Short answer
The GDPR applies in Ireland alongside the Data Protection Act 2018. Publication in a statutory register can be lawful because legislation requires it or assigns a public task, but public availability does not make personal data ownerless. The register and anyone who reuses its data must remain within their respective lawful purposes.
Electronic direct marketing is also governed by Ireland's ePrivacy Regulations. Email and text marketing usually needs opt-in consent, with a narrow existing-customer exception and an unconditional right to stop. Advertising cookies, pixels and SDKs normally require prior consent. Online platforms have additional Digital Services Act duties, including ad transparency and bans on profiling-based ads using sensitive data or targeting known minors.
Ireland's online age of consent is 16 only where an information-society service offered directly to a child relies on consent. Article 15 access requests normally require a free response within one month. A person seeking compensation must prove material or non-material damage caused by an infringement; a breach alone is not enough.
Public registers have a statutory purpose, not a GDPR exemption
The Companies Registration Office and other public registers exist under legislation specifying what must be filed and disclosed. The controller will usually rely on compliance with a legal obligation or performance of a public task under Articles 6(1)(c) or (e). The governing statute helps define the publication purpose, mandatory fields, access, retention and any suppression mechanism.
GDPR principles still apply. The register should publish only authorised data, keep it accurate, protect non-public fields and explain processing. A filing party should not put an unnecessary home address, signature or sensitive information into a free-text attachment merely because the form will be public. Irish company law has specific procedures in some high-risk cases for substituting a registered office for an officer's residential address.
Public access does not authorise every downstream use. A scraper, data broker or marketer becomes responsible for its own collection, combination, profiling and disclosure. It needs a lawful basis, Article 14 transparency where applicable, defensible retention and compliance with marketing objections and ePrivacy rules. “It was on the internet” is not a legal basis.
Erasure and objection are not absolute where legislation requires continuing publication. In Manni, C-398/15, the CJEU held that company-register disclosure may remain necessary after dissolution and recognised no general right to erase it after a fixed period. Accuracy, rectification and any statutory restriction route remain available, and an authority must not expand access beyond the mandate.
Electronic marketing needs consent or the narrow customer exception
The GDPR governs how a list is obtained, profiled, shared and retained. Regulation 13 of S.I. 336/2011 adds channel-specific rules for email, SMS, fax and calls. The general rule for unsolicited electronic marketing to an individual is clear affirmative consent. Silence, a pre-ticked box, bundled terms or purchased contact details without auditable permission are insufficient.
The “soft opt-in” can cover an organisation's own similar products or services where it lawfully obtained electronic details from a customer during a completed sale. The customer must receive a clear, free and easy opt-out at collection and in every message. The initial marketing must fall within the prescribed 12-month period. It does not cover prospects who abandoned checkout, unrelated products, another group company or a bought list.
Every message must identify the sender and provide a valid unsubscribe route. Mobile marketing calls generally require consent; landline calling must respect the National Directory Database opt-out rules. Suppression data may be retained to ensure an objection remains honoured.
Article 21 makes the consequence decisive:
“the personal data shall no longer be processed for such purposes”
—
That absolute rule covers direct-marketing profiling. An organisation cannot override it by asserting legitimate interests.
Cookies and digital ads have overlapping rules
Storing or reading information on a device through cookies, pixels, local storage, fingerprinting or app SDKs normally needs consent before activation. The two narrow exemptions are transmission of a communication and technology strictly necessary for a service explicitly requested by the user. Analytics, conversion tracking, cross-site advertising and preference tools used beyond necessity ordinarily require consent.
The choice must be informed, specific and affirmative; rejection should be as accessible as acceptance, and withdrawal as easy as giving consent. The associated personal-data processing must separately satisfy GDPR purpose, legal-basis, minimisation, sharing, retention and transfer rules. A consent platform cannot legitimise an excessive purpose.
The Digital Services Act adds duties for online platforms. An advertisement must be recognisable as an ad, identify on whose behalf it is shown and explain the main targeting parameters. Platforms may not present profiling-based ads using GDPR special-category data. They may not use profiling to show ads when they know with reasonable certainty that the recipient is a minor; compliance does not itself require collecting extra data merely to decide age.
Ireland's Online Safety Code applies additional protections to regulated video-sharing platforms and audiovisual commercial communications, including child-safety, age-assurance and parental-control measures. Its scope is not every website or advertisement, so GDPR, ePrivacy, consumer and sectoral advertising law must still be mapped separately.
Children receive heightened protection
The Data Protection Act treats a person under 18 as a child. Services should put the child's best interests first, use age-appropriate plain language, minimise collection, use privacy-protective defaults, avoid manipulative design and test profiling or sharing for disproportionate effects. A child has their own data rights; the data does not automatically belong to a parent.
Ireland sets 16 as the Article 8 “digital age of consent”. It applies only when an information-society service is offered directly to a child and consent is the legal basis. Below 16, consent must be given or authorised by the holder of parental responsibility, and the provider must make reasonable efforts to verify that authority in light of available technology.
This does not mean every online use of under-16 data requires parental consent. Contract, legal obligation, public task or legitimate interests may sometimes apply. Those bases must be genuinely available and cannot be selected simply to evade parental verification. Children merit special weighting in a legitimate-interest balance, particularly for behavioural advertising, location, biometrics or sharing.
A parent seeking access on a child's behalf must establish authority, but that is not the end of the analysis. The controller should consider the child's maturity, views, confidentiality, safety and best interests and disclose only the child's data. Older children may exercise rights themselves.
An access request asks for personal data, not only documents
Article 15 entitles a person to confirmation, a copy of personal data undergoing processing and information about purposes, categories, recipients, retention, source, rights, transfers and relevant automated decision-making. No special wording, form or motive is required. Reasonable identity evidence can be requested where genuine doubt exists, but controllers should not demand disproportionate identification.
The response is normally free and due without undue delay and within one month. For a complex request or numerous concurrent requests, the controller may extend by up to two further months, but must notify and explain within the first month. It should search relevant email, databases, active files, retrievable archives and structured manual records and explain codes so the data is intelligible.
Access is not an automatic right to every unredacted document. Article 15(4) protects others' rights and freedoms, and the 2018 Act contains targeted restrictions for matters such as privilege, investigations and defined public interests. The controller should isolate or redact third-party material and provide the rest rather than refuse everything. Any restriction needs an identified legal provision and a documented necessary and proportionate application.
Manifestly unfounded or excessive requests are a high-threshold exception. The controller bears the proof and must tell the requester about the refusal, reasons and complaint/judicial options.
Compensation requires infringement, damage and causation
A person may complain to the DPC for investigation and corrective action. Compensation is a court remedy. Section 117 permits a data-protection action in the Circuit Court or High Court and provides injunctions, declarations and compensation. The Act confirms:
“damage includes material and non-material damage”
—
Under Österreichische Post, C-300/21, three elements are required: a GDPR infringement, material or non-material damage, and a causal link. Mere infringement does not create compensation, but Member States cannot impose a minimum “seriousness” threshold for non-material harm. Evidence may include financial loss, remediation cost, proven distress, loss of control or other actual consequence, assessed under EU principles and Irish procedure without turning compensation into a penalty.
The controller may avoid Article 82 liability if it proves it was in no way responsible for the event causing damage. Regulatory fines and court compensation serve different purposes; one does not automatically determine the other.
Conclusion
Irish data protection law follows purpose and context. Statutory publicity is not unrestricted reuse; consent to one channel is not permission for all marketing; a child's age does not displace their own rights; and access does not erase third-party rights. Controllers should record the legal gateway, minimise the data, provide usable choices and responses, and preserve evidence of both compliance and any claimed harm.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.