Compliance software · Ireland

GDPR and GRC compliance software for Irish businesses and their DPOs

Ireland's Data Protection Commission supervises some of the world's largest technology companies — and every Irish SME that handles personal data. With NIS2, DORA and the EU AI Act arriving on top of the GDPR, AI Pazz Govnex gives a DPO or compliance lead one place to hold records, controls and evidence.

Start free See pricing

In short

Irish organisations that process personal data must follow the EU GDPR and the Data Protection Act 2018, report notifiable breaches to the Data Protection Commission within 72 hours, and appoint a DPO where the GDPR requires one. Financial entities also face DORA, many firms NIS2, and AI providers the EU AI Act. Govnex holds the GDPR and the EU AI Act as ready-made control sets.

Reviewed . A plain-language guide, not legal advice — check the regulator's site for the current position.

The laws and rules that apply in Ireland

What each asks of a business, who it applies to, what happens if you fall short — and whether Govnex holds it as a ready-made control set.

GDPR

EU GDPR and the Data Protection Act 2018

Ready-made in the Govnex Library
Regulator
Data Protection Commission (DPC)
Who it applies to
Every organisation established in Ireland that processes personal data — and, through the one-stop-shop, many multinationals whose EU headquarters are in Ireland.
If you fall short
Up to €20 million or 4% of annual worldwide turnover, whichever is higher.
What it asks of you
  • A lawful basis, transparency and data minimisation for every processing activity
  • Records of processing activities and data protection impact assessments for high-risk processing
  • A Data Protection Officer for public bodies and for large-scale monitoring or special category processing
  • Report a personal data breach to the DPC within 72 hours
  • Safeguards such as standard contractual clauses for transfers outside the EEA

Source: dataprotection.ie

NIS2

NIS2 Directive (EU) 2022/2555

Track it with your own controls
Regulator
National Cyber Security Centre (NCSC) and sector competent authorities
Who it applies to
Medium and large entities in 18 sectors, as essential or important entities — transposed through Ireland's National Cyber Security Bill.
If you fall short
Up to €10 million or 2% of worldwide turnover for essential entities.
What it asks of you
  • Cyber security risk management measures, approved and overseen by management
  • Early warning of a significant incident within 24 hours, notification within 72 hours and a final report within a month
  • Supply chain security

Source: ncsc.gov.ie

DORA

Digital Operational Resilience Act (DORA)

Track it with your own controls
Regulator
Central Bank of Ireland
Who it applies to
Financial entities — banks, insurers, investment and payment firms and more — from 17 January 2025, and their critical ICT providers.
If you fall short
Set by the Central Bank under its administrative sanctions procedure.
What it asks of you
  • An ICT risk management framework
  • Classification and reporting of major ICT-related incidents
  • Resilience testing and management of ICT third-party risk, with a register of information

Source: centralbank.ie

EU AI Act

EU Artificial Intelligence Act (Regulation (EU) 2024/1689)

Ready-made in the Govnex Library
Regulator
National market surveillance authorities
Who it applies to
Providers and deployers of AI systems in the EU, with obligations phasing in from 2025.
If you fall short
Up to €35 million or 7% of worldwide turnover for prohibited practices.
What it asks of you
  • No prohibited AI practices, and AI literacy for staff
  • Risk management, data governance, documentation and human oversight for high-risk systems
  • Transparency for general-purpose AI and for AI that interacts with people

Source: EUR-Lex

Standards Ireland buyers ask for

How AI Pazz Govnex helps in Ireland

What you needHow Govnex does itModule
The DPO's recordsRecords of processing activities with data, owners, lawful basis, recipients and a compliance checklist per activity.
GDPR and AI Act controlsAdopt the GDPR and EU AI Act control sets, assign owners and collect evidence cycle by cycle.
72-hour breach handlingEvery breach an issue with an owner, deadline and closing actions — the record the DPC asks for.
NIS2 and DORA risk managementKeep ICT and cyber risks in registers with treatments, owners and management sign-off.
Tracking the new EU rulesRecord each regulation that applies, what it asks of you and who owns the work.

Your first 90 days

  1. 1List your processing activities and record the lawful basis for each.
  2. 2Adopt the GDPR control set — and the EU AI Act if you build or use AI — and assign owners.
  3. 3Decide whether NIS2 or DORA applies to you, and start their risk registers.
  4. 4Put your 72-hour breach process in place and publish the policies staff acknowledge.
  5. 5Run an internal audit of your controls and report to the board.

Start with what applies to you

Adopt the control sets that fit, add your own for the rest, and give every control an owner. The first months are free.

Start free

Compliance in Ireland: questions and answers

Who regulates data protection in Ireland?
The Data Protection Commission (DPC). Through the GDPR's one-stop-shop it is also the lead supervisory authority for many multinational technology companies with EU headquarters in Ireland.
Does our company need a Data Protection Officer?
Under the GDPR you need one if you are a public body, or your core activities involve large-scale regular monitoring of people or large-scale processing of special category data. Govnex gives a DPO one place for records, controls and breaches.
Does NIS2 apply to SMEs?
Mostly to medium and large entities in the sectors it lists, though some small ones are covered regardless of size. Check your sector and size — and remember your customers may ask you for NIS2-style controls anyway.
What is DORA?
The EU Digital Operational Resilience Act, applying from 17 January 2025 to financial entities and their critical ICT providers: ICT risk management, incident reporting, resilience testing and third-party risk.
Can data stay in the EU?
Dedicated Hosting runs your own deployment with data and files stored in the Azure region you choose, including EU regions.
Is the GDPR in the Govnex Library?
Yes — the GDPR and the EU AI Act are ready-made control sets, alongside ISO 27001, ISO 42001, ISO 22301 and SOC 2.

Modules Ireland teams start with

Small business and up

Data protection compliance software

Data Compliance Tracker

What you hold data about and what you do with it: entities and their records with a business owner and a data owner for each, and Records of Processing Activities with a compliance checklist answered item by item.

  • Entities — Customer, Employee, Supplier — each with a business owner and a data owner
  • A RoPA for each activity: its purpose, its owners, and the records it processes — what they hold read beside it
More about Data Compliance Tracker
Every plan

Compliance management software

Compliance and Control Tracker

Track recurring compliance obligations, assign owners and record the evidence, cycle by cycle.

  • Adopt controls from the Compliance Library — ISO 27001, SOC 2, GDPR, Sri Lanka PDPA and more — as your own editable copies
  • Cycles and assessments whose scope is fixed the moment they open
  • Coverage and maturity scoring, withheld below a coverage floor you set
More about Compliance and Control Tracker
Small business and up

Regulatory change management software

Regulatory Change

The regulations, standards and frameworks that apply to you — who owns each, whether it is still applicable, and the work to comply with it tracked in its own issue register.

  • Add a regulation from the Compliance Library — its issuer, jurisdiction and editions come with it — or type in one the library does not carry
  • An owner, a status and a rationale for every entry, with the units and jurisdictions it applies to
  • Create an implementation register in Issue & Remediation from the regulation in one click, or link one you already run
More about Regulatory Change

Other countries