- The law
- ePrivacy Regulations (S.I. No. 336 of 2011) regulation 13; GDPR; Data Protection Act 2018
- Who enforces it
- Data Protection Commission (DPC)
- Penalties
- A criminal offence for each email: up to €5,000 per email on summary conviction, or up to €250,000 (companies) or €50,000 (individuals) on indictment
What it means for your email
- Marketing emails to individuals need their consent first. The DPC says this is consent in the GDPR sense: freely given, specific, informed and unambiguous, by a clear affirmative action.
- Silence, pre-ticked boxes and inactivity are not consent.
- If consent is in question, the law puts the onus on the sender to show the person unambiguously consented.
- The existing-customer exception lets you email a customer without consent, but only if every condition is met.
- Each unsolicited email sent in breach is a separate offence.
Do
- Use a clear opt-in that is kept separate from other terms.
- Keep a record of how and when each person consented, so you can prove it.
- Use the existing-customer exception only where you got the email address from the customer in the context of a sale, and you market your own products or services of a kind similar to what they bought.
- Give customers a clear, easy and free chance to object when you collect their details, and in every message after.
- Send the first marketing email within 12 months of the sale. After that, you can keep emailing as long as no more than 12 months pass between marketing emails.
Don't
- Don't email people who browsed or abandoned a basket but never bought, unless they consented.
- Don't use the exception to promote another company's products, even a friendly one.
- Don't use pre-ticked boxes or opt-out wording to gather consent.
- Don't email anyone who has told you they object.
Good to know
- Emails to companies and other organisations (not natural persons) don't need consent, but you must stop if they tell you they don't consent.
- An email to an address that reasonably appears to be used mainly for someone's work, about that work only, is not treated as unsolicited marketing to an individual. You must still stop if they object.
- The DPC can prosecute offences in the District Court.
Sources
- S.I. No. 336/2011: European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (Irish Statute Book)
- FAQ on Consent for Electronic Direct Marketing (Data Protection Commission)
- Guidance for Retailers Issuing e-Receipts (Data Protection Commission)
Researched by Mailfois · 2026/27 edition · checked 20 October 2026
Not legal advice. This is a plain-English summary. Check the sources for anything specific, or take professional advice. Spotted something out of date? Email [email protected] and we'll credit you if you'd like.