GDPR Checklist for Irish Businesses 2026 — The Complete Guide

If you run a business in Ireland — whether it is a sole trader, a startup, or a well-established SME — the General Data Protection Regulation (GDPR) applies to you. Since the regulation came into force in May 2018, the Data Protection Commission (DPC) has steadily increased its enforcement activity, and 2026 is no exception.

This guide provides a practical, plain-English checklist that Irish business owners can work through to assess and improve their GDPR compliance posture.

Why GDPR Compliance Matters in 2026

The DPC issued over €3.5 billion in fines across the EU in the years since GDPR took effect, with Ireland being a focal point due to the number of multinational tech companies headquartered here. But enforcement is no longer limited to big tech. In 2025 and into 2026, the DPC has turned its attention to SMEs, healthcare providers, and local service businesses.

Non-compliance can result in:

• Fines of up to €20 million or 4% of annual global turnover, whichever is higher
• Enforcement notices requiring you to stop processing data
• Reputational damage and loss of customer trust
• Civil claims from affected individuals

The Checklist

1. Know What Personal Data You Hold

Before you can protect data, you need to know what you have. Conduct a data mapping exercise:

• List every type of personal data you collect (names, emails, phone numbers, payment details, IP addresses)
• Identify where this data is stored (CRM, email provider, spreadsheets, paper files)
• Document who has access to the data internally
• Record any third parties you share data with (payment processors, email marketing tools, accountants)

This exercise forms the basis of your Record of Processing Activities (ROPA), which is a legal requirement under Article 30 of GDPR for most businesses.

2. Establish a Lawful Basis for Each Processing Activity

GDPR requires that every instance of personal data processing has a valid legal basis. The six lawful bases are:

• Consent — the individual has given clear, informed consent
• Contract — processing is necessary to fulfil a contract with the individual
• Legal obligation — processing is required by law
• Vital interests — processing is necessary to protect someone's life
• Public task — processing is necessary for a task in the public interest
• Legitimate interests — processing is necessary for your legitimate interests, balanced against the individual's rights

For most Irish SMEs, the most commonly relied-upon bases are consent, contract, and legitimate interests. Document which basis applies to each processing activity.

3. Update Your Privacy Policy

Your privacy policy must be written in clear, plain language and must include:

• Your identity and contact details
• The types of personal data you collect
• The purposes and lawful basis for each type of processing
• Any third parties you share data with
• Data retention periods
• Individual rights (access, rectification, erasure, portability, objection)
• How to lodge a complaint with the DPC

Review your privacy policy at least annually or whenever your processing activities change.

4. Implement Proper Consent Mechanisms

If you rely on consent as a lawful basis — for example, for email marketing — the consent must be:

• Freely given (no pre-ticked boxes)
• Specific (separate consent for separate purposes)
• Informed (the person knows what they are consenting to)
• Unambiguous (a clear affirmative action)
• Easy to withdraw at any time

Cookie consent is a related but separate issue governed by the ePrivacy Directive (as transposed into Irish law by SI 336 of 2011). You must obtain consent before setting non-essential cookies.

5. Secure the Data You Hold

GDPR Article 32 requires you to implement "appropriate technical and organisational measures" to protect personal data. Practical steps include:

• Use strong, unique passwords and enable two-factor authentication
• Encrypt personal data at rest and in transit
• Keep software and systems up to date
• Restrict access to personal data on a need-to-know basis
• Use secure, GDPR-compliant cloud providers
• Regularly back up data and test your backups

6. Prepare a Data Breach Response Plan

Under GDPR, you must report certain data breaches to the DPC within 72 hours. You should:

• Define what constitutes a data breach in your organisation
• Assign roles and responsibilities for breach response
• Create a step-by-step response procedure
• Prepare template notification letters for the DPC and affected individuals
• Log all breaches, even those that do not need to be reported

The DPC's breach notification form is available on their website at dataprotection.ie.

7. Conduct Data Protection Impact Assessments (DPIAs)

A DPIA is required when processing is likely to result in a high risk to individuals' rights and freedoms. Common triggers include:

• Large-scale processing of sensitive data
• Systematic monitoring of a publicly accessible area (e.g., CCTV)
• Automated decision-making that produces legal or similarly significant effects

Even when a DPIA is not strictly required, it is good practice to conduct one for any new project or system that involves personal data.

8. Manage Your Third-Party Processors

If you use third-party services that process personal data on your behalf (e.g., a payroll provider, email marketing platform, or cloud storage service), you must have a Data Processing Agreement (DPA) in place with each one.

The DPA must specify:

• The subject matter and duration of processing
• The nature and purpose of processing
• The types of personal data involved
• Your rights to audit the processor's compliance

9. Train Your Staff

Human error is the leading cause of data breaches. All staff who handle personal data should receive GDPR awareness training covering:

• What personal data is and why it matters
• Your company's data protection policies and procedures
• How to recognise and report a data breach
• The consequences of non-compliance

Training should be refreshed annually and documented for compliance records.

10. Appoint a Data Protection Officer (If Required)

You must appoint a DPO if your core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special categories of data. Even if not required, appointing a privacy lead or point of contact is strongly recommended.

Take the Next Step

Unsure where your business stands? Our free GDPR readiness quiz takes five minutes and gives you an instant compliance score with personalised recommendations.