Who We Are

What we do

Data Protection

The Data Protection Act 2018, which became law on 25 May 2018 established a new Data Protection Commission (DPC). The new Commission is the national independent supervisory authority in Ireland with responsibility for upholding the fundamental right of the individual to have their personal data protected.  The DPC’s statutory powers, functions and duties derive from the Data Protection Act 2018, General Data Protection Regulation, Law Enforcement Directive, as well as from the Data Protection Acts 1988 to 2003 which, inter alia, gives effect to Council of Europe Convention 108.

Using its statutory powers, the Data Protection Commission:

  • examines complaints from individuals in relation to potential infringements of data protection law;
  • conducts inquiries and investigations regarding infringements of data protection legislation and takes enforcement action where necessary;
  • promote awareness amongst members of the public of their rights to have their personal information protected under data protection law;
  • drives improved awareness and compliance with data protection legislation by data controllers and processors legislation through the publication of high-quality guidance, proactive engagement with public and private sector organisations;
  • through consultations with organisations, assists in identifying risks to personal data protection and offers guidance of best practice methods to mitigate against those risks; and
  • cooperates with (which includes sharing information with) other data protection authorities, and acts as Lead Supervisory Authority at EU level for organisations that have their main EU establishment in Ireland.

Regulation of Artificial Intelligence

The Regulation of Artificial Intelligence Act 2026, which was commenced, in part, on 31 July, 2026, gives further effect to the EU AI Act(2024). S.I. No. 366/2025  European Union (Artificial Intelligence) Regulations 2025 (as amended) designates the Data Protection Commission (DPC) as a market surveillance authority for certain purposes of the EU AI Act (2024).

The DPC is one of 15 national competent authorities in line with the Government’s adoption of a ‘distributed model’ to implement the EU AI Act (2024). As a market surveillance authority, the DPC will have certain functions and powers:

  • with respect to certain prohibited AI practices pursuant to Article 5 of the EU AI Act (2024)
  • with respect to certain High-risk AI systems pursuant to Article 6(2) of the EU AI Act (2024)
  • as a Notified Body for certain high-risk AI systems pursuant to Article 6(2) of the EU AI Act (2024)

Separate to its designation as a market surveillance authority, in October 2024 the Government identified the DPC as one of 9 fundamental rights authorities (FRAs). This provides FRAs with powers under the EU AI Act to fulfil their mandate as national public authorities responsible for protecting fundamental rights, in the case of the DPC, that of upholding the fundamental right of the individual to have their personal data protected.

Further information on the roles, responsibilities and functions of market surveillance authorities, and of fundamental rights authorities under the EU IA Act (2024) can be found on the website of the AI Office of Ireland - Oifig IS Na hÉireann.