Does GDPR apply to sole traders in Ireland?
Last updated 30 October 2026. General information only, not legal advice.
Yes. GDPR applies to sole traders in Ireland whenever they handle personal data as part of their business. There is no exemption for small or one-person businesses. The only carve-out is for purely personal or household activity, and that does not cover customer, client or supplier details used in a trade or profession.
Why a sole trader is still a data controller
GDPR applies to anyone who decides how and why personal data is processed. The Data Protection Commission (DPC) defines a controller as a person, company or other body that makes those decisions. A sole trader who keeps customer names and contact details, takes bookings, sends invoices or runs a mailing list is acting as a controller.
The household exemption in Article 2(2)(c) GDPR covers processing in a purely personal or household context. The DPC says it applies only where the data is not used in connection with a professional or commercial activity. Once data is used for your trade, the exemption falls away.
What sole traders need to do
The size of the business affects how much work is involved, not whether the rules apply. In practice a sole trader should:
- know what personal data they hold, why, and on what lawful basis;
- tell people how their data is used, usually through a privacy notice (see our guide to a privacy policy and cookie policy for an Irish website);
- keep the data secure and delete it when it is no longer needed;
- respond to requests from individuals about their data, and report personal data breaches where required;
- have written terms with suppliers who handle personal data for them, such as cloud, payroll or booking providers.
Our GDPR guide for small businesses in Ireland covers these steps in more detail.
Do sole traders need a DPO or a record of processing?
Most sole traders do not need a Data Protection Officer, because that depends on activities such as large-scale monitoring or large-scale special-category data. The record-keeping duty in Article 30 does not apply to organisations with fewer than 250 employees unless the processing is likely to risk individuals’ rights and freedoms, is not occasional, or includes special-category or criminal-offence data. A sole trader handling health information on a regular basis, for example, may therefore still need one.
Need help with this? Plus Promotions Limited provides GDPR compliance services for Irish businesses, with projects from €995.
FAQ
Does GDPR apply to sole traders in Ireland?
Yes. A sole trader who processes personal data for their business is a data controller and must follow GDPR. The household exemption does not apply to professional or commercial use.
Does a sole trader need a privacy notice?
Generally yes, if they collect personal data from customers, clients or website visitors. People must be told who is collecting their data, why, and what their rights are.
Can a sole trader be fined under GDPR?
Yes. Fines can apply to any controller, whatever its size. The DPC considers factors such as the nature and seriousness of the infringement. See our guide to GDPR fines in Ireland.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
