled that the collection of data by intelligence services is not proportionate and that the remedies, including judicial remedies, available to individuals with regard to the processing of their data are insufficient. The CJEU therefore invalidated the European Commission's adequacy decision. \n \n \n CJEU, No. C-131/12, Judgment of the Court, Google Spain SL and Google Inc. v. Spanish Data Protection Agency (AEPD) and Mario Costeja González, May 13, 2014 \n \n The CJEU has clarified that operators of internet search engines are now responsible for the processing of personal data appearing on web pages published by third parties. \n Every data subject has the right to obtain the removal of personal data concerning them, i.e., the operator of a search engine must, at the request of said data subject, remove from the list of results obtained following a search carried out using a person's name, links to web pages published by third parties containing information relating to that person. \n \n \n CJEU, No. C-673/17, Judgment of the Court, Federal Association of Consumer Organizations and Consumer Associations – Verbraucherzentrale Bundesverband eV v Planet49 GmbH, October 1, 2019 \n \n In the European Economic Area (\" EEA \"), users of websites and apps cannot be tracked using cookies or similar technologies without their specific consent through active behavior. Pre-ticked checkboxes are not sufficient to constitute consent. Users must also be informed of the possibility of third-party access to cookies and the lifetime of cookies.  \n \n \n CJEU, No. C-40/17, Judgment of the Court, Fashion ID GmbH & Co.KG v Verbraucherzentrale NRW eV, July 29, 2019   \n \n The manager of a website that inserts the Facebook “Like” button on said website becomes jointly responsible (with Facebook) for the processing of personal data of visitors to its website regarding the collection and transmission of such data to Facebook. If the manager wishes to rely on consent as a legal basis for processing, they must obtain it and inform visitors of their rights prior to the collection of data. \n \n \n CJEU, No. C-300/21, Judgment of the Court, UI v Österreichische Post AG, May 4, 2023   \n \n In the event of a breach of the GDPR , the right to compensation is subject to three cumulative conditions, which are as follows: (i) a breach of the GDPR , (ii) material or non-material damage resulting from that breach, and finally (iii) a causal link between the breach and the damage. Based on these three cumulative conditions, a simple breach does not in itself give rise to a right to compensation. Furthermore, the GDPR does not define the concept of “damage.” It merely states explicitly that both “material” and “moral” damage may give rise to a right to compensation, “without any threshold of seriousness being required” ( § 45 ). \n \n \n \n As the Data Protection Commission (the “ DPC ”) is the lead supervisory authority for a number of ‘big tech’ companies, there are a large number of DPC decisions relating to cross-border processing of personal data. For example:  \n Following the adoption of an EDPB Binding Decision dated 28 July 2021 (IN-18-12-2), the DPC imposed a fine of EUR 225 million on WhatsApp for failure to provide sufficient information to both users and non-users regarding its processing activities. Amongst other things, the DPC found that a controller must make available a description of the purpose of processing, the operation which the processing forms part of and its legal basis. The DPC also took issue with users having to navigate between linked documents on both WhatsApp and Facebook websites to understand how their data was being shared between both platforms.  \n On 2 May 2025, the DPC imposed a fine of EUR 530 million on TikTok for failure to ensure that transfers of EEA users’ personal data to China afforded an equivalent level of protection to that guaranteed in the EU. In particular, the DPC noted that TikTok did not address potential access by Chinese authorities under anti-terrorism, counterespionage and other laws. In addition to the fine, the DPC issued an order to suspend TikTok’s transfers to China unless processing is brought into compliance within six months. "]
["Key Data Protection Provisions"]
["1. How are “personal data” and “sensitive data” defined?","Personal DataThe \nGDPR regulates the processing of personal data within the meaning of Article 4.1 of the \nGDPR, i.e. any information relating to an individual who can be identified, either directly or indirectly, in particular by reference to an identifier such as a name, ID number, location data, online identifiers or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The \nGDPR does not apply, however, to fully anonymized or aggregated data where a living individual cannot be identified.\nSensitive DataSensitive data is a special category of personal data that is subject to a higher level of protection under Article 9.1 of the \nGDPR.\nThis includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.\nData relating to criminal convictions or offenses are subject to specific protection under the \nGDPR and may only be processed under the control of official authority or where authorized by Member State law providing for appropriate safeguards for the rights and freedoms of data subjects.\nIn Ireland, data relating to criminal convictions and offences may be processed in the circumstances set out in Section 55 of the \nData Protection Act 2018. This is subject to the implementation of \nSuitable and Specific Measures (“\nSSMs”) to safeguard the fundamental rights and freedoms of the data subject. Section 55 also provides for circumstances where this data may be processed under the control of official authorities. \nSection 55 also allows for the government to make regulations permitting the processing of personal data relating to criminal convictions or offences to be made where necessary and proportionate to prevent fraud, bribery and corruption or to ensure network and information systems security. The \nDPC must be consulted before such regulations are made and \nSSMs must be implemented.\n"]
["2. How is the defined data protected?"," Personal data and sensitive data are protected by the GDPR through a set of principles and technical obligations designed to ensure their confidentiality, integrity, and availability throughout their lifecycle. \n Under GDPR , processing of personal data is subject to: \n \n the main principles set forth in Article 5.1 of the GDPR : lawfulness, fairness and transparency; purpose limitation; data minimization and accuracy; storage limitation; and integrity and confidentiality; \n existence of a valid legal basis for the processing ( GDPR , Article 6); \n enhanced protection of sensitive data ( GDPR , Article 9); \n provision of complete and transparent information to data subjects ( GDPR , Articles 12 to 14); \n possibility given to data subjects to exercise their rights; \n data protection by design and by default ( GDPR , Article 25); \n documenting relations with data processors ( GDPR , Article 28); \n inclusion of the processing in a record of processing activities (as a data controller or processor) ( GDPR , Article 30); \n security obligations ( GDPR , Article 32); and \n notification of personal data breaches to he supervisory authority where there is a risk for the data subject ( GDPR , Article 33) and communication to the data subject when the risk is high ( GDPR , Article 34). \n \n All of these elements ensure optimal protection of the data collected. \n For detailed information on how this aspect of GDPR is enacted in Ireland, please contact  Arthur Cox directly.  "]
["3. Who is subject to privacy obligations?"," The GDPR’s obligations primarily apply to data controllers, defined as any natural person, corporate entity or other legal person, public authority, agency or other body that determines the purposes and means of data processing (alone or together with others). It also provides for certain direct obligations on data processors, which are any natural person, corporate entity or other legal person, public authority, agency or other body that processes personal data on behalf of the data controller.  \n The GDPR applies to: \n \n The processing of personal data in the context of the activities of a data controller’s or data processor’s establishment in the EU (i.e., implying the effective and real exercise of activity through stable arrangements), regardless of whether the data is processed in the EU or not or regardless of whether the data relates to EU residents or not.  \n The processing of personal data of persons within the EU by data controllers or data processors who are established outside the EU, where the processing is related to:\n \n the offering of goods or services to such data subjects in the EU (irrespective of whether payment is required); or \n the monitoring of the behavior of such data subjects as far as the behavior takes place in the EU. \n \n \n "]
["4. How is “data processing” defined?","In accordance with Article 4.2 of the \nGDPR, data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.\nThe processing of personal data is not necessarily computerized: paper files are also concerned and must be protected under the same conditions.\nData processing must have a \npurpose, a specific aim determined prior to the collection and use of the data.\n"]
["5. What are the principles applicable to personal data processing?"," Under the GDPR , a data controller must comply with the following principles under Article 5: \n \n Lawfulness, Fairness and Transparency – the data shall be processed lawfully (i.e., based on one of the six specified legal bases), fairly and in a transparent manner (e.g., pursuant to a privacy policy that meets the requirements of the  GDPR ) in relation to the data subject; \n Purpose Limitation – the data \n \n shall be collected for specified, explicit and legitimate purposes;  \n shall not be further processed in a manner incompatible with those purposes. \n \n \n Data Minimization – the data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed or are further processed; \n Accuracy – the data shall be accurate and, where necessary, kept up to date; \n Storage Limitation – the data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purpose for which the personal data is processed;  \n Integrity and Confidentiality – the data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures; and  \n Accountability – The data controller shall be responsible for and be able to demonstrate compliance with the above principles. \n "]
["6. How is the processing of personal data regulated?"," To be processed lawfully, the GDPR requires that personal data processing are based on one of the specified legal bases, which include the following: \n \n Consent \n \n Personal data may be processed based on the data subject’s specific, freely given and informed consent. \n \n such consent must be provided by way of “a statement or by a clear affirmative action”(pre-ticked boxes and implied consent fall short of the standard); \n Data subjects have the right to withdraw their consent at any time and in an easy manner. \n \n The controller is under an obligation to demonstrate the data subject’s consent where the processing is based on consent.   \n The controller is under an obligation to demonstrate the data subject’s consent where the processing is based on consent.   \n Consent from a child in relation to online services will only be valid if authorized by a parent or guardian. According to Article 8 of the GDPR , a child can consent from 16 years old, though the Member States may reduce this age to 13 years old.  \n In Ireland, the digital age of consent is 16 years old. \n \n Legitimate Interests \n \n A data controller may process personal data based on its legitimate interests or those of a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.   \n The data controller must, however, inform the data subject of the particular legitimate interest pursued and the data subject has the right to object to the legitimate interest-based processing on grounds particular to his or her situation (see Right of Objection below).  \n Public authorities may not rely on this legal basis in the performance of their tasks. \n \n Contractual Necessity \n \n Personal data may be processed where it is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering a contract. The processing must, however, be necessary to contract performance rather than merely facilitative.  \n \n Legal Obligation \n \n A data controller may process personal data where it is necessary to comply with a legal obligation to which it is subject.  \n \n Vital Interest of the Data Subject \n \n The data controller may process personal data where it is necessary to protect the vital interests of the data subject or another natural person.  \n \n Public Interest or in the exercise of Official Authority \n \n The data controller may process personal data where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.  \n Special Categories of Personal Data \n The processing of special categories of personal data is prohibited, except where it relies on one of the exceptions set out in Article 9: \n \n \n The data subject has given explicit consent; \n \n \n Processing is necessary for compliance with obligations or exercising rights under employment and social security and social protection laws, as set out in EU or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the rights and freedoms of data subjects; \n \n \n Processing is necessary to protect the vital interest of the data subject or another natural person where the data subject is physically or legally incapable of giving consent; \n \n \n Processing is carried out in the course of its legitimate activities with appropriate safeguards by a political, philosophical, religious or trade union foundation, association or not-for-profit body and relates to the personal data of its members, former members and persons in regular contact, only which are not disclosed outside without consent; \n \n \n The personal data processed are manifestly made public by the data subject; \n \n \n Processing is necessary for the establishment, exercise or defense of a legal claim or whenever courts are acting in their judicial capacity; \n \n \n Processing is necessary for reasons of substantial public interest on the basis of EU or Member State law, which is proportionate, respects the essence of the right to data protection and provides for suitable and specific measures to safeguard the rights and interests of the data subjects; \n \n \n Processing is necessary for the purposes of preventative or occupational medicine, medical diagnosis, provision of health or social care or treatment or management of health or social care systems and services on the basis of EU or Member State law or pursuant to a contract with a health professional; \n \n \n Processing is necessary for reasons of public interest in the area of public health on the basis of EU or Member State law; \n \n \n Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes on the basis of EU or Member State law. \n \n \n Member States may have further conditions with regard to the processing of genetic data, biometric data or data concerning health. \n In Ireland, the Data Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314/2018) prescribes a list of  Suitable and Specific Measures (“SSMs”) to be taken by controllers when processing personal data for health research purposes. This includes the requirement that explicit consent be obtained from the data subject. Controllers may be exempted from this requirement where they obtain a Committee Declaration that the public interest in carrying out the research significantly outweighs the public interest in requiring explicit consent.  \n In addition to these special categories of data mentioned in Article 9, Member States may also further determine the specific conditions for the processing of a national identification number or any other identifier of general application. \n For detailed information on how this aspect of GDPR is enacted in Ireland, please contact  Arthur Cox directly.  \n Risk-Based Approach  \n Data controllers must also have “appropriate technical and organizational measures” in place to ensure and to be able to demonstrate that processing is performed in accordance with the GDPR , taking a risk-based approach (Article 24). This requires that the controller takes account of the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons. The measures must be reviewed and updated where necessary and shall include the implementation of appropriate data protection policies.   \n Privacy by Design and Privacy by Default \n The GDPR also introduces new concepts of ‘privacy by design’ and ‘privacy by default’ under Article 25. This requires that a controller shall implement appropriate technical and organizational measures for ensuring that, by default, only personal data that are necessary for each specific purpose of the processing are processed. That obligation applies to: \n \n the amount of personal data collected; \n the extent of their processing; and  \n the period of their storage and their accessibility.  \n "]
["7. How are storage, security and retention of personal data regulated?"," The GDPR requires that “appropriate technical and organizational measures” are in place to protect the security of personal data and that personal data not be retained for longer than is necessary for the purpose or purposes for which the data are processed. \n Article 32 provides some detail on the standards that controllers and processors should take into account in determining appropriate security measures against unauthorized or unlawful processing, accidental damage, destruction or loss of data. The data controller must take into account: \n \n the state of the art;  \n the cost of implementing the measures;  \n the nature, scope, context and purposes of processing; and \n the risk of varying likelihood and severity for rights and freedoms of the data subject posed by the processing, in particular, those presented against unauthorized or unlawful processing, accidental damage, destruction or loss of data. \n \n The GDPR notably states that pseudonymization and encryption should be considered where appropriate and that controllers maintain system resilience and security testing, backup, recovery and continuity measures. \n Data controllers and data processors must ensure all of their employees comply with the security measures in place and not process personal data other than on the instructions of the controller. \n Personal data may not be kept for longer than is necessary for the specified purpose or purposes for which it was collected and a data retention procedure or policy should be implemented in this respect.  "]
["8. What are the data subjects' rights under the data legislation?","Under the \nGDPR, data subjects have enhanced rights in relation to their personal data, most of which only apply in specific circumstances. \nThe data controller shall provide information on action taken on a request within one month of receipt, which period may be extended by two further months where necessary, taking account of the complexity and number of requests and provided that the controller informs the data subject of such extension within one month of the request. \nWhere requests are manifestly unfounded or excessive, in particular, because of their repetitive character, the data controller may charge a “reasonable fee based on administrative costs” or refuse the request.\nRight of Access The data subject can ask a data controller for a copy of his or her personal data being processed by the data controller. \nRight of Rectification The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her and to have incomplete personal data completed.\nRight of ErasureIn certain circumstances, the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay.\nRight of Restriction of ProcessingThe data subject has the right to obtain from the controller restriction (i.e. suspension) of the processing in certain circumstances, such as where the accuracy of the data is being contested, the processing is unlawful or the data subject has objected to the processing. \nRight to Data PortabilityThe right to data portability of personal data is the right to receive the personal data provided by the data subject to the controller (on the basis of consent or contractual necessity) in a structured, commonly used and machine-readable format and to transmit that data to another controller.\nRight to ObjectThe data subject has the right to object, on grounds relating to his or her particular situation, to the processing of the personal data based on the performance of a task carried out in the public interest or for the legitimate interests of the controller or a third party.\nThe controller must no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. \nWhere personal data is processed for direct marketing purposes, the data subject has the right to object to the processing of his personal data at any time.\nAutomated Decisions with Legal or Significant EffectsData subjects have a right not to be subject to automated decision-making in respect of the personal data, including profiling, with no human intervention where such a decision produces legal effects concerning the data subject or similarly significantly affects him or her (e.g., creditworthiness check or e-recruitment). This does not apply where explicit consent is provided, the processing is authorized by EU or Member State law or the processing is necessary for the purposes of entering into or performing a contract with the data subject. \nIn Ireland, Section 33 of the \nData Protection Act 2018 provides, in certain circumstances, a specific right to be forgotten to children (persons under 16) regarding personal data collected in relation to the offer of information society services. \nFor detailed information on how this aspect of GDPR is enacted in Ireland, please contact Arthur Cox directly. "]
["9. What are the consent requirements for data subjects?"," \n Consent is one of the legal bases provided for by the GDPR on which the processing of personal data may be based. It is defined in Article 4.11 of the GDPR as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. \n The consent of the individual is systematically required for certain types of processing, which are governed by specific legal provisions: for example, to carry out commercial prospecting by email. Under Article 7 of the GDPR , four cumulative criteria must be met for consent to be valid. Consent must be: \n \n Free: consent must not be coerced or influenced. The individual must be offered a genuine choice, without suffering any negative consequences if they refuse; \n Specific: consent must correspond to a single processing operation for a specific purpose; \n Informed: to be valid, consent must be accompanied by a certain amount of information communicated to the person before they consent (the identity of the data controller, the purposes pursued, the categories of data collected, the existence of a right to withdraw consent, where applicable: the fact that the data will be used in the context of automated individual decisions or that it will be transferred to a country outside the European Union); \n Unambiguous: consent must be given by a clear statement or other affirmative act. There must be no ambiguity as to the expression of consent. For example, the following methods of obtaining consent cannot be considered unambiguous: pre-ticked or pre-activated boxes, “bundled” consent (where a single consent is requested for several separate processing operations), or inaction (e.g., failure to respond to an email requesting consent). \n \n The data subject has the right to withdraw consent, and as such, they must be able to withdraw their consent at any time, using a method that is as simple as the method used to obtain consent (for example, if consent was obtained online, it must also be possible to withdraw consent online). \n In addition, the data controller must be able to demonstrate at any time that the individual has given valid consent. To do so, the data controller must document the conditions under which consent was obtained. \n When the child is under 16 years of age, processing is only lawful if consent is given or authorized by the holder of parental responsibility over the child. The  GDPR allows Member States to vary the age below which consent must be given by parents between 13 and 16 years. \n In Ireland, the age of digital consent is 16.  \n Section 41 of the Data Protection Act 2018 provides for the processing of data for a purpose other than the purpose for which it was originally collected, to the extent that such processing is necessary and proportionate to prevent a threat to national security, to prevent, detect, investigate or prosecute criminal offences or for the purpose of legal advice or proceedings. \n For detailed information on how this aspect of GDPR is enacted in Ireland, please contact  Arthur Cox directly.  "]
["10. How is authorization for use of data handled?","Authorization to use personal data is managed through the selection and justification of a legal basis for each processing operation and, in certain cases, through the collection of explicit consent.\nThe \nGDPR requires that all processing of personal data be based on at least one of the six legal bases provided for in Article 6.\nAuthorization to use data does not therefore necessarily imply consent from the data subject, provided that the use is based on another legal basis provided for in Article 6.\nIn the case that an entity that has collected data wishes to reuse it for purposes other than those initially specified, the consent of the data subject must be obtained again.\nThe use of consent boxes that are checked by default is prohibited. Furthermore, silence on the part of the person concerned (e.g., the person visits the website without accepting or refusing cookies) does not constitute consent.\n"]
["11. Are cross-border data transfers regulated? If so, what are the restrictions on cross-border data transfers?"," The GDPR also restricts the transfer of personal data to a country outside the European Economic Area (\" EEA \") unless certain conditions or safeguards are in place.  \n Transfer to Adequate Countries Outside the EEA \n Transfers of data to a third country or international organization are permitted where the European Commission has taken an adequacy decision under Article 45 of the GDPR that there is an adequate level of protection of personal data in that country or organization. \n The existing list of countries that have been approved by the EU Commission will remain in force. Transfers of personal data to the following countries can take place without too much concern: \n \n Andorra \n Argentina \n Canada (partial adequacy decision for personal data transferred to recipients subject to the Canadian Personal Information Protection and Electronic Documents Act 2000 )  \n Faroe Islands \n Guernsey \n Israel \n Japan \n Jersey \n New Zealand \n Republic of Korea \n Switzerland \n The Isle of Man \n United Kingdom \n Uruguay \n \n While the Privacy Shield was a partial adequacy decision covering transfers to organizations that complied with the Privacy Shield Principles in the United States, it has been invalidated by the decision of the European Court of Justice in case C-311/18 dated 16 July 2020 (\" Schrems II decision \") and is not applicable anymore. \n In the wake of the invalidation of the Privacy Shield , the European Commission issued an adequacy decision for the EU–US Data Privacy Framework (“ DPF ”). Such transfers can occur freely with U.S. companies that are certified under the DPF , without needing additional safeguards. However, some concerns were raised regarding the consequences of the U.S. surveillance laws, and there is a belief that the DPF might be invalidated by the European Court of Justice. \n Transfer to Non-Adequate Countries \n Where the country to which the personal data will be transferred does not appear on an approved list of countries (such as the transfer to U.S. companies not certified under the DPF ), the transfer of personal data can still take place only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies are available.  \n The appropriate safeguards may be provided by: \n \n a legally binding and enforceable instrument between public authorities or bodies;  \n binding corporate rules in accordance with Article 47;  \n so-called standard contractual clauses adopted by the European Commission or the supervisory authority, which incorporate the EU standards into the contract; \n an approved code of conduct pursuant to Article 40, together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards; or \n an approved certification mechanism pursuant to Article 42, together with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards;  \n binding corporate rules pursuant to Article 47. \n \n The standard contractual clauses are the most commonly used appropriate safeguard mechanism. However, according to the  Schrems II decision , controllers relying on standard contractual clauses or BCRs are required to verify, on a case-by-case basis and, where appropriate, in collaboration with the recipient of the data in the third country, if the law of the third country ensures a level of protection of the personal data transferred that is essentially equivalent to that guaranteed in the European Economic Area. Where necessary, supplementary measures (i.e., legal, technical or organizational measures) have to be implemented to ensure such an essentially equivalent level of protection. \n The GDPR also provides for derogations to the prohibition of personal data transfers, for instance, where the data subject has explicitly consented to the transfer, after having been informed of the possible risks due to the absence of an adequacy decision.  "]
["12. How are data \"incidents\" and \"breaches\" defined?","The \nGDPR does not relate to “incidents” related to personal data, but to “breaches”, i.e., any security incident, whether malicious or not, and occurring intentionally or unintentionally, that compromises the integrity, confidentiality, or availability of personal data.\nIn accordance with Article 4.12 of the \nGDPR, a personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. \n"]
["13. Are there any notification requirements for incidents and/or data breaches?","The \nGDPR introduces a compulsory requirement for controllers to report data breaches to the competent national supervisory authority(ies) (please see below) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to data subjects.  \nA risk assessment will, therefore, need to be taken by the controller in evaluating whether the obligation to report arises. Where a breach poses a high risk to data subjects, the \nGDPR also requires that the controller communicate the breach to the affected data subjects without undue delay. Regardless of whether notification to the regulator is made or not, controllers must document all personal data breaches, comprising the facts, its effects and remedial action taken. \nWhere a processor has suffered a personal data breach, the processor must notify the controller “without undue delay” after becoming aware of the breach.\nProviders of publicly available electronic communications services in public communications networks in the EU are subject to a mandatory reporting obligation in accordance with \nEU Regulation No 611/2013.\n"]
["14. Who is/are the privacy regulator(s)?"," Supervisory Authority \n Article 55, GDPR , provides that each national supervisory authority has the competence to act in relation to matters in its territory. In Ireland, the supervisory authority is the Data Protection Commission (“ DPC ”): Homepage | Data Protection Commission .  \n Lead Supervisory Authority \n In circumstances where a controller or a processor is engaged in “cross-border processing” (being the processing of personal data which takes place in the context of activities of establishments of that controller or processor in more than one Member State or processing which substantially affects or is likely to substantially affect data subjects in more than one Member State), then the supervisory authority of the main or single establishment of the controller or processor shall have the competence to act in respect of such cross-border processing. \n Tasks and Powers of a Supervisory Authority \n The GDPR provides for enhanced, wide-ranging powers of enforcement to supervisory authorities, who may impose substantial fines for breaches of the GDPR .  \n The tasks of a supervisory authority are set out in Article 57 of the GDPR and include, among others: \n \n monitoring and enforcing the application of the GDPR ;  \n promoting awareness; \n handling complaints;  \n conducting investigations; \n cooperating with other supervisory authorities; \n administrative tasks such as drawing up codes of conduct, reviewing certifications and approving standard contractual clauses for transfers of personal data outside the EEA .  \n \n The powers of a supervisory authority are set out in Article 58 and include, among others: \n \n ordering the production of information from controllers and processors; \n conducting investigations in the form of audits, including onsite investigations; \n issuing warnings, reprimands, and enforcement orders,  \n ordering the suspension or ban of non-compliant processing activities; \n the imposition of administrative fines; and \n advising, for example, in relation to high-risk processing or issuing opinions. \n \n The European Data Protection Board ensures that EU rules designed to protect data are applied consistently across all EU countries, so that all citizens have the same rights, regardless of where they live. \n Finally, the European Commission and the CJEU contribute to the interpretation and enforcement of the GDPR . "]
["15. What are the consequences of a data breach?"," Administrative Fines \n The imposition of administrative fines by a supervisory authority is subject to appropriate procedural safeguards in accordance with Union or Member State law and therefore, the mechanism and procedure for imposing a fine may vary from Member State to Member State. \n For detailed information on how this aspect of GDPR is enacted in Ireland, please contact  Arthur Cox directly.  \n In Ireland, the power of the Commission to impose an administrative fine is set out in Section 141 of the Data Protection Act 2018 . Note that this section limits administrative fines on public authorities and bodies that do not act as an undertaking within the meaning of the Competition Act 2002 to EUR 1 million. \n The level of administrative fines is set out in Article 83, together with examples of aggravating and mitigating factors in determining whether to impose a fine and, if so, the level of such fine. In each case, the supervisory authority is to ensure that the imposition of fines is effective, proportionate and dissuasive. The amount of a fine depends on the nature of the infringement in question, with the applicable thresholds being up to: \n \n 2% of the total global annual turnover of an undertaking for the preceding financial year or EUR 10,000,000, whichever is higher; or \n 4% of the total global annual turnover of an undertaking for the preceding financial year or EUR 20,000,000, whichever is higher. \n "]
["16. How is electronic marketing regulated?","Direct marketing to individuals is currently regulated at a Member State level under national legislation that gives effect to the \ne-Privacy Directive (\"\nDirective 2002/58/EC\"). \nThe use of publicly available electronic communications services to send unsolicited communications or to make unsolicited calls for the purpose of direct marketing is restricted. Generally, such communications by electronic means require consent or are subject to a right to opt out.\nIn Ireland, the \nEuropean Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 require consent to send direct marketing emails (including SMS and other text, voice, sound, or image messages). Exceptions exist where i) communications are sent to an existing customer promoting similar products or services to those already purchased by the customer or ii) the email communication is sent in a business-to-business relationship to a business-related email address. With respect to (i), this exception does not apply where the recipient has informed the sender that they do not consent to receiving such messages.\nIn January 2017, the European Commission published its proposal for an \ne-Privacy Regulation, which will replace and modernize the existing \ne-Privacy Directive and should particularize and complement the \nGDPR as its \nlex specialis on the protection of privacy and confidentiality of electronic communications. On February 10, 2021, the Council of the European Union finally agreed on a draft text of the\n e-Privacy Regulation, along with a mandate for its Presidency to start negotiations with the European Parliament in order to reach a consensus thereon. The 1st political trilogue concerning the ePrivacy regulation took place on May 20, 2021, under the Portuguese Presidency. The e-Privacy scope of application is set to have a broader reach than the \nGDPR, as inter alia concerns EU end-users – to whom electronic communications data (including both the content and metadata thereof) refer – regardless of whether they are natural or legal persons. On February 11, 2025, the European Commission disclosed in the “\n2025 Work Programme” that it will withdraw the proposal for a new \ne-Privacy Regulation (replacing the current \ne-Privacy Directive). The current \ne-Privacy Directive and its national transposition laws will remain in force.\nFor detailed information on how this aspect of GDPR is enacted in Ireland, please contact Arthur Cox directly. "]
["17.\tAre there sector-specific or industry-specific privacy requirements?","Healthcare sector In accordance with Article 9.1 of the \nGDPR, the processing of health data is prohibited in principle, except in the specific cases provided for in Article 9.2.\nIn Ireland, the \nData Protection Act 2018 (Section 36(2)) (Health Research) Regulations 2018 (S.I. No. 314/2018) prescribes a list of \nSpecific and Suitable Measures (“\nSSMs”) to be taken by controllers when processing personal data for health research purposes. This includes the requirement that explicit consent be obtained from the data subject. Controllers may be exempted from this requirement where they obtain a Committee Declaration that the public interest in carrying out the research significantly outweighs the public interest in requiring explicit consent. \nSection 50 of the \n2018 Act provides for the processing of health data where it is necessary and proportionate for the purposes of policies of insurance or life assurance, health insurance, pension arrangements or the mortgaging of property. \nSSMs must be taken. \nJudicial sectorIn Ireland, data relating to criminal convictions and offences may be processed in the circumstances set out in Section 55 of the \nData Protection Act 2018. Regulations permitting the processing of personal data relating to criminal convictions or offences may also be made where necessary and proportionate to prevent fraud, bribery and corruption or to ensure network and information systems security. \n"]
["18.\tWhat are the requirements for appointing Data Protection Officers or similar roles?"," Article 37 of the GDPR sets out the procedures for appointing a Data Protection Officer (\" DPO \"). \n This appointment is mandatory when: \n \n The processing is carried out by a public authority or body, except for courts acting in their judicial capacity;  \n The core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or  \n The core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10. \n \n The DPO must have legal and technical expertise in personal data protection and a good understanding of the business sector, internal organization, particularly processing operations, information systems, and data protection and security requirements. \n In addition, the DPO must have sufficient resources to perform their duties (Article 38.2, GDPR ), which means that they must: \n \n be involved in all matters relating to personal data protection; \n have sufficient time to perform their duties; \n have adequate material and human resources; \n have access to relevant information; \n be able to maintain their specialized knowledge; \n be easily accessible to the persons concerned. \n \n Finally, the DPO must be able to act independently (Article 38.3, GDPR ), which means: \n \n not being in a conflict of interest if their role as a delegate is combined with another role; \n be able to report on their actions to the highest level of the organization's management; \n not be penalized for performing their duties as a delegate; \n not receive instructions in the performance of their duties as a delegate. \n \n The tasks assigned to the DPO are detailed in Article 39 of the GDPR and mainly involve advising, informing, monitoring, and managing relations with supervisory authorities. "]
["19.\tWhat are the record-keeping and documentation obligations?"," Under the GDPR , archiving and documentation obligations are part of the principle of accountability, which means that every organization must be able to demonstrate its compliance with the GDPR at any time, imposing specific requirements for document retention and maintenance. \n Any entity that processes data must document and regularly update its records demonstrating compliance with the GDPR . \n It is necessary to document the processing of personal data in the following documents: \n \n Records of data processing activities (both for data controllers and data processors) (Article 30, GDPR ); \n DPIA s for, if applicable,  processing operations likely to result in high risks to the rights and freedoms of individuals (Article 35, GDPR ); \n Where there are data transfers outside the European Union, appropriate documentation, depending on the context of such transfer, e.g., standard contractual clauses, BCRs, and certifications (Articles 28 and 42, GDPR ). \n \n It is also necessary to keep the information provided to data subjects, the templates used to obtain consent from data subjects, and the procedures put in place for data subjects to exercise their rights. \n Finally, contracts that define the roles and responsibilities of those involved in processing must also be archived, including contracts with subcontractors, internal procedures in the event of data breaches (Article 33, GDPR ), and evidence that data subjects have given their consent when the processing of their data is based on this basis. \n With regard to the archiving of personal data, Article 5.1(e) GDPR imposes a limited retention period for data, i.e., a period not exceeding that necessary for the purposes for which they are processed. These retention periods must be documented in the processing records, internal document management policies, and information notices to data subjects. "]
["20.\tWhat are the requirements for conducting Data Protection Impact Assessments (DPIAs)?"," Article 35 of the GDPR requires that a Data Protection Impact Assessment (\" DPIA \") be carried out when a type of processing, in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons. \n The DPIA is carried out by the data controller, in collaboration with the DPO (if a DPO has been appointed). If a data processor is involved in the processing, they must provide assistance and the information necessary to carry out the DPIA . \n The DPIA shall be required in particular in the following cases: \n \n a systematic and extensive evaluation of personal aspects relating to natural persons, which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;  \n processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or  \n a systematic monitoring of a publicly accessible area on a large scale.  \n \n In addition, if the processing meets at least two of the nine criteria set out in the G29 Guidelines , a DPIA is mandatory: \n \n evaluation/scoring (including profiling); \n automated decision-making with legal or similar effects; \n systematic monitoring; \n collection of sensitive or highly personal data; \n large-scale collection of personal data; \n cross-referencing of data; \n vulnerable individuals (patients, elderly people, children, etc.); \n innovative use (use of new technology); \n exclusion from the enjoyment of a right or contract. \n \n In Ireland, the DPC ’s Guide to DPIAs contains an additional ten types of processing operations for which a DPIA is required. \n For detailed information on how this aspect of GDPR is enacted in Ireland, please contact  Arthur Cox directly.  \n The DPIA shall contain at least: \n \n a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller; \n an assessment of the necessity and proportionality of the processing operations in relation to the purposes;  \n an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and \n the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this regulation, taking into account the rights and legitimate interests of data subjects and other persons concerned.  \n \n The DPIA must be conducted before processing operations begin. It should be started as early as possible and updated throughout the treatment cycle. \n It is also necessary to review the  DPIA regularly to ensure that the level of risk remains acceptable throughout the treatment, as the environment, particularly the technical environment, will evolve, requiring adjustments to the measures implemented. \n In Ireland, where a DPIA suggests that identified risks cannot be managed and the risk remains high, controllers must consult with the DPC before moving forward with the project and commencing the processing. \n For detailed information on how this aspect of GDPR is enacted in Ireland, please contact  Arthur Cox directly.  "]
["21.\tWhat are the requirements for third-party vendor management and data sharing?"," In the context of the GDPR , a third-party vendor refers to any external entity that processes personal data on behalf of another organisation. This may include cloud service providers, marketing agencies, payment processors, and IT support companies, among others. As these vendors handle personal data, they become an extension of the organisation and must adhere to the same compliance requirements. \n Cases where the third-party vendor is considered a data processor: \n \n The third-party vendor may be considered a data processor if it processes personal data solely in accordance with the instructions of the data controller and does not use the data for its own purposes (hosting, customer support, emailing, data analysis). \n A third-party vendor may only reuse personal data for its own purposes if such reuse is compatible with the initial processing and the data controller has given its written authorization. \n This entity can be considered a subcontractor as defined in Article 4 of the GDPR , i.e., a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.  \n \n Cases where a third-party vendor cannot be considered a data processor: \n \n The third-party vendor may be considered an independent data controller if it decides on the purposes and means of the processing itself or if it is jointly responsible for the processing with the data controller (advertising service provider that collects data for its own targeting purposes). \n In this case, the third-party vendor must obtain the consent of the data subjects in order to legally use their data for a purpose other than that initially intended. \n \n In all cases, before entering into a contract with the third-party vendor, you must: \n \n assess its level of security and compliance (certifications); \n ensure that appropriate technical and organizational measures are in place; \n analyze the risks associated with the processing (nature and sensitivity of the data, purposes, transfers abroad); \n in the event of international transfers, ensure that guarantees equivalent to those of the GDPR are in place; \n ensure that an effective data breach management policy is in place (rapid notification, obligation to cooperate, security tools). \n "]
["22.\tWhat are the penalties and enforcement mechanisms for non-compliance?","Article 83 of the \nGDPR sets out the general conditions for supervisory authorities to impose administrative fines on controllers or processors of up to EUR 20,000,000 or 4% of the total worldwide annual turnover of the preceding financial year, whichever is higher.\nIn Ireland, Section 127 of the \nData Protection Act 2018 provides for the (non-monetary) corrective powers of the \nDPC upon conclusion of an inquiry. \nThe Act also outlines several criminal offences. Summary offences carry a maximum penalty of EUR 5,000 and/or 12 months imprisonment, while the maximum penalty for indictable offences is EUR 250,000 and/or five years imprisonment. \nFor detailed information on how this aspect of GDPR is enacted in Ireland, please contact Arthur Cox directly. "]
["23.\tWhat are the ongoing compliance and audit requirements?","The \nGDPR does not impose any obligation to carry out a compliance audit, unlike \nDPIA, which may be mandatory in certain situations.\nHowever, Articles 5 and 24 of the \nGDPR impose a principle of accountability on data controllers. As such, they must implement appropriate technical and organizational measures and must be able to demonstrate compliance with the processing at any time.\nThus, the implementation of regular internal audits ensures that the obligations imposed by the \nGDPR are being met and identifies any unauthorized practices so that they can be stopped.\nIn the event that the data controller uses a subcontractor, the latter must make available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller (Article 28.3(h) \nGDPR).\nFinally, data protection authorities have a right similar to an audit right, allowing them to monitor an entity's compliance and request the provision of documents to prove it (Article 58 of the \nGDPR).\n"]
["24. Are there any recent developments or expected reforms?","In Ireland, the \nDPC published its \nChildren Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing (“\nthe Fundamentals”) in December 2021. \nThe Fundamentals identify 14 key principles for processing children’s data, give guidance on obligations under the \nGDPR and outline how children may exercise their data protection rights. The 14 principles establish the baseline expectations of the \nDPC for organisations processing children’s data under the \nGDPR.\nThe Fundamentals apply to both online and offline organisations, whose services are directed at, intended for, or are likely to be accessed by children. Where a service is accessed by children, an organization can choose to provide a “floor of protection” so that all users are provided with the same level of protection regardless of age. Alternatively, organisations may take a risk-based approach to verifying users’ age so that the Fundamentals are only applied in respect of child users.\nThe Fundamentals provide a list of data protection by design and default measures that the \nDPC considers appropriate in the context of children’s data. Whether a measure is mandatory will vary depending on the nature of the processing activity. \nIn 2023, the \nDPC issued a fine to TikTok (EUR 345 million) for failure to adequately protect the data of child users. Features found to be in breach included child user accounts being public by default, a failure to ensure that adult users overseeing the accounts of child users were verified as parents or guardians and the use of dark patterns to nudge child users towards more privacy-intrusive settings. \nIn 2022, the \nDPC issued a fine to Meta Platforms Ireland Limited (EUR 405 million) with respect to the processing of personal data of child users in the context of the Instagram platform. The \nDPC’s inquiry considered Instagram’s registration system that, at times, meant the accounts of child users were set to “public” by default. The \nDPC’s inquiry also considered that child users were allowed to operate “business accounts” on the platform and that at certain times, the operation of such accounts required and/or facilitated the publication of the child user’s phone number and/or email address. \nOn 14 August 2025, the \nDPC opened a new inquiry into Children’s Health Ireland (\"\nCHI\") regarding the physical safety and security of children’s health records.\nThe European Commission issued a project of reform of the \nGDPR on 21 May 2025, which would notably exempt some data processors from the obligation to hold a record of data processing. This would apply to data processors who have less than 750 employees, and subject that the processing is not likely to result in high risk for the rights and freedoms of data subjects.\nFor detailed information on how this aspect of GDPR is enacted in Ireland, please contact Arthur Cox directly. "]