GDPR and IT: What Irish Businesses Must Have in Place in 2026
GDPR enforcement has matured significantly since the regulation came into force in 2018. The Data Protection Commission (DPC) in Ireland has issued substantial fines against major companies and continues to investigate complaints from individuals and sector watchdogs. While large multinationals attract the headlines, the obligations under GDPR apply equally to Irish SMEs, and the technical requirements are specific.
What GDPR Actually Requires from Your IT Infrastructure
GDPR requires that personal data is processed lawfully, stored securely, and protected against unauthorised access, loss, or destruction. Article 32 of the regulation specifically requires that organisations implement appropriate technical and organisational measures to protect personal data.
In practice, this translates to concrete IT requirements: encryption of personal data at rest and in transit, access controls that limit who can access personal data based on legitimate need, audit logging that records who accessed what data and when, backup systems that protect against accidental loss, patch management to address vulnerabilities that could expose personal data, and incident response procedures that allow you to detect, respond to, and report data breaches within the 72-hour notification window.
The 72-Hour Breach Notification Requirement
One of the most operationally demanding aspects of GDPR is the requirement to notify the DPC within 72 hours of becoming aware of a personal data breach. This requires that breaches are detected quickly, which requires monitoring, and that the organisation has a process for assessing severity and escalating to the appropriate people.
Businesses that discover a breach days after it occurred, or that cannot determine the scope of the breach because logging was inadequate, are at material risk of regulatory action. The 72-hour clock is unforgiving, and it starts when you become aware of the breach, not when it happened.
Common GDPR Technical Gaps
The most frequent technical gaps we identify in Irish businesses include personal data stored on shared drives with overly broad access permissions, email systems without encryption for sensitive data transmission, no centralised logging or monitoring that would detect unauthorised access, backup systems that protect against hardware failure but not against ransomware or accidental deletion by privileged users, and no documented incident response procedure.
Each of these represents both a regulatory risk and a business risk. A data breach that results from avoidable technical failures is likely to receive less sympathetic treatment from the DPC than one where appropriate controls were in place.
How Managed IT Services Support GDPR Compliance
A well-structured managed IT service addresses the majority of GDPR's technical requirements as standard. Savenet's managed service includes encryption, access management, audit logging, automated evidence collection, and incident response capability, the same controls that form the technical backbone of GDPR compliance.
We support clients through GDPR assessments and can provide the documented evidence of technical controls that Data Protection Officers and auditors require.
What are the IT requirements under GDPR?
GDPR's Article 32 requires organisations to implement appropriate technical and organisational measures to protect personal data. In IT terms, this translates to encryption of personal data at rest and in transit, access controls limiting who can access personal data, audit logging recording who accessed what and when, patched and maintained systems to reduce vulnerability, secure backup of personal data, and incident response procedures capable of meeting the 72-hour breach notification requirement.
What counts as a personal data breach under GDPR?
A personal data breach is any incident that results in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This includes ransomware attacks that encrypt personal data, accidental deletion of records, sending personal information to the wrong recipient, a laptop containing unencrypted personal data being stolen, and unauthorised access to systems or accounts that store personal data.
What is the 72-hour notification requirement?
When a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the organisation must notify the Data Protection Commission (DPC) within 72 hours of becoming aware of the breach. This is a hard deadline. The notification must describe the nature of the breach, the categories and approximate number of people affected, the likely consequences, and the measures taken or proposed to address it. If the full details are not available within 72 hours, an initial notification should be made and supplemented as further information becomes available.
What fines can the DPC issue for IT-related GDPR violations?
The DPC can issue fines of up to 20 million euro or 4% of global annual turnover, whichever is higher, for the most serious violations. Fines for violations of Article 32, which covers technical and organisational security measures, can be up to 10 million euro or 2% of global annual turnover. The DPC has demonstrated willingness to issue significant fines; several decisions against organisations with Irish operations have attracted international attention.
Does GDPR require encryption?
GDPR does not mandate specific technologies but lists encryption as an example of an appropriate technical measure in Article 32. In practice, failing to encrypt personal data and then experiencing a breach is likely to be treated as a failure to implement appropriate security measures, which carries regulatory risk. Encryption of personal data on laptops, portable storage, and in transit over networks is widely regarded as a baseline expectation for any organisation holding personal data.
What is a Data Protection Impact Assessment (DPIA) and when is one required?
A DPIA is a structured process for identifying and minimising data protection risks in a new project or system. One is required when processing is likely to result in a high risk to individuals, including when processing large amounts of sensitive personal data, using new technologies, monitoring individuals systematically, or processing data of vulnerable groups such as children. Failure to conduct a required DPIA is itself a GDPR violation.
How does a managed IT service support GDPR compliance?
A well-structured managed IT service addresses most of GDPR's technical requirements as part of its standard delivery: encryption, access management, audit logging, patch management, backup management, and incident detection and response. Savenet provides clients with documented evidence of these controls, which is useful for internal compliance reviews, DPO assessments, and regulatory enquiries. We can also support formal GDPR assessments and assist with the technical aspects of data protection impact assessments.
Not sure if your IT infrastructure meets your GDPR obligations? Book a free compliance review.
Book a free IT review at savenetsolutions.ie
