Irish email marketing law: the ePrivacy Regulations and GDPR

The short version

Marketing email in Ireland is governed by the ePrivacy Regulations (S.I. No. 336 of 2011, regulation 13) together with the GDPR and the Data Protection Act 2018. The Data Protection Commission (DPC) enforces them. It comes down to four things:

• Consent: email individuals only with their clear opt-in consent, unless the narrow existing-customer exception applies.
• The 12-month rule: that exception only lasts 12 months from the sale, unless you keep emailing the customer within that time.
• Identify yourself: never hide who the email is from, and give a valid address to contact you and to ask you to stop.
• Stop when asked: emailing someone who has objected is a criminal offence.

Ireland and the UK started from the same EU rules, so they look alike. They differ in ways that catch out teams who run Ireland from a UK plan: see how Ireland differs from the UK below.

Consent: a clear opt-in

Marketing emails to individuals need their consent first. The DPC says this is consent in the GDPR sense: freely given, specific, informed and unambiguous, given by a clear affirmative action.

• Silence, pre-ticked boxes and inactivity are not consent.
• Keep the opt-in separate from your other terms, and say what people are signing up for.
• If consent is ever in question, the regulations put the burden on you to show the person unambiguously consented. Keep a record of how and when each person agreed.

The existing-customer exception, and its 12-month limit

You can email an existing customer without asking for consent first, but only if every condition in regulation 13(11) is met:

1. You got their email address from them, in the context of a sale of a product or service.
2. You're marketing your own products or services, of a kind similar to what they bought.
3. They were clearly and distinctly given the chance to object, easily and free of charge, when you collected their details, and are given it again in every message.
4. The sale happened no more than 12 months before the email, or you have emailed them for marketing within that 12-month period.

The fourth condition is the one UK-based teams most often miss. In practice: if a customer bought once and you haven't emailed them for over a year, the exception has lapsed for them, and you need consent.

The exception doesn't cover people who browsed or abandoned a basket but never bought, and it never covers another company's products, even a partner's.

Business addresses

• Emails to companies and other organisations (not individuals) don't need consent, but you must stop if they tell you they don't consent.
• An email to an address that reasonably appears to be used mainly for someone's work, about that work only, isn't treated as unsolicited marketing to an individual. You must still stop if they object.

What every email must include

Regulation 13(12) says a marketing email must not:

• disguise or conceal the identity of the sender it was sent on behalf of;
• encourage people to visit a website that breaks the e-commerce rules on commercial communications (S.I. No. 68 of 2003, regulation 8); or
• lack a valid address where the recipient can ask you to stop.

The e-commerce rules add that a commercial email must be clearly identifiable as one, the person it's sent for must be clearly identifiable, and offers and promotional competitions must be clearly identifiable with their conditions easy to find. In practice: a from name and footer that name the real brand, your contact address, a working unsubscribe link, and links to the terms of any offer or prize draw.

Unsubscribes

• Every marketing email needs a working way to opt out. The DPC says a valid means of opting out must be included in every message, and many senders use an unsubscribe link.
• Opting out must be easy and free. Don't make people log in or create an account.
• Neither the regulations nor the DPC set a number of days to act on an opt-out. Stop promptly: any marketing email sent after someone has objected risks an offence.
• Under GDPR article 21, people can object to direct marketing at any time, and their data must then no longer be used for it. Keep a suppression list and apply it across every list and tool.

Enforcement and penalties

Breaking regulation 13 is a criminal offence, and each email is a separate offence. The DPC can prosecute in the courts. Under regulation 13(15), each offence carries:

• on summary conviction, a class A fine (up to €5,000); or
• on indictment, up to €250,000 for a company or €50,000 for an individual.

So a single campaign to people who didn't consent can be many offences at once. Separately, how you collect and use personal data is subject to the GDPR and the DPC's powers under it.

How Ireland differs from the UK

• The 12-month limit. Ireland's existing-customer exception lapses after 12 months without marketing contact. The UK's soft opt-in has no such time limit.
• Criminal, per email. Irish breaches are criminal offences prosecuted email by email. In the UK, the ICO mainly uses civil fines, now up to £17.5 million or 4% of global turnover since February 2026 (see PECR changes in 2026).
• EU GDPR, not UK GDPR. Ireland follows the EU GDPR, and the DPC is the regulator, not the ICO.
• Business addresses. Ireland's rules for company addresses and work addresses are worded differently from the UK's corporate-subscriber rules. Check them on their own terms rather than assuming the UK approach carries over.

If you send to both, treat Ireland as its own market in your plan, with its own consent records and its own check before sign-off. See the UK email marketing law guide for the UK side.

A practical checklist for Ireland

• Consent is a clear, separate opt-in, recorded with how and when.
• Customers emailed under the exception bought from you, were offered an opt-out at the time, and have had a marketing email within the last 12 months.
• No marketing to browsers, basket abandoners or partners' customers without consent.
• The from name and footer name the real brand, with a contact address.
• A working, free unsubscribe in every email, tested before sign-off.
• Objections suppressed across every list and tool, promptly.
• Offers and prize draws clearly labelled, with their terms one click away.

The pre-send checker flags a missing unsubscribe or postal address before you send, and Mailfois Upkeep can bring round a consent audit and the unsubscribe check on a schedule, with a record.

Frequently asked questions

Do I need consent to send marketing emails in Ireland?

Yes, for individuals. You need clear opt-in consent unless the existing-customer exception applies, and that exception only lasts 12 months from the sale without further marketing contact.

Is Ireland's soft opt-in the same as the UK's?

No. Both cover existing customers and similar products, but Ireland adds a 12-month limit: the sale must be within 12 months, or you must have emailed the customer within that period.

Who enforces email marketing law in Ireland?

The Data Protection Commission (DPC). It can prosecute breaches of the ePrivacy Regulations in the courts.

What are the penalties?

Each email sent in breach is a separate criminal offence: a class A fine (up to €5,000) on summary conviction, or up to €250,000 for a company or €50,000 for an individual on indictment.

Can I email business addresses without consent in Ireland?

Emails to companies and other organisations don't need consent, and nor do work emails to an address used mainly for work, about that work. In both cases you must stop if they object.

Sources

• S.I. No. 336/2011: the ePrivacy Regulations, regulation 13 (Irish Statute Book)
• S.I. No. 68/2003: the e-commerce regulations (Irish Statute Book)
• Fines Act 2010, section 3: a class A fine is up to €5,000 (Irish Statute Book)
• FAQ on consent for electronic direct marketing (Data Protection Commission)
• Can customers object to electronic direct marketing? (Data Protection Commission)