🙌 We were delighted to participate in the Privacy Laws & Business conference “Ireland and EU Privacy/Digital Laws: New Horizons” last week. Commissioner for Data Protection Des Hogan and the DPC contributed to a number of panels, alongside a keynote address by European Commissioner Michael McGrath.

✍ Our blog shows you what to do when you become aware that your personal data is being used by unauthorised third parties, as well as how to recognise and reduce those risks. Take a look 👉 www.dataprotection.ie/en/dpc-guida...

🔎 Case Study This complaint concerned an incident at a workplace carpark and the CCTV images which were then viewed in the context of disciplinary proceedings. 👉 https://www.dataprotection.ie/en/dpc-guidance/case-studies/objection-to-processing/processing-necessary-purpose-performance-contract

📣 We have announced our final decision following an inquiry into a series of personal data breaches at Permanent TSB (PTSB). The DPC's decision found that PTSB infringed the GDPR and has reprimanded PTSB and issued fines totalling €277,500. 👇 Our press release www.dataprotection.ie/en/news-medi...

GDPR and Subject Access Request FAQs: How long does an organisation have to respond to my access request❓

📢 We have opened an inquiry into Infinite Styles Services Co. Ltd. (SHEIN Ireland) under Section 110 of the Data Protection Act 2018. The inquiry concerns SHEIN Ireland’s transfers of personal data of EU/EEA data subjects to China. 🔗 dataprotection.ie/en/news-medi...

Our GDPR self-assessment checklist tool aims to help organisations identify where immediate remedial actions are required in order to be compliant with the GDPR. 📋 https://www.dataprotection.ie/en/organisations/resources-organisations/self-assessment-checklist

🏆 Winners! We are thrilled to announce our Pause Before You Post video and campaign has won two awards at the Global Social Media Awards 2026. We won 🥇gold for Best Charity/ Not-for-Profit Campaign and 🥈silver for Most Impactful Social Media Campaign.

📣 ICYMI: We’ve redesigned our website so that the summaries and full text of our decisions are more easily searchable and accessible. Now you can search and explore our published decisions and filter by sector, topic and/or Article of the GDPR. Take a look! 👀

Case Study 🔎 This complaint arose from a request to have an email address on an account changed. The complainant made the request via the controller’s online chat and was informed that an ID to authenticate account ownership would be required in order to proceed with the request. Take a look! 👇

This week DPC Commissioner Dale Sunderland and Deputy Commissioner Graham Doyle participated in a number of events and meetings at the 2026 Privacy Symposium in Venice. #PrivacySymposium #PSC25

⚖️ Explore summaries and full text of decisions published by the Data Protection Commission. Our New Decisions Page 👇 https://dataprotection.ie/en/dpc-guidance/decisions

🧑‍⚕️ Health insurance companies sometimes request information directly from a GP so that medical costs and services can be paid. How does this work under the GDPR❓ https://www.dataprotection.ie/en/faqs/banking-insurance-sector/can-my-insurance-company-request-copy-my-full-medical-records-my-gp

A Data Protection Officer should have an appropriate level of expertise in data protection law and practices to enable them to carry out their role. Take a look at our guidance on the appropriate qualifications for DPOs to learn more 👇 https://www.dataprotection.ie/en/dpos/qualifications-dpos

📘 Codes of Conduct are voluntary sets of rules that assist with compliance and accountability in specific sectors or relating to particular processing operations. Codes of conduct and certification mechanisms under the GDPR explained ℹ️ https://www.dataprotection.ie/en/organisations/codes-conduct

📸 This blog goes through the common queries we receive from schools, parents and even photographers about taking photos at school events. Take a look and remember to ⏸️#PauseBeforeYouPost https://dataprotection.ie/en/dpc-guidance/blogs/taking-photos-school-events-where-common-sense-comes-play

Principles of Data Protection 🛡️ 👉 https://dataprotection.ie/en/organisations/data-protection-basics/principles-data-protection Data controllers must take responsibility for their processing of personal data, how they comply with the GDPR, and they must be able to demonstrate their compliance.

Principles of Data Security: A data controller has a duty to limit access to personal data on a "need to know" basis, with greater limitations on more sensitive data. Read our guide to Data Security: https://www.dataprotection.ie/en/organisations/know-your-obligations/data-security-guidance

We are delighted that our Pause Before You appear video and campaign has been nominated in 2 categories at the Global Social Media Awards 2026. We have been nominated in the ‘Best Charity/Not-for-Profit Campaign’ and ‘Most Impactful Social Media Campaign’ !

📷 At large events it is advisable to have notices in place advising attendees of the intention to take photos etc. Our FAQs 👉 https://www.dataprotection.ie/en/faqs/topical-data-protection-issues/when-i-am-attending-public-event-can-organisers-take-promotional-photographs-me-without-my-consent

Under the GDPR, certain organisations are required to appoint a designated Data Protection Officer (DPO). Organisations are also required to publish the details of their DPO and provide these details to their national supervisory authority.

🔎 This complaint arose from a workplace investigation regarding allegations made by the complainant against a colleague and the subsequent access request they made. 👉 https://www.dataprotection.ie/en/dpc-guidance/case-studies/access-request-complaints/processing-context-workplace-investigation

Case Study 📋 Confidential Expressions of Opinion and Subject Access Requests: https://www.dataprotection.ie/en/dpc-guidance/case-studies/access-request-complaints/confidential-expressions-opinion-and-subject-access-requests#opinion

🌍 The transfer of personal data from the EU to outside the EU should not undermine the level of protection of the individuals concerned. Read our guide: https://www.dataprotection.ie/en/organisations/international-transfers/transfers-personal-data-third-countries-or-international-organisations

🔒 Organisations are required to report personal data breaches to the DPC where the breach presents a risk to the individuals affected, without undue delay. FAQ 🔗 https://www.dataprotection.ie/en/faqs/responsibilities-data-controllers/what-do-i-do-if-there-security-breach

📝 This blog examines the right of access under the GDPR and how the DPC handles complaints from individuals who are concerned that organisations have not addressed their Subject Access Requests appropriately. Take a look! www.dataprotection.ie/en/dpc-guida...

Lá Fhéile Pádraig Sona ón gCoimisiún um Chosaint Sonraí. Happy St. Patrick's Day from the Data Protection Commission. #LáFhéilePádraig #StPatricksDay

🔔 ☎️ Helpdesk Update. From Monday, 16 March our phonelines will be open weekdays between 9.30am – 1.00pm. All of our contact details are available here on our website here 👉 https://www.dataprotection.ie/en/contact/how-contact-us

❓ Ceisteanna Coitianta - Fianáin 🍪 Tá suíomh Gréasáin nó aip ag iarraidh orm toiliú le fianáin – cé na roghanna atá agam? ❓ FAQs - Cookies 🍪 I am being asked by a website or app to consent to cookies – what choice do I have?

Gach uair go roinneann tú a saol ar líne, tá tú i mbaol a sonraí pearsanta a roinnt leis an domhan. Déan machnamh roimh phostáil. #SeachtainNaGaeilge #PauseBeforeYouPost

Tá sé de cheart ag gach duine cosaint sonraí pearsanta a bhaineann leis nó léi: https://www.dataprotection.ie/ga/individuals/cearta-daoine-aonair-faoin-rialachan-ginearalta-um-chosaint-sonrai

🔔 ☎️ Helpdesk Update. From Monday, 16 March our phonelines will be open weekdays between 9.30am – 1.00pm. All of our contact details are available here on our website here 👉 https://www.dataprotection.ie/en/contact/how-contact-us

🎉 Wishing everyone a happy International Women’s Day from the Data Protection Commission

It was great to meet our Canadian colleagues Stephan Luciw and Harpreet Bains. Stephan and Harpreet work with the Information and Privacy Commissioner of Ontario @ipcontario.bsky.social and both made a visit to our Dublin office this week. A lovely opportunity to exchange ideas and perspectives!

Bhain an gearán seo le freagra, a líomhnaítear a bheith neamhiomlán, ar iarratas rochtana le haghaidh píosa scannáin TCI a rinne an gearánach chuig institiúid oideachais. 🔗 https://www.dataprotection.ie/ga/dpc-guidance/case-studies/access-request-complaints/rochtain-ar-phiosa-scannain-tci

Le linn Seachtain na Gaeilge, gheobhaidh tú níos mó eolais (as Gaeilge) maidir le bunrudaí cosanta sonraí, cearta daoine aonair faoin GDPR, agus feidhmiú do chearta, ag https://www.dataprotection.ie/ga/individuals

🔔 Latest News The Data Protection Commission Announces Conclusion of Inquiry into University of Limerick

The Data Protection Commission (DPC), as part of the Digital Regulators Group (DRG), welcomes the publication of Digital Ireland – Connecting our People, Securing our Future, the National Digital & AI Strategy 2030. 👉 dataprotection.ie/en/news-medi...

Topical FAQ 🙋 📷 There is nothing in the GDPR that prohibits people from taking photos in a public place. However, what you do with that photo can potentially become a data protection issue, e.g. if the photograph was sold for commercial gain or was posted publicly on a social media account.

Commissioner Des Hogan outlined our role in engaging and advising on AI systems from tech companies. Since 2021, we have engaged with approximately 180 AI products and services, often before reaching market. Commissioner Hogan’s remarks came during today’s Joint Committee on AI.

Join us for an information webinar on our 🛠️ Data Protection Toolkit for Schools, tailored for school leadership at primary and post-primary levels. This workshop will offer practical guidance and a space for common queries and challenges. ✍️ Register now at https://blackrockesc.ie/

📣The DPC welcomes the publication of the EDPB report on the implementation of its Coordinated Enforcement Framework (CEF) action on the right to be forgotten. For more: https://dataprotection.ie/en/news-media/latest-news/dpc-welcomes-publication-edpb-cef-implementation-report-right-be-forgotten

DPC Deputy Commissioner, Graham Doyle commenting on the announcement today of our inquiry into X Internet Unlimited Company (XIUC)

The Data Protection Commission (DPC) has opened an inquiry into X Internet Unlimited Company (XIUC) under section 110 of the Data Protection Act 2018

Any processing of personal data is only lawful where it has what is known as a ‘legal basis’. Some of the specific rights granted to data subjects under the GDPR only apply where processing is justified by particular legal bases. See our table for a quick guide!

Case Study 🔍 Use of a Personal Email in Work. 📩 This case study shows how strict rules should be in place prohibiting employees from sending work related correspondence to their personal email under any circumstances.

🚘📸 In many cases, data protection issues can arise for dash cam owners. This guidance aims to assist owners in understanding any obligations they may have under the GDPR. Using a dash cam? Have a read 👇 https://www.dataprotection.ie/en/dpc-guidance/guidance-drivers-use-dash-cams#Dash%20Cams

AI is a growing part of everyday life, for both young and old. This Safer Internet Day, we've put together 5 practical tips to help young people navigate AI safely. Download and share our new infographic created in collaboration with @cnam-ie.bsky.social #SaferInternetDay2026 #AIAware

Access requests should generally be 🆓 of charge. However, where requests are considered ‘manifestly unfounded or excessive’, the data controller may charge a reasonable fee. Learn more here 👉 https://www.dataprotection.ie/en/individuals/exercising-your-rights/what-will-it-cost

Case Study 🔍 This complaint concerned the processing of the complainant's personal data - details about a medical condition - by his employer, for the purpose of administering the complainant's sick leave and related payments. 👉 www.dataprotection.ie/en/dpc-guida...