GDPR Fines in Ireland: How Much Can the DPC Fine Your Business? (2026)
Last updated 9 October 2026. General information only, not legal advice.
Ireland is home to the European headquarters of many of the world’s largest technology companies — and the Irish Data Protection Commission (DPC) has become one of the most significant GDPR regulators in the EU. Understanding how GDPR fines work, what triggers DPC investigations, and how to keep your business compliant is essential for any Irish business handling personal data in 2026.
Key points
- Under Article 83 of the GDPR, the maximum fine is up to €10 million or 2% of worldwide annual turnover (lower tier), or up to €20 million or 4% (upper tier). For an undertaking, the higher figure applies.
- These are maximums, not set amounts. The DPC weighs factors such as seriousness, duration, number of people affected, cooperation and whether you reported the breach.
- The DPC has fined organisations of very different sizes, from €1,500 against a small organisation to €530 million against a global platform.
- A DPC fine does not become payable until it is confirmed by the court, and it can be appealed.
- Notify the DPC of a qualifying personal data breach within 72 hours of becoming aware of it.
GDPR Fine Tiers
GDPR provides for two tiers of administrative fines:
Lower Tier — Up to €10 million or 2% of global annual turnover
This tier applies to infringements including:
- Failure to implement appropriate technical and organisational security measures
- Failure to conduct a Data Protection Impact Assessment (DPIA) where required
- Failure to appoint a Data Protection Officer (DPO) where required
- Failure to notify the DPC of a personal data breach within 72 hours
- Failure to maintain records of processing activities
Upper Tier — Up to €20 million or 4% of global annual turnover
This tier applies to more serious infringements including:
- Failure to have a lawful basis for processing personal data
- Breaches of the core data protection principles (fairness, transparency, purpose limitation, data minimisation)
- Violations of data subject rights (access, erasure, rectification, portability)
- Unlawful transfer of personal data to third countries
- Failure to obtain valid consent where consent is the lawful basis
Recent DPC Enforcement Actions
The DPC has issued some of the largest GDPR fines globally, predominantly against major technology companies. Notable fines include very substantial penalties against global platforms for unlawful data transfers and consent failures. However, the DPC also investigates and fines smaller organisations — Irish SMEs are not immune from enforcement.
Examples of DPC Fines
The DPC publishes a list of its fines on dataprotection.ie. Examples from that list show how wide the range is:
- TikTok Technology Limited: €530 million (April 2025), following an inquiry into transfers of user data to China.
- Google: €403 million (September 2026), relating to the processing of location data.
- Department of Social Protection: €550,000 (June 2025).
- Midlands Regional Hospital Tullamore: €300,000 (June 2026).
- Slane Credit Union: €5,000 (January 2022) and MOVE Ireland: €1,500 (August 2021).
The DPC has also fined public bodies, hospitals, universities and local authorities, so this is not only a big technology issue. Figures are taken from the DPC fines page and are correct as of 9 October 2026; check the DPC site for the current list.
When a fine is actually payable
According to the DPC, a fine does not become payable until a court confirms it. If there is no appeal, the DPC applies to the Circuit Court to confirm the fine. If the decision is appealed, the fine cannot be collected while the appeal is pending. Once confirmed, the DPC issues a payment notice requiring payment in full within 28 days.
The DPC annual report for 2025 recorded 16,160 new cases from individuals (up 45% on 2024) and 6,521 valid breach notifications. For more on breach duties, see our 72-hour data breach response guide.
What Triggers a DPC Investigation?
DPC investigations can be triggered by:
- A complaint from an individual whose data rights they believe have been violated
- A personal data breach notification (organisations must self-report serious breaches within 72 hours)
- A DPC own-initiative inquiry
- Cross-border cases referred from other EU data protection authorities
How to Reduce Your GDPR Risk
The best protection against GDPR fines is genuine compliance — not just having documentation, but actually following it. Key steps include:
- Have an accurate, up-to-date Privacy Policy that reflects your actual data processing
- Identify and document your lawful basis for each type of processing
- Respond to data subject requests (access requests, erasure requests) within one month
- Have a personal data breach response plan so you can notify the DPC within 72 hours if required
- Ensure your cookie consent mechanism is GDPR-compliant — no pre-ticked boxes, no dark patterns
- Have Data Processing Agreements with all third-party processors
Frequently Asked Questions
Can a small Irish business really be fined under GDPR?
Yes. While the DPC’s most headline-grabbing fines have been against large technology companies, small businesses are not exempt. An individual complaint about how your business handled their data can trigger a DPC investigation regardless of your size.
Do I have to tell the DPC if there is a data breach?
If a personal data breach is likely to result in a risk to individuals’ rights and freedoms, you must notify the DPC within 72 hours of becoming aware. If the breach is likely to result in a high risk to individuals, you must also notify the affected individuals directly.
What factors does the DPC consider when deciding the size of a fine?
Article 83(2) of the GDPR lists the factors. They include the seriousness and duration of the infringement, how many people were affected, whether it was deliberate or negligent, steps taken to reduce harm, previous infringements, cooperation with the regulator and how the DPC found out about it, including whether you reported it yourself.
Do I always need a Data Protection Officer?
No. A DPO is only required in specific cases, such as public bodies or where core activities involve large-scale monitoring or special category data. See our guide on whether you need a DPO.
Can the DPC fine a public body?
Yes. The DPC list includes fines against bodies such as the Department of Social Protection, a regional hospital, a university and county councils.
Get your business GDPR-compliant today with our GDPR Privacy Policy service and Website Terms & Conditions. For data protection advice, use the Law Society of Ireland’s Find a Solicitor directory (we are not a solicitor’s practice), or join the no-fee solicitor waiting list. Also see our GDPR for small businesses guide.
This article is for informational purposes only and does not constitute legal advice.
Need help with this? Work of this kind is carried out by a solicitor regulated by the Law Society of Ireland. We are not a solicitor’s practice and do not provide it — to instruct a solicitor, use the Law Society of Ireland’s Find a Solicitor directory.You can also join the no-fee solicitor service waiting list.
