What You Need to Know After Recent Legal Changes
Something has shifted in Ireland over the past year. If you run a website that collects any kind of personal information from visitors, the rules have changed. Not in a small way. In a way that affects how you build your site, how you handle user data, and how you talk to your customers about privacy.
This is not just about the big tech companies. It affects small businesses, blogs, affiliate sites, and anyone with a contact form or an email list. The Data Protection Commission is active. The new Gambling Regulatory Authority of Ireland has its own rules. And new legislation is arriving that will change how data flows between businesses.
This article breaks down what has changed, what it means for your site, and what you should do about it. No legal jargon. No panic. Just clear information you can use.
The Data Protection Commission Is Watching
Ireland has one of the most important data regulators in Europe. The Data Protection Commission (DPC) is the lead authority for many of the world’s largest tech companies that have their European headquarters here. That gives it a lot of power, and it uses it.
The DPC publishes detailed guidance on almost every aspect of data protection. For website owners, the most relevant topics are:
- Cookies and tracking technologies. If your site uses analytics, advertising pixels, or any kind of tracking, you need clear consent from users.
- Data security. You must protect any personal data you hold from unauthorised access, loss, or misuse.
- Breach notifications. If there is a data breach, you have a legal obligation to report it to the DPC within 72 hours.
- Data Protection Impact Assessments (DPIAs). If your processing is likely to result in a high risk to users’ rights, you must conduct a DPIA before you start.
For most Irish websites, the practical impact is straightforward. Use a clear cookie banner. Have a privacy policy that actually explains what you do with data. Keep your site secure. Do not hold onto data longer than you need it.
The Gambling Regulation Act 2024 and Data
The Gambling Regulation Act 2024 is a major piece of legislation. It established the Gambling Regulatory Authority of Ireland (GRAI) on 5 March 2025 to license and regulate all gambling activity in the country, excluding the National Lottery.
The Act is primarily a public health measure. It aims to protect vulnerable people from gambling harm. But it also has significant data protection implications.
Section 65 of the Act gives the GRAI the power to make regulations about how personal data and special category data are processed for the purposes of the Act. This includes setting rules about how long data can be kept and what restrictions apply to data subject rights.
There is also a requirement for licensees to notify the Authority about suspicious gambling patterns, which may involve processing personal data. This creates obligations around data sharing and reporting.
But here is the critical part. A recent analysis from the Cork Online Law Review points out that the Act does not include explicit measures to govern how gambling companies collect, process, or share personal data for targeted advertising, data analytics, or player profiling.
The Act requires compliance with GDPR. But it does not provide industry-specific guidelines for responsible data usage in gambling. This is a gap that critics say leaves players exposed to data exploitation. The article notes that the gambling industry relies heavily on data to optimise engagement and maximise profits, and the current framework does not adequately address this.
For website owners in the betting and casino space, this means two things. First, you must comply with GDPR in full. Second, you should expect further regulation in this area. The GRAI has the power to make rules, and it is likely to use it.
The Data Act Is Coming
The EU Data Act (Regulation (EU) 2023/2854) became applicable across the EU on 12 September 2025. It is a major piece of legislation that sets rules on who can access and use data generated by connected products and related services.
Ireland has not yet passed the national legislation to implement it. The General Scheme of the Data Bill 2025 was published on 4 February 2026. It is now going through pre-legislative scrutiny.
The Data Act introduces several important concepts:
Connected products. These are devices that collect data about their use or environment and can communicate it. Examples include smart home appliances, fitness trackers, and connected cars.
Data holders. These are the companies that control access to the data generated by these products. They have obligations to make data available to users and, in some cases, to third parties.
Data recipients. These are businesses that receive data from data holders, often at the request of users.
The Act also introduces rules on unfair contract terms in business-to-business data sharing agreements. Terms that grossly deviate from good commercial practice or are contrary to good faith may be considered unfair and unenforceable.
For Irish website owners, the Data Act is most relevant if you use connected devices, offer related services, or enter into data sharing agreements with other businesses. If you run a standard website with a contact form, the immediate impact is limited. But the direction of travel is clear. Data is becoming a regulated asset.
The AI Act Changes Everything
On 31 July 2026, Ireland’s Regulation of Artificial Intelligence Act 2026 came into force. This gives effect to the EU AI Act in Ireland and establishes the AI Office of Ireland as the central coordinating authority.
The key point for website owners is this. The Data Protection Commission is designated as a Market Surveillance Authority for AI. It will supervise the protection of fundamental rights relating to personal data in the context of high-risk AI systems.
If your website uses AI tools for things like personalisation, automated decision-making, or profiling, you need to understand what category those tools fall into. High-risk AI systems have strict requirements around documentation, transparency, and human oversight.
The fines are serious. Under the EU AI Act penalty structure, serious breaches can reach EUR 35 million or 7 percent of global annual turnover, whichever is higher.
This is not something to ignore. Even small websites are starting to use AI for content generation, chatbots, and recommendation engines. If those systems process personal data, they fall within the scope of the AI Act.
What This Means for Your Website
If you run a website in Ireland, here is what you should be doing right now.
1. Audit your data collection. List every place on your site where you collect personal information. Contact forms, newsletter signups, comment sections, analytics, and advertising pixels. Know what you are collecting and why.
2. Get your cookie consent right. The DPC has been clear that implied consent is not enough. Users must actively opt in to non-essential cookies. If your banner only has an “Accept” button and no way to refuse, you are not compliant.
3. Write a real privacy policy. Your policy should explain what data you collect, why you collect it, how long you keep it, and who you share it with. It should be in plain English. Do not copy and paste from another site.
4. Secure your site. Use HTTPS. Keep your software updated. Use strong passwords. Limit access to your admin panel. Back up regularly. If you collect payment information, use a reputable payment processor and never store card details on your own server.
5. Have a breach plan. If your site is hacked and user data is exposed, you have 72 hours to report it to the DPC. Know who to contact and what steps to take.
6. Be careful with third-party tools. Every plugin, widget, and tracking script you add to your site is a potential data risk. Only use tools you trust. Read their privacy policies. Make sure they are GDPR compliant.
7. If you are in gambling, be extra careful. The GRAI has broad powers. The Act requires compliance with data protection law. And the regulator is likely to issue specific guidance in the future. Do not wait for enforcement. Get your house in order now.
Why This Matters for B2B Clients
If you are trying to attract business clients, data protection is now a selling point. Companies are increasingly cautious about who they work with. They want partners who take data security seriously.
A clean, compliant website signals that you are a professional operation. It tells potential clients that you understand the legal landscape and can be trusted with their data. In a small market like Ireland, reputation matters. Being known as a company that does things properly is worth a lot.
The Bottom Line
The legal landscape for data protection in Ireland is changing fast. The DPC is active. The GRAI has new powers. The Data Act is coming. The AI Act is here.
None of this is optional. If you run a website that collects data, you are subject to these rules. The good news is that most of what you need to do is straightforward. Be transparent. Be secure. Do not collect more than you need. Do not keep it longer than necessary.
Do those things, and you will be in good shape. Ignore them, and you leave yourself open to fines, complaints, and damage to your reputation.
At Smart Digital Marketing, we work with Irish businesses on websites, content, and digital strategy. If you have questions about data protection or need help getting your site compliant, get in touch. We are always happy to help.