The GDPR applies directly in Ireland, the Data Protection Act 2018 fills in the national detail, and the Data Protection Commission is the regulator, with the added weight of supervising many of the large technology companies headquartered here. For an ordinary Irish organisation the practical question is what staff need to know so the organisation can show it complies. This guide sets out the obligations the DPC lists, why training is part of them, what a staff course should cover, and where an online course such as Lift College's GDPR Training (Ireland) fits.
The law
Regulation (EU) 2016/679, the General Data Protection Regulation, has applied since 25 May 2018. The Data Protection Act 2018 gives further effect to it in Ireland, establishes the Data Protection Commission, sets the digital age of consent at 16, and transposes the Law Enforcement Directive for An Garda Síochána and other bodies. Fines under the GDPR run to €20 million or 4% of worldwide turnover, whichever is higher, and the DPC has issued some of the largest in Europe.
The obligations the DPC lists
The DPC's Know Your Obligations pages for organisations, read on 9 November 2026, set them out under these headings: access and portability; the accountability obligation; lawful processing; the transparency requirement; data protection by design and by default; the risk-based approach; data security; breach notifications; data protection impact assessments; data protection officers; and controller and processor relationships.
Accountability is the one that makes training a requirement in practice. Article 5(2) says the controller must be able to demonstrate compliance with the principles, and Article 39 gives the data protection officer the task of awareness-raising and training of staff involved in processing. An organisation that cannot show its staff were trained has a gap in its accountability evidence.
Who needs training
Everyone who handles personal data in their work: HR, payroll, reception, sales, customer service, healthcare administration, schools, clubs and charities. The depth varies. Front-line staff need the principles, how to recognise a subject access request and a breach, and everyday security. Managers and anyone who decides how data is used need lawful bases, DPIAs and processor contracts. The DPO, where one is required, needs far more than any staff course.
What a staff course should cover
- Personal data and special category data, and the seven principles.
- The six lawful bases, including when consent is and is not the right one.
- Transparency: privacy notices and what people must be told.
- Individual rights: access, rectification, erasure, portability, objection, and the one-month clock.
- Security in everyday work: email, devices, paper, home working, phishing.
- Breaches: what counts, the 72-hour deadline for notifying the DPC, and when to tell the people affected.
- The DPO's role, processors, and transfers outside the European Economic Area.
Lift College's GDPR Training (Ireland) is 2 hours in 5 modules, written for Ireland with the GDPR, the Data Protection Act 2018 and the DPC, with a check after every module and a dated, verifiable certificate. It is priced in euros. It costs €22.99, pay once, with 14-day money back. Lift College recommends a refresh every 12 months, free, because the DPC's guidance and the case law keep moving.
What it cannot do
- Make anyone a data protection officer or stand in for the DPO's own training.
- Write the organisation's records of processing, privacy notices or DPIAs.
- Give legal advice on a particular transfer, contract or complaint.
Where to go next
- See the course: GDPR Training (Ireland).
- Browse all Ireland courses, priced in euros.
- Organisations in the UK should take GDPR Training, which covers the UK GDPR and the Data Protection Act 2018 as they apply in the UK.