Ireland: Data Protection

The key provisions introducing Ireland’s statutory “right to be forgotten” regime for cancer survivors are due to come into operation on 15 October 2026, following the making of the relevant commencement order by the Irish Government.

We recognise the importance of responsible procurement and the role our supplier relationships play to support our broader Sustainable Business objectives.

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.

The Irish High Court has clarified the scope of statutory exemptions under the Data Protection Act 2018, ruling that organisations can legitimately refuse data subject access requests when legal privilege, client confidentiality, or litigation interests are at stake. This landmark decision establishes clear boundaries between different exemption provisions and confirms their compatibility with GDPR Article 23, providing much-needed guidance for organisations navigating complex disclosure obligations.

The EU e-Evidence Regulation has entered into force, establishing a new framework for cross-border requests for electronic evidence in criminal proceedings. Service providers operating in the EU now face strict compliance deadlines and significant penalties for non-compliance, while navigating complex rules about data production, preservation orders, and limited grounds for refusal. How will companies balance law enforcement cooperation with fundamental rights protections under this challenging new regime?

The Critical Infrastructure Act 2026 is commenced, as we outline in our Insights blog post: Critical Infrastructure Act 2026 commenced. Several projects have been designated as critical infrastructure projects, as we outline in our public procurement section.

On 14 April 2026, the European Commission adopted a Delegated Regulation supplementing the MiFID II Directive with regard to regulatory technical standards (RTS) specifying the criteria for establishing and assessing the effectiveness of order execution policies of investment firms.

On 30 June 2026, the Irish Data Protection Commission (“DPC”) published its annual case studies booklet (“Booklet”) alongside its 2025 annual report (“Report”).

Ireland's EU Council Presidency faces critical telecommunications negotiations that will reshape Europe's digital infrastructure landscape. The Digital Networks Act promises to modernize the EU's telecoms framework by replacing multiple directives with a unified regulation, while parallel negotiations on child safety online raise fundamental questions about encryption and privacy. These interconnected policy files will determine how Europe balances investment incentives, cross-border service provision, netw