GDPR Compliance Checklist for Irish SMEs (2026)
Last updated 12 October 2026. General information only, not legal advice.
If you run or manage a small or medium-sized business in Ireland, GDPR applies to you whenever you handle information about identifiable people: customers, staff, job applicants, suppliers’ contacts or website visitors. This checklist turns the Data Protection Commission’s (DPC) guidance for SMEs into a practical list you can work through. It is a starting point for a compliance review, not a guarantee of compliance.
Who this checklist is for
The GDPR and the Data Protection Act 2018 apply to businesses of every size. There is no general exemption for small firms, although some obligations scale with risk. The DPC publishes a guidance note for SMEs that sets out the key steps, each tied to a GDPR article. The checklist below follows that structure.
1. Know what personal data you hold
Map your data
List the personal data you collect, where it comes from, where it is stored, who sees it and who you share it with. Include paper files, email, cloud tools, CCTV and your website.
Keep a record of processing (Article 30)
Article 30 requires a written record of processing activities. Article 30(5) exempts organisations with fewer than 250 employees only if the processing is occasional, unlikely to result in a risk to individuals, and does not include special-category or criminal-offence data. In practice most businesses that process payroll, HR or customer data regularly should keep a record. See our GDPR guide for small businesses.
2. Confirm your lawful basis and be transparent
Lawful basis (Articles 6 to 9)
For each activity, identify one of the six lawful bases in Article 6 (consent, contract, legal obligation, vital interests, public task or legitimate interests). Special-category data such as health data needs an additional condition under Article 9. Where you rely on consent, it must be freely given, specific, informed and unambiguous, and you must be able to show it and let people withdraw it.
Privacy notices (Articles 12 to 14)
Tell people who you are, why you use their data, your lawful basis, how long you keep it, who receives it and what rights they have. Review your website and employee notices, and your cookie banner and policy.
3. Apply the core principles (Article 5)
Collect only what you need, use it for the stated purpose, keep it accurate, and keep it no longer than necessary. A written retention schedule, with secure deletion when periods expire, is one of the easiest gaps to close.
4. Secure the data (Article 32)
Security must be appropriate to the risk. Typical measures include access controls, encryption of laptops and mobile devices, multi-factor authentication, backups, patching, secure disposal of paper and staff training. Name a person responsible for security and incidents.
5. Be ready for a personal data breach (Articles 33 and 34)
If a breach is likely to result in a risk to individuals, you must notify the DPC without undue delay and, where feasible, within 72 hours of becoming aware of it. If the risk is high, you must also tell the affected individuals. All breaches must be documented, whether or not they are reported. Keep a simple incident response plan, and see our 72-hour data breach response guide.
6. Respect individuals’ rights (Articles 12 to 22)
People can ask for access, correction, erasure, restriction, portability and can object to certain processing. Under Article 12(3) you must respond without undue delay and in any event within one month of receiving the request. That can be extended by up to two further months where requests are complex or numerous, but you must tell the person about the extension, with reasons, within the first month. Make sure staff can recognise a request and know where to send it.
7. Manage suppliers and transfers
Processors (Article 28)
If a supplier handles personal data on your behalf (payroll, IT support, cloud hosting, mailing platforms), you need a written contract containing the Article 28 terms. Check that your suppliers’ contracts are in place.
Transfers outside the EEA (Articles 44 to 49)
Identify any transfers outside the EEA, including to cloud providers. You need a valid transfer mechanism, such as an adequacy decision or standard contractual clauses.
8. Decide whether you need a DPO or a DPIA
Data Protection Officer (Article 37)
A DPO is mandatory for public bodies, for organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, and for those whose core activities involve large-scale processing of special-category or criminal-offence data. If you decide you do not need one, record your reasoning. Read our guide on whether you need a Data Protection Officer.
Data Protection Impact Assessment (Article 35)
A DPIA is required before processing that is likely to result in a high risk to individuals. Article 35(3) gives examples: systematic and extensive profiling that produces significant effects, large-scale processing of special-category or criminal-offence data, and large-scale systematic monitoring of a publicly accessible area. New technology can also trigger one. Build a short screening step into new projects.
9. Document and review
Keep policies, training records, breach logs and decisions in one place and review them at least annually. Regulators look for evidence of accountability (Article 5(2) and Article 24), not just policies on paper. The fines framework in Article 83 allows penalties of up to €20 million or 4% of worldwide annual turnover for the most serious infringements, and up to €10 million or 2% for others, whichever is higher.
More guides are available in our GDPR and data protection hub.
Need help with this? Plus Promotions Limited provides GDPR audit and gap analysis for Irish businesses, from €495.
Frequently asked questions
What is a GDPR compliance checklist?
It is a structured list of the steps a business takes to meet its obligations under GDPR: mapping data, choosing lawful bases, informing people, securing data, handling breaches and requests, and documenting decisions.
Does a small business in Ireland need to comply with GDPR?
Yes. GDPR applies to any organisation that processes personal data, regardless of size. Some obligations, such as record-keeping, have limited exemptions for smaller organisations.
Do SMEs need a record of processing activities?
Often yes. The Article 30(5) exemption for organisations under 250 employees does not apply if the processing is more than occasional, is likely to pose a risk, or includes special-category data.
How quickly must a data breach be reported to the DPC?
Without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals.
Does my business need a Data Protection Officer?
Only if Article 37 applies, for example large-scale regular monitoring or large-scale special-category data. Many SMEs do not need one but should document that decision.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
