🇮🇪Data Protection Act 2018

← Back to laws in Ireland

Data Protection Act 2018

Ireland applies this national law alongside the GDPR. The summary below concentrates on the national overlay so that the GDPR baseline is not duplicated.

How the national law fits with GDPR

The Act gives further effect to the GDPR, establishes and empowers the DPC, and sets national rules for children, special-category data, expression, research, public functions and rights restrictions.

National additions and variations

• Section 31 retains 16 as the Article 8 age for consent to information-society services and excludes preventative or counselling services from that definition for this purpose.
• Sections 36 and 45-55 define suitable and specific safeguards and national routes for employment, insurance, health, public-health, research, electoral and criminal-data processing.
• Health research is also subject to regulations made under section 36; the Act should not be used without those current regulations.
• Section 40 regulates constituency-case processing by elected representatives, including access limitations and necessity and proportionality safeguards.
• Section 43 balances data protection with journalistic, academic, artistic and literary expression; section 60 and regulations provide specified rights restrictions.

Operational approach

First maintain the GDPR control set. Then document whether this country is in scope and apply the national controls to the affected people, systems and processing. Keep article-level evidence for child consent, employment, special-category or criminal data, research, electronic communications, identifiers, surveillance and any rights restriction relied upon.