IrelandA company collected my data without consent. What are my rights under GDPR?
Under GDPR and the Data Protection Act 2018, you have the right to object to unlawful data processing, request erasure, and lodge a complaint with the Data Protection Commission.
What the Law Says
The General Data Protection Regulation (GDPR) applies directly in Ireland, and the Data Protection Act 2018 supplements it by setting out national rules and powers. Where personal data is collected without a lawful basis — such as consent, contract, or legitimate interest — the processing is unlawful, and you have enforceable rights.
GDPR gives you several core rights when your data is processed unlawfully, including the right to withdraw consent (if previously given), the right to object to processing, the right to erasure ('right to be forgotten'), and the right to lodge a complaint with the Data Protection Commission (DPC).
The Data Protection Act 2018 supports and clarifies how these rights operate in Ireland. It empowers the DPC to investigate complaints, issue enforcement notices, and impose administrative fines in line with GDPR.
You may also be entitled to compensation for material or non-material damage caused by unlawful processing — but this requires proving damage and causation.
Statutory TextSection 38 of the Data Protection Act 2018 provides for the establishment and functions of the Data Protection Commission, including its power to investigate complaints and enforce GDPR and domestic law.
— Data Protection Act 2018, s. 38 — Functions of the Data Protection Commission
What to Do
Contact the company in writing to request confirmation of what data they hold, why it was collected, and ask for its erasure.
If they don’t respond within one month or refuse, submit a formal complaint to the Data Protection Commission at https://www.dataprotection.ie.
Keep copies of all correspondence and note dates — the DPC may ask for evidence of your request and their response.
If you suffered harm (e.g., financial loss or distress), consider seeking legal advice about claiming compensation under GDPR Article 82.
Sources
Same Question, Other Jurisdictions
Germany
European Union
UKNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.