GDPR Compliance for Irish SMEs: What You Actually Need

Yuli O’Grady, Solicitor

Law Society of Ireland Regulated · Reviewed March 2025

Reviewed by a qualified Law Society regulated Irish solicitor for accuracy and compliance with Irish law.

GDPR has been in force since 2018, but many Irish SMEs still don’t have full compliance in place. The Data Protection Commission (DPC) is one of the most active data protection regulators in Europe. Here’s what you actually need.

Does GDPR Apply to My Small Business?

Yes — if you process any personal data of EU residents (including your own customers’ email addresses), GDPR applies regardless of business size. There are no SME exemptions, only slightly reduced obligations for businesses with fewer than 250 employees.

The GDPR Compliance Checklist for Irish SMEs

Privacy policy — on your website, covering what data you collect and why
Cookie consent — compliant banner with genuine opt-in for non-essential cookies
Data Processing Agreements — with every third-party processor (Mailchimp, Stripe, Google Analytics, etc.)
Lawful basis — documented reason for each type of data processing
Subject Access Request procedure — how you’ll respond within 30 days
Data breach plan — 72-hour notification requirement to the DPC

What Are the Penalties?

The DPC can fine up to €20 million or 4% of global annual turnover for serious violations. For most SMEs, the realistic risk is smaller fines, enforcement notices, and reputational damage — but non-compliance is not worth the risk.

Our GDPR solicitors offer a full compliance audit from €395 fixed fee.

GDPR Compliance for Irish SMEs: What You Actually Need