- GDPR is the General Data Protection Regulation, Regulation (EU) 2016/679. It sets the rules for how your business collects and uses information about people, and the rights those people have over it.
- It has applied across the European Union since 25 May 2018. Art. 99
- It replaced a 1995 law that predated social media and smartphones and was applied differently in each country.
- Being a small business doesn’t put you outside it: a customer list, staff records or newsletter sign-ups are enough to bring you in. Art. 2 and 3
- Ireland’s regulator is the Data Protection Commission (DPC). Since leaving the EU, the UK has had its own version, the UK GDPR, overseen by the Information Commissioner’s Office (ICO).
- Fines can reach €20 million or 4% of worldwide annual turnover, whichever is higher. Art. 83(5) Under the UK GDPR the cap is £17.5 million or 4%.
What is GDPR?
GDPR is the EU’s law on personal data. Because it’s a regulation, it applies directly in every EU country exactly as written, without each country having to pass its own version first. Countries do add a national law for the points GDPR leaves to them. In Ireland, that’s the Data Protection Act 2018.
Two definitions tell you whether something your business does is covered.
Personal data is any information about a person who can be identified: a name, an email address, a customer number, a supplier’s van registration, the IP address of someone visiting your online shop. Art. 4(1)
Processing is almost anything you do with that data: collecting it, storing it, looking it up, emailing it, deleting it. If your customer list is in a spreadsheet, you’re already processing personal data. Art. 4(2)
The contacts on your phone that you keep for personal reasons aren’t covered. Art. 2(2)(c)
Ireland’s supervisory authority is the DPC. Every EU country has one, and they work together in the European Data Protection Board (EDPB), which publishes guidelines on how the Regulation should be interpreted. Many large technology companies have their EU headquarters in Dublin, so the DPC is also the lead authority for complaints about them across the EU. When you’re unsure what a rule means in practice, the EDPB’s guidelines and your national authority’s guidance are the places to look.
If your business is in the UK
When the UK left the EU, GDPR was copied into UK law as the “UK GDPR”, which has applied since 1 January 2021. It sits alongside the Data Protection Act 2018 and was amended by the Data (Use and Access) Act 2025. The principles, rights and deadlines in this article are the same in the UK. What changes is the regulator: there, it’s the ICO. If you sell from the UK to customers in the EU, the EU GDPR can apply to you as well. Art. 3(2)
Why was GDPR created?
GDPR replaced Directive 95/46/EC, from 1995. The recitals (the text before the articles, where the lawmakers explain what they intended) give four reasons for the change.
Technology had outgrown the 1995 law
In 1995, few people had email at home. Twenty years on, your data was passing through social networks, online shops, cloud services and advertisers building profiles of you. The Regulation names “rapid technological developments” and globalisation as the new challenges. Recital 6
Each country had different rules
Every country had to write the 1995 directive into its own law, and each did it differently, with its own exceptions and penalties. Ireland had its Data Protection Acts of 1988 and 2003; the UK had its Data Protection Act 1998. An online shop selling into Ireland, France and Germany faced three regimes for the same kind of customer. GDPR itself says this patchwork created legal uncertainty and held back the single market. Recitals 9 and 10
Data protection became a fundamental right
The Treaty of Lisbon made the EU Charter of Fundamental Rights binding in 2009. Article 8 of the Charter says “everyone has the right to the protection of personal data concerning him or her”, and Article 16 of the Treaty on the Functioning of the EU gave the Union the legal basis for a single rule on it. Recital 1
People had lost control of their data
The Regulation aims to give people control of their own personal data and to build enough trust for the digital economy to grow. Recital 7 Two events sped up the negotiations: the 2013 revelations about mass surveillance, and the EU Court of Justice’s 2014 ruling on the “right to be forgotten”.
From proposal to application
| Date | What happened |
|---|---|
| 24 Oct 1995 | Directive 95/46/EC, the previous law, is adopted |
| 25 Jan 2012 | The European Commission proposes the new Regulation |
| 27 Apr 2016 | The European Parliament and the Council adopt GDPR |
| 4 May 2016 | Published in the Official Journal of the EU |
| 23 May 2018 | The UK’s Data Protection Act 2018 receives Royal Assent |
| 24 May 2018 | Ireland’s Data Protection Act 2018 is signed into law |
| 25 May 2018 | GDPR starts to apply and the directive is repealed |
| 1 Jan 2021 | The UK GDPR takes over in the UK after Brexit |
Businesses had two years to prepare between adoption and application. Plenty left it until May 2018, which explains the flood of “please consent” emails you probably remember.
The 7 GDPR principles
Nearly every rule in GDPR flows from seven principles. When you’re not sure whether something is allowed, test it against them. Art. 5
| Principle | What it means for your business |
|---|---|
| Lawfulness, fairness and transparency | Have a reason the law recognises before you use the data, and tell people what you do with it. |
| Purpose limitation | Use data only for the purpose you collected it for. An email address a customer gave you for invoices can’t simply go onto your newsletter list. |
| Data minimisation | Ask only for what you need. Delivering a sofa doesn’t require the customer’s date of birth. |
| Accuracy | Fix data that’s wrong. |
| Storage limitation | Decide how long you keep each type of data, then delete it. |
| Integrity and confidentiality | Protect data from unauthorised access, from loss and from being sent to the wrong person. |
| Accountability | Be able to show, with documents, that you meet the other six. |
Accountability is the principle that takes the most day-to-day work: you need records, policies and evidence that your decisions were thought through. Art. 5(2)
The six lawful bases
Every use of personal data needs at least one of these: consent, a contract, a legal obligation, vital interests, a public task, or legitimate interests. Art. 6(1)
Many people think GDPR means asking for consent for everything. It doesn’t. When you invoice a customer, your basis is the contract and your legal duty to keep accounts. Asking for consent here would be a mistake: the customer could withdraw it.
People’s rights
You normally have one month to reply when a customer, an employee or anyone else whose data you hold uses one of these rights. Art. 12(3)
| Right | What the person can ask for | Article |
|---|---|---|
| To be informed | Who uses the data, what for and for how long | 13 and 14 |
| Access | A copy of the data and an explanation of how it is used | 15 |
| Rectification | Correction of wrong data | 16 |
| Erasure | Deletion of the data, in some cases (the “right to be forgotten”) | 17 |
| Restriction | A freeze on using the data while an issue is resolved | 18 |
| Portability | The data in a format they can take to another service | 20 |
| Objection | That you stop using the data for some purposes, such as direct marketing | 21 |
| Automated decisions | Not to be subject to a decision made only by a system, with significant effects | 22 |
An email asking for “a copy of all the data you hold about me” is a subject access request (DSAR), and your month has already started. Our guide to subject access and erasure requests takes you through each day of that month, with template replies.
What GDPR asks of your business
A small business usually runs into these obligations first. We’ve put them in the order we’d tackle them.
- Work out what data you hold, why you hold it and where it is. That’s your record of processing activities (ROPA), and almost everything else builds on it. Art. 30 Our guide to the record of processing activities shows you how to fill it in, and our free Excel ROPA template gives you a head start.
- Tell people what you do with their data, in a clear privacy notice on your website, forms and contracts. Art. 13
- Set up a process for access, rectification and erasure requests, and log each one. The access and erasure request log works out the deadlines for you.
- Know what to do when something goes wrong. If a personal data breach puts people at risk, you have 72 hours to report it, and the weekend counts. Art. 33 In Ireland you report to the DPC through its online breach form; in the UK, to the ICO. Our guide Data breach: what to do in the first 72 hours takes you through it hour by hour.
- Put contracts in place with suppliers that handle data on your behalf (GDPR calls them processors), such as your invoicing software or email marketing tool. Art. 28
- Check whether you need a data protection officer (DPO). You must have one if you’re a public body, or if your core activity involves monitoring people on a large scale or using sensitive data on a large scale. Art. 37 In Ireland, you notify the DPC of your DPO’s contact details. Many small businesses that don’t have to appoint one hire an external DPO anyway. If you’re a consultant looking after several businesses, we wrote External DPO with multiple clients for you.
Is GDPR changing?
The 2016 text is still the law. The EU is, however, discussing changes that would ease some obligations, mostly for smaller businesses.
The Omnibus IV package, proposed in May 2025, would widen the exemption from the record of processing activities; the provisional agreement of June 2026 points to organisations with fewer than 1,000 people. The Digital Omnibus, from November 2025, covers data breach notification and excessive access requests.
None of these changes applies yet, so keep following the current rules. Nor do they affect the UK GDPR, which the UK is reforming through its own Data (Use and Access) Act 2025. We follow each step in Digital Omnibus: what Brussels wants to change for data breaches and access requests.
Frequently asked questions
Does GDPR apply to small businesses?
Yes. Any organisation that processes personal data is covered, whatever its size. Businesses with fewer than 250 employees get a partial exemption from the record of processing activities, but every other rule still applies. Art. 30(5)
Does GDPR still apply in the UK after Brexit?
Yes, in the form of the UK GDPR, which kept the same principles, rights and 72-hour breach deadline. If you’re a UK business selling to people in the EU, the EU GDPR can apply to you as well, and you may need a representative in the EU. Art. 3(2) and 27
Does GDPR apply to companies outside the EU?
Yes, if they offer goods or services to people in the EU or monitor their behaviour, for example with targeted advertising. Art. 3(2)
Who enforces GDPR in Ireland and the UK?
The Data Protection Commission (DPC) in Ireland and the Information Commissioner’s Office (ICO) in the UK. That’s where you report a data breach, and where a customer can complain about you. If your business is elsewhere in the EU, the EDPB website lists every national authority.
Do I always need consent to use personal data?
No. Consent is only one of six possible lawful bases. When you invoice, deliver an order or run payroll, your basis is the contract or a legal obligation. Art. 6(1)
Sources
- Regulation (EU) 2016/679 (GDPR), recitals 1, 6, 7, 9 and 10; Art. 2 to 6, 12 to 22, 27, 28, 30, 33, 37, 83 and 99 (EUR-Lex)
- Directive 95/46/EC (EUR-Lex)
- Charter of Fundamental Rights of the European Union, Art. 8 (EUR-Lex)
- Treaty on the Functioning of the European Union, Art. 16 (EUR-Lex)
- Commission proposal COM(2012) 11 (EUR-Lex)
- Data Protection Act 2018 (Ireland) (Irish Statute Book)
- Data Protection Commission
- UK GDPR, Data Protection Act 2018 (UK) and Data (Use and Access) Act 2025 (legislation.gov.uk)
- Information Commissioner’s Office
- EDPB, list of members (national authorities)
Updated: 24 October 2026. This article is general information and is not legal advice on a specific case.