GDPR compliance for Irish regulated firms in 2026

The 2026 enforcement picture

Recent Data Protection Commission activity has concentrated on patterns that are unglamorous and very common:

• Professional services firms with no working DSAR process
• Smaller firms with no breach response plan at all
• Cloud storage in use with no adequate data processing agreement behind it
• Any firm involved in a reportable breach that missed the 72-hour notification

None of those require a sophisticated attack. They require an ordinary mistake and an unprepared firm.

What every Irish regulated firm needs

A record of processing activities

Under Article 30, most Irish firms must maintain a ROPA. For a regulated firm it doubles as the map of where personal data sits, which is the same question AML record-keeping asks.

A usable record names, for each processing activity, the purpose, the categories of people and data, who it is shared with, any transfer outside the EEA, the retention period and the security measures. Kept that way it also answers the first three questions the DPC asks after a breach: what was taken, whose, and why did you have it.

A DSAR process

Clients and former staff are entitled to their data within one month. Firms without a named owner and a documented route miss it, because the request lands in a general inbox and sits there. Train staff to recognise a DSAR and forward it the same day.

The month can be extended by two more where requests are complex or numerous, but only if the firm tells the requester within the first month and says why. Verify identity before releasing anything, redact other people’s data, and log every request with its dates: the log is what shows the DPC the process works. A request does not have to use the words “subject access” to be one, and it can arrive by phone, in a complaint, or in a letter from a solicitor.

A breach response plan

The clock starts when the firm becomes aware, not when it finishes investigating. Seventy-two hours to notify the DPC, unless the breach is unlikely to result in a risk to individuals. A template prepared in advance is the single biggest factor in meeting that deadline.

Two further obligations sit beside the notification. Where the breach is likely to result in a high risk to the people affected, they have to be told without undue delay, in plain language, with what they can do about it. And every breach, notified or not, goes in the firm’s breach register with the facts, the risk assessment and the decision, because the DPC is entitled to see the ones you decided not to report.

Staff training

Almost every breach begins with a person: a phishing click, a misdirected email, a lost device, a file shared with the wrong permissions. Training is the strongest control available, and the one most often skipped.

A DPIA where the risk is high

A data protection impact assessment is required before processing that is likely to result in a high risk to individuals, and the DPC publishes a list of operations that need one. For a regulated firm the usual triggers are transaction monitoring that profiles customers, app-based identity verification that uses facial matching, which is biometric data, systematic monitoring of staff, and any new system that brings client data together. The assessment is short when it is done early and painful when it is done after the contract is signed.

Processors and the cloud

Every supplier that handles personal data on the firm’s behalf, from the cloud file store to the e-verification provider and the training platform, needs a written contract with the terms Article 28 requires: processing only on the firm’s instructions, confidentiality, security measures, controls on sub-processors, help with data subject requests and breaches, deletion or return at the end, and the right to audit. Where the provider is outside the EEA, the transfer needs a lawful route as well, such as the EU-US Data Privacy Framework for certified US providers or standard contractual clauses, and a note of why the firm relies on it, because two earlier US adequacy decisions were struck down and the current one is under challenge. A provider’s standard terms often cover all of this; the firm still has to have read them and filed them.

Do you need a data protection officer?

A DPO is mandatory for public bodies and for organisations whose core activities involve large-scale regular monitoring of individuals or large-scale processing of special category or criminal-offence data. Most small and mid-sized regulated firms fall outside that, but every firm still needs a named person who owns data protection, whose contact details appear in the privacy notice, and who would answer if the DPC rang. In practice that person is often the compliance officer, and the role should be written into the job description rather than assumed.

A DPC notification template

Keep this filled out as far as it can be before you need it. Six headings, and the DPC asks for all of them:

1. Nature of the breach. Confidentiality, integrity or availability, with a one-line description.
2. Categories and approximate number of data subjects. For example, 120 client records.
3. Categories and approximate number of records. For example, names, addresses, PPSNs, AML CDD documents.
4. Likely consequences. For example, identity fraud risk.
5. Measures taken or proposed. Containment, investigation, notification.
6. Contact point. The DPO or the nominated contact, with a number that will be answered.

The first hour

What the plan should tell whoever finds the problem:

1. Contain it. Revoke the access, recall the email, disable the account, isolate the device. Minutes matter more than analysis.
2. Preserve the evidence. Logs, the message, the screenshot. Do not let the clean-up destroy the record of what happened.
3. Tell the owner. The named breach lead and the deputy, by phone, not by email to a shared inbox.
4. Assess the risk. What data, whose, how many, and what could be done with it. That assessment decides whether the DPC and the individuals are notified.
5. Start the clock. Record the moment of awareness. Seventy-two hours runs from there, whatever the investigation still has to find out.

Notification can be made in phases. File what is known inside the deadline and supplement it as the facts come in; the DPC would rather have an early, incomplete report than a late, polished one.

GDPR and AML: The interaction

Firms regularly ask whether data protection constrains their AML obligations. It does not. AML processing is a public-interest task, and the AML obligation prevails where the two appear to conflict.

That is not a blanket permission. Data collected for AML must still be limited to what is necessary, held securely, kept no longer than required, which under the Criminal Justice Act is at least five years after the relationship ends or the last transaction, longer where tax or company law says so, and disposed of securely at the end of it.

The contradiction to resolve in writing: a storage limitation policy that says “delete after two years” and an AML policy that says “retain for five” cannot both be followed.

Three places the two regimes meet

• A DSAR from a client who has been reported. The internal report and any suspicious transaction report are never disclosed in a subject access response: section 60 of the Data Protection Act 2018 allows the right of access to be restricted where that is necessary for the prevention, detection, investigation and prosecution of offences, and the tipping-off offence applies in any case. Route every DSAR past the MLRO before it is answered.
• A request to be forgotten. Erasure does not apply to data the firm is legally obliged to keep, so CDD records stay for the retention period however firmly the request is worded. Tell the person which data was deleted and which the law requires you to keep.
• Screening. PEP, sanctions and adverse media checks process data about alleged offences. That is lawful because the Criminal Justice Acts require it, and the firm’s data protection policy should say so in those terms, naming the legal basis.

The compliance officer’s data protection checklist

A quarterly check that takes an hour and prevents most of the findings above:

• The record of processing activities reflects what the firm actually does, including any system adopted this quarter
• Every processor has a contract with the Article 28 terms on file, and every non-EEA transfer has a lawful route
• The DSAR log shows every request, its date, the response date, and any extension with its notice
• The breach register has entries, each with a risk assessment and a notification decision
• A DPIA exists for transaction monitoring, biometric verification and any staff monitoring
• The retention schedule agrees with the AML policy, and deletion actually runs
• Every member of staff has a data protection training record dated within the year
• The named data protection contact is current, published, and knows they hold the role

Training is still the weakest link

The DPC keeps saying it and it keeps being true. The firms that appear in enforcement decisions are the ones whose staff did not know the rule. A phishing click, a To field where a Bcc belonged, a skipped encryption step: any of those can produce a reportable breach on an ordinary Tuesday.