The Commission finalised four large scale inquiries in 2025, imposing administrative fines totalling just over €530.77 million, the most significant being the TikTok Technology Limited decision resulting in a fine of €530 million, followed by the Department of Social Protection biometric processing inquiry in which a fine of €550,000 was imposed.
In 2025, 16,160 new cases were received, a 45% increase on 2024, and 208 cross-border complaints were concluded by the Data Protection Commission (DPC) as Lead Supervisory Authority (LSA), up 43%. The number of breach notifications to the DPC fell by 16%. In addition, the DPC provided input on 77 pieces of proposed legislation, up from 56 in 2024.
2025 DPC overview
| 6,521 data breaches: Almost 50% of breaches involved data being sent to the wrong recipient |
| 16,160 new cases in 2025: Highest annual caseload in DPC history (45% increase) |
| 208 cross-border complaints concluded: 43% increase on 2024 figures |
| 42% of overall complaints received were Subject Access Request complaints |
| €530.77 million administrative fines |
Top GDPR complaint categories
| Complaint type: | % of total |
| Data Subject Access Request | 42% |
| Right to erasure | 17% |
| Fair processing | 16% |
Data Subject Access Requests
Data Subject Access Requests (DSARs) were the top complaint category in 2025, with 1,280 DSARs accounting for 42% of all complaints. The most common query was non-response to DSARs, with related complaints typically arising from employer-employee disputes, financial matters or following poor customer service.
The DPC advised that when relying on exemptions in response to a DSAR, organisations should document their reasoning and prepare a schedule of withheld or redacted documents with references to the relevant legislation.
The DPC conducted 13 site visits in 2025 at premises including restaurants, GP surgeries and solicitors’ offices, where controllers failed to respond to rights requests or engage with the complaint process.
Controllers should now take the opportunity to review their DSAR, data retention and deletion processes in light of the volume of complaints relating to these areas. The DPC’s booklet of case studies from 2025, published alongside the Annual Report, illustrates how the DPC engages with stakeholders to resolve data protection complaints in these areas and offers insights for controllers into how corrective measures are implemented.
Key compliance risks and emerging trends
Use of AI
The DPC noted a marked increase in individuals using AI tools to draft access requests and complaints, cautioning that AI-generated submissions may be inaccurate and that individuals should exercise caution when entering personal data into such tools.
Following the December 2024 EDPB opinion on AI, the DPC continued its regulatory engagement regarding the use of personal data for training of generative AI models by large technology firms based in Ireland, in close cooperation with peer European authorities.
Key engagements and case studies included:
- X/Grok: Ongoing inquiry into the use of publicly accessible EEA user posts for AI model training, focusing on lawfulness, purpose limitation and transparency
- Meta: Ongoing engagement on the use of publicly shared Facebook and Instagram content for large language model training
| Case Study 28. Employee uploading Curricula Vitae to AI tool: A financial services organisation detected that an employee had uploaded 32 CVs to a free external AI tool without any AI governance framework or data processing agreement in place. The DPC stressed the importance of AI governance frameworks, staff training and clear policies on third-party AI use. Key takeaway: The absence of AI governance frameworks and clear policies on third-party AI tool use may expose organisations to liability for unauthorised processing by employees. AI governance should be evaluated by organisations to ensure any data processing is compliant with the GDPR. |
Electronic direct marketing
In 2025, the DPC received 245 new electronic direct marketing complaints, a 24% increase on 2024, with 73% relating to unsolicited emails and 11% to unsolicited SMS text messages. A total of 275 investigations were concluded, representing an 88% increase on 2024.
The most frequently reported issues involved marketing communications sent without a functional opt-out mechanism or without the individual’s explicit consent.
The DPC issued 50 warning letters for unsolicited marketing. Organisations should ensure consent is clearly distinguishable, not bundled with other requests, and that opt-out mechanisms are functional.
Data breach trends
Of the 6,521 valid breach notifications received in 2025, 50% arose from correspondence sent to the wrong recipient. Public sector bodies and banks accounted for the highest notification volumes. Notably, the DPC has commenced an initiative to examine organisations’ compliance with their obligation under Article 33(5) GDPR to record all personal data breaches, including those not reported to the DPC.
ePrivacy breach notifications rose 71% to 731, with over one-third caused by phishing. The DPC considers multi-factor authentication a baseline security standard and intends to engage further with the telecommunications sector in 2026.
Pre-engagement with the DPC
The DPC emphasises proactive engagement as a central regulatory tool. It conducted 1,222 supervision engagements in 2025, of which 498 related to multinational technology companies. Of these, 57% were DPC-initiated and 43% were company-initiated.
In its early engagement with Etsy, the DPC identified concerns around transparency and retention periods in its chatbot. As a result of the engagement, Etsy added a Help Centre hyperlink and express reference to retention periods in Etsy’s Privacy Policy.
| Key takeaway: Pre-engagement at DPIA or design stage is welcomed by the DPC as a risk mitigation strategy. |
Inter-regulatory cooperation
Inter-regulatory cooperation was a key priority in 2025 given the complexity of the EU’s digital legislative package. Over 50 meetings were held with peer regulators, and a joint “Short Guide to Digital Regulation” was published through the Digital Regulators Group.
Since mid-2023, the DPC has maintained a full-time Brussels-based Attaché to support ongoing engagement with EU institutions, peer supervisory authorities, civil society and regulated entities. In 2025, the Attaché participated in over 30 public events and 22 EDPB expert sub-group meetings and actively monitored the Procedural Harmonisation Regulation agreed by EU co-legislators in November 2025. The role has since been made permanent, with key priorities looking ahead including engagement arising from Ireland’s 2026 Council Presidency and monitoring of key EU policy files such as the Digital Omnibus and AI Omnibus.
International activities
Under the GDPR’s One-Stop-Shop mechanism, the DPC acts as Lead Supervisory Authority for organisations with their main establishment in Ireland and concludes decisions under the Article 60 cooperation mechanism, through which Concerned Supervisory Authorities share their views. In 2025, it received 315 valid cross-border complaints, concluded 208 and rejected or dismissed 34. A further 163 amicable resolutions were submitted through Article 60, up by 41% on 2024.
Headline cross-border decision: Transfer of EEA user data to China
April 2025, the DPC found that TikTok infringed Articles 13(1)(f) and 46(1) GDPR in connection with the transfer of EEA user data to China, imposing fines of €530 million and ordering suspension of transfers. TikTok appealed the decision and we discuss the High Court judgment of 3 June 2026, in our briefing, TikTok Decision: Impact on international data transfers.
| Key takeaway: Organisations transferring personal data outside the EEA must identify an appropriate transfer mechanism and demonstrate that the transferred data benefits from a level of protection essentially equivalent to that guaranteed under the GDPR. |
International transfers – Binding Corporate Rules (BCR)
The DPC acted as lead reviewer on 13 BCR applications and maintained oversight of 33 approved frameworks. The DPC noted in this regard that a common deficiency in BCR applications is the failure by applicants to clearly demonstrate the commitments being made.
DPC decisions
As of 31 December 2025, the DPC had 87 statutory inquiries ongoing, including 53 cross-border, and issued 10 Final Decisions and 92 Provisional Decisions. Three domestic decisions are noteworthy:
- Inquiry regarding Department of Social Protection: The DPC found infringements of lawful basis, transparency and DPIA obligations in the processing of biometric facial templates from Public Services Card applicants as part of SAFE 2 registration. A reprimand, €550,000 fine and order to cease processing within nine months were imposed. The decision is under appeal.
| Key takeaway: Organisations processing biometric data must ensure a valid lawful basis exists, and that transparency and DPIA obligations are met. |
- Inquiry regarding City of Dublin Education and Training Board (CDETB): The DPC found security failures following a breach affecting approximately 13,000 student grant applicants. Notification to the DPC was also found to be critically delayed. CDETB declined to notify data subjects until over two years after becoming aware of the breach. A reprimand, compliance order and €125,000 fine were imposed, reduced from the Draft Decision amount following CDETB engagement with the DPC.
- Inquiry regarding University of Limerick (UL): Between November 2018 and January 2020, UL notified the DPC of 12 breaches, six involving unauthorised email access through phishing. Compromised accounts contained identity information, PPSNs, bank details and medical or legal documentation. A reprimand and a fine of €98,000 were imposed.
| Key takeaway: Repeated breaches arising from the same vulnerability may be treated as evidence of systemic security failures. |
Litigation
Data Protection Commission v European Data Protection Board (Cases T-70/23, T-84/23, T-111/23)
The Court held that a relevant and reasoned objection under Article 4(24) GDPR may address the scope of an investigation, thereby authorising the EDPB, in adopting a binding decision, to direct an LSA to broaden its investigation and, if necessary, conduct a fresh investigation and deliver a follow-on Draft Decision to the Article 60 cooperation procedure.
McShane v Data Protection Commission [2025] IEHC 191
The High Court refused Mr. McShane’s application for judicial review of a DPC Decision of 23 May 2022, which had dismissed his complaint arising from the May 2021 HSE cyber-attack. The DPC had determined that the HSE was not a data controller in respect of non-work personal data stored on a work phone issued to Mr. McShane. Costs were awarded to the DPC and the HSE. Mr. McShane appealed the decision to the Court of Appeal, which dismissed the appeal, finding that the appellant had not identified any infirmity in the High Court’s decision.
For further information, please contact a member of our Technology and Innovation Group.
The authors would like to thank Cian Curley and Ana Klingl for their contributions to this post.
