Fines and enforcement
How Ireland's Data Protection Commission enforces the GDPR
Short answer
- Regulator
- Data Protection Commission (DPC), Ireland 1
- Total fines, 2025
- 530,773,000 euro 1
- Largest 2025 decision
- TikTok Technology Limited, two fines totalling 530,000,000 euro 1
- Valid breach notifications, 2025
- 6,521 1
- Lead authority since May 2018
- 88% of 2,189 cross-border complaints 1
What the DPC does
The Data Protection Commission is Ireland's data protection regulator and acts as EU lead supervisory authority for data controllers with their main establishment in Ireland 1. In 2025 it received 6,521 valid data breach notifications, a 16% fall on 2024, of which 5,692 were GDPR notifications 1. It had 87 statutory inquiries on hand at the end of 2025, including 53 cross-border inquiries, and it concluded 2,569 complaints 1. It issued 10 Final Decisions and 92 Provisional Decisions during the year 1. New inquiries announced in 2025 covered Children's Health Ireland at Tallaght University Hospital, TikTok's transfers of EEA user data to China, and X Internet Unlimited Company's use of user data to train AI models 1.
Fines imposed in 2025
The DPC imposed administrative fines totalling 530,773,000 euro in 2025 1. The fines in the annual report were as follows 1. The report describes the TikTok decision of 30 April 2025 as imposing two administrative fines totalling 530 million euro, and its table of Final Decisions lists the single total 1.
| Organisation | Fine | Subject |
|---|---|---|
| TikTok Technology Limited, 30 April 2025 1 | 530,000,000 euro, two fines 1 | Transfers of EU and EEA user data to China 1 |
| Department of Social Protection, 9 June 2025 1 | 550,000 euro 1 | Biometric facial templates used in Public Services Card registration 1 |
| City of Dublin Education and Training Board, 18 June 2025 1 | 125,000 euro 1 | Security breach of the SUSI web server holding student grant applicants' data 1 |
| University of Limerick, 11 December 2025 1 | 98,000 euro 1 | Phishing attacks that compromised staff email accounts 1 |
The EDPB can require a higher fine
As lead authority, the DPC coordinates with other EU supervisory authorities, and the European Data Protection Board can resolve disputes with a binding decision 4,3. In the WhatsApp inquiry the DPC imposed a 225 million euro fine on 2 September 2021, after the Board adopted a binding decision on 28 July 2021 that required the DPC to reassess and increase its proposed fine 4. The Board adopted Binding Decision 2/2023 on TikTok on 2 August 2023 3.
Breach notification enforcement
The DPC acts on failures to report and communicate breaches 2. In its final decision in the Health Service Executive inquiry, announced on 2 September 2026, it fined the HSE a total of 645,000 euro 2. The breakdown included 30,000 euro for infringement of Article 33(1), the duty to notify the regulator, and 15,000 euro for Article 34(1), the duty to communicate the breach to individuals 2. The DPC reprimanded the HSE and ordered it to bring its processing into compliance 2.
Common questions
What was the DPC's largest fine in 2025?
Its decision of 30 April 2025 on TikTok Technology Limited imposed two fines totalling 530 million euro over transfers of EU and EEA user data to China, part of a 2025 total of 530,773,000 euro 1.
Why does the DPC handle so many Big Tech cases?
The DPC acts as EU lead supervisory authority for data controllers with their main establishment in Ireland, and its annual report describes regulating large technology firms based in Ireland 1.
Can the DPC's decisions be overridden?
The European Data Protection Board can issue a binding decision. In 2021 it required the DPC to increase the WhatsApp fine to 225 million euro 4.
Does the DPC fine organisations over breach notification duties?
Yes. In the HSE decision of 2 September 2026 it fined 30,000 euro for the Article 33(1) notification duty and 15,000 euro for the Article 34(1) duty to tell individuals 2.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- Data Protection Commission: Annual Report 2025 (undated)
- Data Protection Commission: Final Decision following Inquiry into the Health Service Executive (HSE) (2 September 2026)
- European Data Protection Board: Binding decisions (Documents)
- Data Protection Commission: Data Protection Commission announces decision in WhatsApp inquiry (2 September 2021)
Related
- EU data protection authorities compared
Complaints, fines, breach notices, staff growth and handling times at EU data protection authorities, from the Commission and national annual reports.
- How the GDPR one-stop-shop works
How a single lead supervisory authority handles cross-border GDPR cases, how authorities cooperate and how the EDPB resolves disputes.
- Largest GDPR fines and their appeal status
Large GDPR fines from regulators' own records, from the €1.2 billion Meta decision to Uber and TikTok, with the appeal status each record shows.
- What a regulator reprimand means
A reprimand is a formal finding of a breach without, or alongside, a fine. How the GDPR, the UK ICO, Ireland's DPC and France's CNIL use reprimands.
- How GDPR fines are calculated
The GDPR fine ceilings, the Article 83 factors and the EDPB five-step method, with seriousness levels, turnover bands and real decisions.