Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Ireland enforces GDPR through the Data Protection Commission, a particularly consequential regulator given how many US Big Tech EU headquarters sit in Dublin. NIS2 remains untransposed as of September 2026; the National Cyber Security Bill was still at committee stage in mid-2026, and the EU has referred Ireland to the CJEU over the delay.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in Ireland without transposition.
SourceIreland's national data protection act, which gives further effect to GDPR and establishes the Data Protection Commission's powers.
Source72 hours
GDPR Article 33 applies uniformly: notify the DPC without undue delay and, where feasible, within 72 hours of becoming aware of a breach.
Notify: Data Protection Commission (DPC)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceApplicable , as of 2026-09-08
Not yet transposed as of September 2026. Ireland missed the 17 October 2024 EU deadline; the National Cyber Security Bill 2024 (which transposes NIS2, puts the NCSC on a statutory footing, and designates CSIRT-IE) remained at committee stage in the Oireachtas as of mid-2026. On 8 July 2026 the European Commission referred Ireland (with Spain, France, and the Netherlands) to the CJEU for failure to notify complete transposition. In the meantime, NIS1 continues to apply to existing Operators of Essential Services, and the NCSC is issuing preparatory board-level guidance and a CyFun risk-management framework.
SourceData Protection Commission(DPC)
Visit authority siteNo, not as of September 2026. The National Cyber Security Bill 2024 remains at committee stage in the Oireachtas. The EU referred Ireland to the CJEU on 8 July 2026 over the delay, and the government has signaled it expects to notify transposition by the end of 2026.
The Data Protection Commission (DPC), Ireland's independent GDPR supervisory authority, which is also the lead regulator for many multinational tech companies with EU headquarters in Dublin under GDPR's one-stop-shop mechanism.
Existing Operators of Essential Services remain subject to the original NIS1 regime until the National Cyber Security Bill is enacted. The NCSC is also issuing preparatory guidance so organizations can prepare ahead of the new law.
Talk to us about scoping an engagement around your specific regulatory context.
