Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 08 SEPTEMBER 2026

The Data Protection Commission’s 2025 Annual Report

Arthur Cox
Explore more from Arthur Cox

Ireland's Data Protection Commission received a record 16,160 new cases in 2025, marking a 45% increase from the previous year, while imposing over €530 million in administrative fines. The Commission finalized four major inquiries, with the TikTok decision accounting for €530 million of the total penalties, and concluded 208 cross-border complaints as Lead Supervisory Authority.

IrelandPrivacy
Colin Rooney
Colin Rooney
Olivia Mullooly
Olivia Mullooly
Ian Duffy
Ian Duffy
Rachel Benson
Rachel Benson
Author LinkedIn connections

The Commission finalised four large scale inquiries in 2025, imposing administrative fines totalling just over €530.77 million, the most significant being the TikTok Technology Limited decision resulting in a fine of €530 million, followed by the Department of Social Protection biometric processing inquiry in which a fine of €550,000 was imposed.

In 2025, 16,160 new cases were received, a 45% increase on 2024, and 208 cross-border complaints were concluded by the Data Protection Commission (DPC) as Lead Supervisory Authority (LSA), up 43%. The number of breach notifications to the DPC fell by 16%. In addition, the DPC provided input on 77 pieces of proposed legislation, up from 56 in 2024.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

The Data Act – “Access By Design” Requirement Comes Into Force

The European Union's Data Act introduces a groundbreaking "access by design" requirement that fundamentally changes how manufacturers must approach product development for connected devices and IoT products. From September 2026, businesses placing connected products on the EU market must ensure users can directly access their generated data by default, shifting data accessibility from a reactive request-based model to a proactive design imperative.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act – Part I: Key Considerations Regarding Data Access And Sharing

The EU Data Act, which became applicable on 12 September 2025, fundamentally reshapes how businesses handle data generated by connected devices and related services. With Ireland's General Scheme published in February 2026 designating ComReg and CCPC as enforcement authorities, companies must now assess their compliance obligations across data sharing frameworks, contractual terms, and user access rights or face significant fines.
IrelandPrivacy
Matheson
Matheson
Article

The Data Act: “Access By Design” Requirement Comes Into Force For Medical Devices

The Data Act's "access by design" requirement came into force on 12 September 2026, mandating that manufacturers of connected products and providers of related services must enable direct user access to generated data by default. This article examines the scope of this new obligation and its practical implications for businesses in the Life Sciences sector, particularly those developing medical devices and Internet of Things products.
IrelandPrivacy
Matheson
Matheson