Who We Are

Inquiry into Permanent TSB (PTSB)

Area: Bank/Credit/Insurance

Topic: Data security

Articles: 5, 32, 33

DPC Reference: IN-22-7-3

Decision Date: 30 April 2026

The inquiry commenced following Permanent TSB’s (‘PTSB’) notification to the DPC of a series of three data breaches relating to PTSB’s ‘Open 24 Contact Centre’. Each of the data breach notifications concerned malicious actors, in possession of certain PTSB client information, contacting PTSB’s Open24 Contact Centre in order to gain access to client accounts.

The decision considered whether PTSB had complied with Articles 5(1)(f), 32(1) and 33(1) GDPR. In particular the DPC considered whether PTSB had implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risks associated with its processing of personal data via the Open 24 Contact Centre, and also whether PTSB had reported the breaches to DPC within the required time periods under the GDPR. 

The DPC’s decision found that PTSB:

  • infringed the principle of integrity and confidentiality of Article 5(1)(f) GDPR by failing to ensure appropriate security of the personal data related to customer accounts by implementing appropriate technical and organisational measures;
  • infringed Article 32(1) GDPR by failing to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk presented by its processing of personal data within the Open24 Contact Centre; and
  • infringed Article 33(1) GDPR by its failure to notify the DPC without undue delay and within 72 hours of becoming aware of the breaches.

Corrective Powers Exercised:

  1. The Decision issued PTSB with a reprimand in respect of the infringements of Articles PTSB;
  2. The Decision imposed an administrative fine on PTSB in the amount €250,000 in respect of the infringements of Articles 5(1)(f) and 32(1) GDPR; and
  3. The Decision imposed an administrative fine on €27,500 for the infringement of Article 33(1) GDPR

 

You can download the full decision at this link: Permanent TSB (PTSB) - April 2026 (PDF, 898KB).

Inquiry into Microsoft Ireland Operations Limited

Area: Cross Border Private Company

Topic: DS Rights

Articles: 12(4), 15(4), 15(1)(a), 58(2)(b), 58(2)(d)

Decision Date: 1 September 2025

On 1 September 2025, following an inquiry concerning a complaint received against Microsoft Ireland Operations Limited (Microsoft), the Data Protection Commission (DPC) adopted a decision.

The DPC commenced this inquiry on 16 May 2023, on foot of a complaint that Microsoft failed to comply with an access request submitted by the complainant in August 2020.

The scope of the inquiry concerned an examination and assessment of the following:

  1. Whether the Controller complied with Article 12(4) of the GDPR after the Complainant made an access request on 17 August 2020; 

     

  2. Whether the Controller’s reliance on Article 15(4) to withhold all of the Complainant’s data was justified; and 

 

  1. Whether the Controller was in compliance with Article 5(1)(a) in deleting the Complainant’s personal data (i.e. any personal data contained in the relevant OneDrive account).

As the processing under examination constituted 'cross border' processing, the DPC’s decision was subject to the cooperation and consistency mechanism outlined in Article 60 of the GDPR and pursuant to Article 60(3) of the GDPR, the DPC submitted its draft decision to the supervisory authorities concerned for their opinion.

The DPC received one relevant and reasoned objection to the draft decision from the supervisory authorities concerned within the statutory period and therefore issued a revised draft decision. As the DPC did not receive any relevant and reasoned objections to the revised draft decision, the supervisory authorities concerned were deemed to be in agreement with the revised draft decision of the DPC and are bound by it in accordance with Article 60(6) of the GDPR.

The DPC adopted its decision in respect of this complaint in accordance with Article 60(7) of the GDPR. The decision, which was adopted on 1 September 2025, records findings of infringement as follows:

  • Article 12(4) of the GDPR

The DPC finds that Microsoft infringed Article 12(4) of the GDPR in respect of the access request when it failed to inform the complainant of the possibility to lodge a complaint with a supervisory authority and to seek a judicial remedy following the complainant’s access request.

  • Article 5(1)(a) of the GDPR

The DPC finds that, the specific circumstances of the complaint, Microsoft infringed the lawfulness, fairness and transparency principle under Article 5(1)(a) of the GDPR in its handling of the access request and in its decision to delete the complainant’s data.

Corrective Powers Exercised:

  • A reprimand to Microsoft Ireland Operations Limited pursuant to Article 58(2)(b) of the GDPR in light of the infringements found.
  • In light of the infringement of Article 5(1)(a) of the GDPR, and in accordance with Article 58(2)(d) of the GDPR, an order for Microsoft to revise its policies and procedures so that 
    1. the data retention policies for data associated with accounts terminated by Microsoft for violations of the Microsoft Services Agreement are clarified in its user-facing policies; 
    2. the circumstances when Microsoft permanently deletes such data are clarified and;
    3. the appeals processes available to the account holder where Microsoft has terminated the service for an alleged infringement of the Terms of Service are outlined.

 

The full decision is now available to view (PDF, 1MB)

Data Protection Commission Publishes Annual Report for 2025 and Results of “Sharenting” Survey

30th June 2026

The Data Protection Commission (DPC) published its Annual Report for 2025 today. At a press conference at the DPC’s offices, Commissioners for Data Protection, Dr Des Hogan (Chairperson), Mr Dale Sunderland and Ms Niamh Sweeney detailed the significant work of the office throughout the year.  ...

Inquiry concerning the University of Limerick

Area: University

Topic: Data security

Articles: 5, 30, 32, 33, 34

DPC Reference: IN-19-7-1

Decision Date: 10 December 2025

This Decision arises from an own-volition inquiry into the University of Limerick (‘UL’) following a series of personal data breaches that occurred between November 2018 and January 2020. The temporal scope of the Inquiry is from May 2018 to January 2020.

Between 30 November 2018 and 20 January 2020, UL notified the Data Protection Commission (‘DPC’) of 12 personal data breaches, in six of which unauthorised persons gained access to the employee email accounts of UL staff members by means of phishing attacks. The unauthorised users were able some cases to set up forwarding rules which diverted emails containing specified keywords to a folder they had created in the user’s mailbox. The compromised email accounts contained personal data including identity information, contact details, PPS numbers, bank information, medical or legal documentation, staff disciplinary and HR records, and data belonging to students, staff, and external parties.

This DPC carried out this Inquiry under sections 110-111 of the Data Protection Act 2018. It assessed UL’s compliance with Articles 5(1)(f) and 32(1) GDPR (implementation of appropriate technical and organisational measures to ensure appropriate security of the personal data processed on its email service); Article 30(1) GDPR (maintenance of a record of processing activities); Article 33(1) GDPR (notification to the DPC of personal data breaches without undue delay, and in any event within 72 hours of becoming aware of them); Article 34(1) GDPR (notification to concerned data subjects without undue delay of personal data breaches assessed to pose a high risk).

The DPC found that UL did not implement appropriate technical and organisational measures to ensure the security of personal data as required by Articles 5(1)(f) and 32(1) GDPR. The DPC also found that UL’s initial record of processing activity did not fully comply with the requirements of Article 30(1) GDPR, though UL implemented a compliant record of processing activity in May 2020, after the period assessed by the DPC in this Inquiry. The DPC found that three breach notifications were filed more than 72 hours after UL became aware of them, and were not reported without undue delay in accordance with Article 33(1) GDPR. With respect to Article 34(1) GDPR, UL failed in three cases to inform persons affected by a high-risk breach without undue delay. The DPC therefore found infringements of Articles 5(1)(f), 32(1), 30(1), 33(1), and 34(1) of the GDPR.

The DPC’s decisions on corrective measures took account of UL’s significant steps to remediate the deficiencies in its processing of personal data identified in this inquiry. Based on the details of those improvements provided by UL in its submissions, the DPC has decided that it is not necessary or proportionate for it to issue an order for UL to bring that processing into compliance with the GDPR. The DPC’s acknowledgement of those improvements does not however relieve UL of its obligation to continually evaluate the effectiveness of its measures and the measures that are necessary to ensure a level of security that is appropriate to the dynamic risk presented by its processing.

Having carefully considered the infringements identified in this Decision, the DPC has decided to exercise certain corrective powers in accordance with section 115 of the 2018 Act and Article 58(2) GDPR. The corrective powers that the DPC has decided are appropriate to address the infringements in the particular circumstances are:

  1. A reprimand to UL pursuant to Article 58(2)(b) GDPR in respect of its infringements of Articles 5(1)(f) and 32(1) GDPR, Article 30(1) GDPR, Article 33(1) GDPR and Article 34(1) GDPR; and
  2. Administrative fines for the infringements of Articles 5(1)(f) and 32(1) GDPR, Article 30(1) GDPR, Article 33(1) GDPR and Article 34(1) GDPR.

The administrative fines issued for the above infringements are as follows:

  1. In respect of UL’s infringement of Article 5(1)f and 32(1) GDPR, an administrative fine of €45,000
  2. In respect of UL’s infringement of Article 30(1), an administrative fine of €3,000
  3. In respect of UL’s infringements of Article 33(1) GDPR, an administrative fine of €35,000
  4. In respect of UL’s infringements of Article 34(1), an administrative fine of €15,000.

The DPC commends the tenor and tone of UL’s engagement with the DPC since being presented with the DPC’s proposed findings in a draft version of its Decision. These fines are substantially lower than the maximum fines proposed in the draft Decision. The final fines reflect the mitigation occasioned by UL accepting the majority of the findings in the draft Decision, acknowledging responsibility for significant infringements, and proactively taking steps to improve its systems, training, and policies, in order to reduce the likelihood of similar breaches occurring in the future.

The full decision can be downloaded at this link: Inquiry into University of Limerick December 2025 (16MB, PDF).

The Data Protection Commission Publishes Final Decision Following Inquiry into University of Limerick

02nd March 2026

The Data Protection Commission (DPC) has published its final decision following an inquiry into a personal data breach in University of Limerick. This decision arises from an own-volition inquiry into the University of Limerick following a series of personal data breaches that occurred between November 2018 and January 2020. ...