The General Data Protection Regulation has been law since 2018, yet Irish business websites still get the basics wrong. Cookie banners that do nothing, privacy policies copied from American templates, analytics running without consent, contact forms that collect data they never use. The Data Protection Commission (DPC) is the lead supervisory authority for many of the largest tech companies in Europe, and it pays attention to domestic businesses too. This guide covers what your website actually needs to be compliant in 2026, with practical steps rather than legal theory.
Why GDPR Still Matters for Irish Websites in 2026
Ireland's Data Protection Commission has issued over €4 billion in fines since GDPR took effect, most of those against large technology companies. But the DPC also investigates complaints from individuals about smaller businesses: a customer who asks for their data and gets no reply, a website that tracks visitors without consent, a mailing list that has no unsubscribe link.
GDPR applies to every Irish business that collects personal data, regardless of size. A sole trader with a contact form on a one-page website is subject to the same rules as a multinational. The difference is in scale, not in obligation. The regulation covers any information that can identify a person, directly or indirectly: names, email addresses, IP addresses, cookie identifiers, device fingerprints and location data.
Beyond compliance, there is a practical argument. Visitors are more cautious about where they enter their details than they were five years ago. A website that handles data visibly and carefully builds more trust than one that does not. For businesses that depend on online enquiries, such as those offering web design or professional services, that trust directly affects conversion rates.
Cookie Consent: What the Law Actually Requires
The ePrivacy Directive, implemented in Ireland through the ePrivacy Regulations 2011 (S.I. No. 336 of 2011), requires informed consent before placing non-essential cookies on a visitor's device. GDPR raised the standard of what counts as valid consent. Together, they mean:
- No pre-ticked boxes. Consent must be a clear affirmative action. A banner that says "By continuing to browse you accept cookies" is not valid consent[1].
- Granular choices. Visitors must be able to accept or reject different categories of cookies (analytics, marketing, functional) separately. A single "Accept all" button without an equally easy "Reject all" option does not meet the standard.
- No cookie walls. You cannot refuse access to the website unless a visitor accepts all cookies. Essential cookies that the site needs to function (session cookies, security tokens, shopping cart) do not need consent.
- Easy withdrawal. It must be as easy to withdraw consent as it was to give it. If accepting takes one click, rejecting or changing preferences should take one click too.
- Record of consent. You need to be able to demonstrate that consent was given: what was consented to, when, and how.
In practice, this means a proper cookie consent management platform (CMP) — not a banner you coded yourself that only shows a message. Tools like Cookiebot, CookieYes or Complianz scan your site, categorise cookies, block scripts until consent is given and keep an auditable log. The DPC has made clear that simply informing visitors about cookies is not the same as obtaining consent[2].
Google Analytics and Consent Mode v2
Google Analytics 4 (GA4) is the most common analytics tool on Irish websites. Since March 2024, Google requires Consent Mode v2 for any site using GA4 in the European Economic Area. If your consent banner does not communicate with Google's consent API, your analytics data may be incomplete or your site may be non-compliant — possibly both.
Consent Mode v2 introduces two new signals:
- ad_user_data — controls whether user data can be sent to Google for advertising purposes.
- ad_personalization — controls whether personalised advertising is allowed.
These sit alongside the existing analytics_storage and ad_storage signals. When a visitor declines analytics cookies, GA4 switches to cookieless pings that use modelled data to fill gaps, rather than dropping the visit entirely. This means you still get directional data without violating the visitor's choice.
Setting this up properly requires your cookie consent tool to integrate with Google Tag Manager or the gtag.js consent API, and for your GA4 configuration to respect the consent signals. If you are running analytics and reporting for your business, it is worth auditing this setup specifically — a misconfigured Consent Mode means either lost data or a compliance gap.
Privacy Policy: What It Must Cover
GDPR Articles 13 and 14 list the information you must provide when collecting personal data. For an Irish business website, your privacy policy should cover at minimum:
- Identity and contact details of the data controller (your business name, address, email).
- What data you collect and from where: contact forms, analytics, cookies, email sign-ups, purchase data.
- Why you collect it — the legal basis for each type of processing. Common bases are consent (for marketing emails), legitimate interest (for analytics), contractual necessity (for processing an order) and legal obligation (for tax records).
- Who you share it with — every third party that receives personal data: your hosting provider, email service, analytics platform, payment processor, CRM.
- International transfers. If data goes outside the EEA (which it does if you use US-based services like Google, Mailchimp or Stripe), you must explain the safeguards in place, such as Standard Contractual Clauses or an adequacy decision.
- How long you keep it. Vague statements like "as long as necessary" are not sufficient. Specify retention periods: enquiry data kept for two years, purchase records for seven years (Revenue requirement), analytics data anonymised after 14 months.
- Individual rights. List the rights visitors have: access, rectification, erasure, restriction, portability, objection and the right to complain to the DPC.
- How to contact you about data protection matters.
A privacy policy copied from a template and never customised is worse than no policy, because it creates a false impression of compliance. If your website lists services you do not offer, processors you do not use, or legal bases that do not apply, it is misleading.
Contact Forms and Data Collection
Every contact form on your website is a point of data collection. GDPR requires you to collect only the data you need for the stated purpose (data minimisation) and to be transparent about what happens to it.
- Only ask for what you need. If you need a name and email to respond to an enquiry, do not also ask for a phone number, company size and budget range unless there is a genuine reason.
- State what will happen. A short line below the form — "We use your details to respond to your enquiry. See our privacy policy" — is enough.
- Separate consent for marketing. If you plan to add enquirers to a mailing list, that requires a separate, unticked checkbox. You cannot assume that someone who asked a question also wants your newsletter.
- Secure transmission. Forms should submit over HTTPS. If your site does not have an SSL certificate, form data travels in plain text. Every page on a modern website should be served over HTTPS — this is also a factor in how search engines assess your site, as covered in our guide to website security.
- Storage and access. Know where form submissions are stored (your email inbox, a CRM, a database) and who has access. If submissions go to a shared inbox that five people can read, all five are processing personal data.
For businesses that handle a high volume of enquiries through their website, an organised approach to form data also improves response times and follow-up. This is one of those areas where compliance and good business practice overlap.
Third-Party Scripts and Processors
Most business websites load scripts from third parties: Google Analytics, Meta Pixel, Google Maps, YouTube embeds, live chat widgets, font services, reCAPTCHA. Each of these may set cookies or collect personal data, and each one creates a data processing relationship you are responsible for.
Under GDPR, if a third party processes personal data on your behalf, you need a Data Processing Agreement (DPA) with them. The large platforms (Google, Meta, HubSpot, Mailchimp) publish standard DPAs you can accept through their settings. Smaller providers may need a direct agreement.
Practical steps:
- Audit your scripts. Open your browser's developer tools, check what loads on your pages and where data goes. You may find tracking scripts added years ago that nobody remembers.
- Block non-essential scripts until consent. Your cookie consent tool should prevent marketing and analytics scripts from firing before the visitor makes a choice.
- Replace where possible. Self-hosted fonts instead of Google Fonts, a static map image with a link instead of an embedded Google Map, a privacy-focused analytics tool alongside or instead of GA4 — each change reduces your data processing footprint.
- Document everything. Keep a list of every third-party service your website uses, what data it accesses, where it is hosted and what DPA is in place. This is part of your Record of Processing Activities (ROPA), which GDPR requires.
If you are building a new website or planning a website redesign, this audit is easiest at the start. Retrofitting consent management onto a site with dozens of unmanaged scripts is harder and more expensive.
Website Security and Data Protection
GDPR Article 32 requires "appropriate technical and organisational measures" to protect personal data. For a website, this means:
- HTTPS everywhere. SSL/TLS certificates encrypt data in transit. There is no reason not to use HTTPS on every page in 2026.
- Software updates. If your site runs on WordPress, Drupal, Laravel or any other framework, keep it updated. Unpatched CMS installations are the most common cause of website breaches.
- Strong authentication. Admin accounts should use strong, unique passwords and two-factor authentication. Limit the number of people with admin access.
- Regular backups. Backups stored separately from the web server, tested periodically.
- Monitoring. Know when something goes wrong. Uptime monitoring, file integrity checks and login attempt logging all help detect problems early.
A data breach involving personal data must be reported to the DPC within 72 hours if it poses a risk to individuals[3]. If your website is hacked and customer data is exposed, you need to know quickly, understand what was accessed and have a process for notification. This is not theoretical: small business websites in Ireland are targeted regularly, usually through automated attacks on outdated software.
We cover the technical side of this in more detail in our website security guide, and ongoing protection is part of what a website maintenance plan should include.
AI Chatbots and Automated Processing
AI-powered chatbots are becoming common on business websites. If your chatbot collects personal data — names, email addresses, order numbers, support queries — GDPR applies to that data the same way it applies to a contact form.
Additional considerations for AI chatbots:
- Transparency. Visitors should know they are interacting with an automated system, not a person. GDPR and the EU AI Act both require this.
- Data processing. If the chatbot sends conversation data to a third-party AI provider (OpenAI, Anthropic, Google), that is a data transfer that needs a DPA and, if the provider is US-based, appropriate safeguards for international transfers.
- Data retention. Chatbot conversations that contain personal data should not be stored indefinitely. Define and enforce a retention period.
- Right to human review. Under Article 22, individuals have the right not to be subject to decisions based solely on automated processing that significantly affect them. If your chatbot makes decisions (eligibility checks, pricing, access), a human review option must be available.
If you are considering an AI chatbot for your business, building GDPR compliance into the design from the start is far easier than adding it later. This includes choosing where data is processed, what is logged and how conversations are stored.
GDPR Checklist for Irish Business Websites
Use this checklist to audit your website. Each item is something the DPC could reasonably check if they received a complaint about your business.
| Area | Requirement | Status |
|---|---|---|
| Cookie consent | CMP installed with Accept / Reject options for each cookie category | ☐ |
| Cookie consent | Non-essential scripts blocked until consent is given | ☐ |
| Cookie consent | Consent records stored and auditable | ☐ |
| Cookie consent | Withdrawal of consent is as easy as giving it | ☐ |
| Analytics | GA4 configured with Consent Mode v2 | ☐ |
| Analytics | Data retention period set (14 or 26 months) | ☐ |
| Analytics | IP anonymisation confirmed (default in GA4) | ☐ |
| Privacy policy | Published, accessible from every page | ☐ |
| Privacy policy | Lists all data collected, purposes and legal bases | ☐ |
| Privacy policy | Names all third-party processors | ☐ |
| Privacy policy | Covers international data transfers with safeguards | ☐ |
| Privacy policy | States specific data retention periods | ☐ |
| Privacy policy | Lists individual rights and how to exercise them | ☐ |
| Forms | Collect only necessary data (data minimisation) | ☐ |
| Forms | Clear statement of purpose near each form | ☐ |
| Forms | Separate opt-in for marketing communications | ☐ |
| Forms | Submitted over HTTPS | ☐ |
| Security | SSL/TLS on all pages | ☐ |
| Security | CMS and plugins up to date | ☐ |
| Security | Admin accounts use 2FA | ☐ |
| Security | Regular backups in place | ☐ |
| Third parties | All third-party scripts audited and documented | ☐ |
| Third parties | DPAs in place with all processors | ☐ |
| Third parties | Non-essential third-party scripts blocked until consent | ☐ |
| Rights | Process in place to respond to data access requests within 30 days | ☐ |
| Rights | Process for data erasure requests | ☐ |
| Breach | Breach notification procedure documented (72-hour DPC deadline) | ☐ |
Frequently Asked Questions
Does GDPR apply to my small business in Ireland?
Yes. GDPR applies to every organisation that processes personal data, regardless of size. A sole trader with a website contact form is covered. The DPC does not distinguish between large and small businesses when it comes to the obligation to comply — only the scale and complexity of the requirements differ.
Do I need a cookie consent banner?
If your website uses any non-essential cookies — analytics, marketing, social media embeds — yes. A banner alone is not enough: it must offer genuine choice, with the ability to accept or reject categories separately, and non-essential scripts must not run until consent is given.
Can I use Google Analytics under GDPR?
Yes, provided you configure it correctly. Use GA4 with Consent Mode v2, set an appropriate data retention period, ensure your cookie consent tool communicates with the Google consent API, and document the international data transfer safeguards (Google's DPA and Standard Contractual Clauses). Some Irish businesses add a privacy-focused alternative like Plausible or Fathom as a belt-and-braces approach.
What happens if I receive a data access request?
You must respond within one month. The individual has the right to a copy of all personal data you hold about them, the purposes of processing, the categories of data, recipients, retention periods and the source of the data. If you cannot identify what data you hold or where it is stored, that is itself a compliance problem.
Do I need a Data Protection Officer?
Most small and medium Irish businesses do not need a formal DPO. It is required if your core activities involve regular, systematic monitoring of individuals on a large scale, or large-scale processing of special category data (health, biometric, political opinions). Even if you do not need a DPO, you should have someone responsible for data protection matters.
What are the fines for GDPR non-compliance in Ireland?
Fines can reach up to EUR 20 million or 4% of annual global turnover, whichever is higher. In practice, fines for small businesses are much lower, but the DPC can also issue enforcement notices, reprimands and orders to stop processing. The reputational cost of a publicised complaint can be more damaging than the fine itself.
Is a privacy policy template enough?
No. A template is a starting point, but it must be customised to reflect your actual data processing activities. A privacy policy that lists services you do not use, processors you have never heard of, or legal bases that do not apply is misleading and could itself be a compliance issue.
How does GDPR affect email marketing?
You need consent to send marketing emails to individuals (B2C). There is a limited "soft opt-in" exception for existing customers if you collected their email during a sale and offer an unsubscribe option, but this only covers similar products or services. For B2B, legitimate interest may apply in some cases, but best practice is still to obtain explicit consent. Every marketing email must include an unsubscribe link that works immediately.
Sources
- Data Protection Commission — Cookies and Other Tracking Technologies: Guidance for Organisations
- Data Protection Commission — Report on Cookie Consent Sweep
- Data Protection Commission — Breach Notification
- General Data Protection Regulation — Article 32: Security of Processing
- General Data Protection Regulation — Article 13: Information to be provided where personal data are collected from the data subject
This article is for informational purposes and does not constitute legal advice. For specific questions about your obligations under GDPR, consult a qualified data protection practitioner or the Data Protection Commission directly.