Laws and data licensing
Ireland: privacy laws and AI data licensing
Short answer
If your records include people in Ireland, the main rules are: EU GDPR plus the Data Protection Act 2018.
In short
- Country
- Ireland
- Main privacy laws
- EU GDPR plus the Data Protection Act 2018.
- Note
- Many large tech companies' EU regulator.
- Last reviewed
- 2026-10-09
- 01Your work records
- 02Personal details removed
- 03You approve the release
- 04Licensed to AI developers
What to know#
Many large tech companies' EU regulator.
For suppliers#
- SourceX works with businesses based in Ireland, and their records may include customers abroad
- Records tied to other countries are reviewed against their rules or excluded
- Personal details are removed before anything is shared
Which regulator oversees Irish records: the DPC or another EU authority?#
The Data Protection Commission (DPC) is Ireland's regulator, and for cross-border processing it is the lead authority for an organisation whose main EU establishment is in Ireland. Under the GDPR one-stop-shop, that organisation deals with one lead supervisory authority, and the lead role covers people across the EU, not only people in Ireland.
The main establishment is generally where decisions about the purposes and means of processing are made. An Irish subsidiary that only executes decisions taken elsewhere may not make the DPC the lead authority, so the answer depends on where the licensing decision is actually taken.
The Irish supervisory authority also asked the European Data Protection Board for the opinion that became Opinion 28/2024, which covers when an AI model can be considered anonymous and legitimate interest as a legal basis for developing or using AI models.
What does Ireland's Data Protection Act 2018 add to GDPR for reused records?#
The Act fills in the choices GDPR leaves to each member state; it does not create a general route to reuse records for a new commercial purpose. Reuse is still judged under GDPR's lawful basis and purpose rules. The national provisions below are the ones most likely to affect a dataset. They are cited from the Irish Statute Book as of 13 October 2026, with Section 31 and the Regulations in their original 2018 text, so check for later amendments.
| Provision | What it says | Why it matters for a dataset |
|---|---|---|
| Section 41 | Makes processing for a purpose other than the one data was collected for lawful to the extent necessary and proportionate for listed aims such as national security and preventing or prosecuting crime | It is not a basis for licensing records; reuse still has to pass GDPR's own tests |
| Section 31 | Sets 16 as the age for a child's own consent to information society services under GDPR Article 8 | Consent collected from under-16 users of an online service without parental consent may not support reuse |
| Health Research Regulations 2018 | Make explicit consent the default safeguard for health research, unless the Health Research Consent Declaration Committee grants a declaration that consent is not required | Health research records are tied to the consent or declaration they were gathered under |
| Main establishment test (GDPR one-stop-shop) | An organisation with its main EU establishment in Ireland has the DPC as lead authority for cross-border processing | The DPC's guidance and decisions are the ones to read first |
How can personal data from Ireland reach a U.S. recipient?#
Personal data can go to a U.S. organisation that is certified under the EU-U.S. Data Privacy Framework (DPF); otherwise the usual route is the EU standard contractual clauses (SCCs). The Commission adopted the DPF adequacy decision on 10 July 2023. It covers only U.S. organisations that self-certify, re-certify every year and appear on the public Data Privacy Framework List, so check the recipient's listing before relying on it.
The General Court dismissed a challenge to the DPF on 3 September 2025 (Latombe v Commission, T-553/23). An appeal to the Court of Justice (C-703/25 P) was lodged on 31 October 2025, so check its status before relying on the framework for a long contract.
The DPC enforces these rules. In its decision of 12 May 2023 it fined Meta Platforms Ireland 1.2 billion euros and ordered the transfers suspended, finding that the company's use of SCCs for certain Facebook transfers to the U.S. did not comply with GDPR. Meta has appealed.
| Route | When it fits | What to check |
|---|---|---|
| DPF adequacy | The U.S. recipient is listed as active on the Data Privacy Framework List | Listing status and annual re-certification |
| SCCs, Module 1 (controller to controller) | The recipient decides how it uses the data and is not DPF-listed | A transfer impact assessment, as the clauses require |
| SCCs, Module 2 (controller to processor) | A U.S. vendor processes the data only on the exporter's instructions | The Article 28 processor terms are built into the module |
| Anonymised data | No one in the data is identifiable by means reasonably likely to be used | Whether the source data or a key is kept; if so, the output may only be pseudonymised, not anonymised |
What should an Irish dataset owner check before licensing records?#
Most of the work is the same as for any GDPR dataset; the Irish points are the lead authority, the national age and health research rules, and the DPC's view of anonymisation. The DPC treats data as anonymised only when people are not identifiable by any means reasonably likely to be used. If the source data is not deleted, the output may only be pseudonymised rather than anonymised, and the DPC guidance prescribes no particular technique.
- Confirm where the decision to license is made, and so whether the DPC is the lead authority
- Record the lawful basis and the original purpose for each source system
- Flag records from online services used by under-16s and check how consent was obtained
- Separate any health research data and check its consent or consent declaration
- Decide whether the output will be anonymised or pseudonymised, and whether source data or keys are kept
- Pick the transfer route for any personal data going outside the EU, and confirm a DPF listing on the day of signing
- Have counsel review the specific facts; this summary is general information, not legal advice
Sources for this section
- The DPC acts as lead supervisory authority under the GDPR one-stop-shop for organisations whose main EU establishment is in Ireland. Source
- EDPB Opinion 28/2024, requested by the Irish supervisory authority, covers AI model anonymity and legitimate interest. Source
- Section 41 of the Data Protection Act 2018 makes processing for a new purpose lawful to the extent necessary and proportionate for listed aims. Source
- Section 31 of the Data Protection Act 2018 sets 16 as the age for GDPR Article 8 consent in Ireland. Source
- The Health Research Regulations 2018 make explicit consent the default safeguard for health research, with consent declarations as an alternative. Source
- The Commission adopted the EU-U.S. Data Privacy Framework adequacy decision on 10 July 2023; U.S. organisations self-certify and re-certify annually. Source
- A U.S. organisation must self-certify to the DPF Principles and be on the Data Privacy Framework List to rely on the DPF. Source
- The General Court dismissed the Latombe challenge to the DPF on 3 September 2025. Source
- An appeal against the Latombe judgment (C-703/25 P) was lodged with the Court of Justice on 31 October 2025. Source
- The DPC fined Meta Platforms Ireland 1.2 billion euros on 12 May 2023 over U.S. transfers made on SCCs and ordered them suspended. Source
- The 2021 SCCs use modules by role, build in Article 28 processor terms and require a transfer impact assessment. Source
- The DPC treats data as anonymised only when no one is identifiable by means reasonably likely to be used; if source data is kept, the output may only be pseudonymised. Source
Frequently asked questions
Which privacy laws apply to records about people in Ireland?
EU GDPR plus the Data Protection Act 2018. Many large tech companies' EU regulator.
Can a company based in Ireland license its data through SourceX?
Yes. SourceX works with companies based in Ireland, and U.S. companies are its priority. Records are reviewed against the rules that apply, and personal details are removed before anything is shared.
Can a U.S. business license records that include customers in Ireland?
Records tied to Ireland are reviewed against its rules or excluded from the license, and personal details are removed before anything is shared.
What happens to records that cannot be cleared?
Records that can't be cleared under the rules that apply are excluded, and the company approves every release before data moves.
General information, not legal advice. Laws change and their application depends on your facts. SourceX assesses which rules apply deal by deal with your counsel. Last reviewed 2026-10-09.