GDPR IT Compliance Checklist for Irish Businesses

Why your IT team owns most of GDPR

The DPC (Data Protection Commission) enforces GDPR in Ireland and has issued fines against organisations of every size, including SMEs. Most breaches that trigger DPC investigations are not caused by bad legal documents: they are caused by poor IT security. Data left unencrypted on a stolen laptop, personal data emailed to the wrong address because of an autocomplete error, a breach through an unpatched server.

Your solicitor can sort out the data processing agreements and privacy policy. What follows is the IT side of the house, the technical and organisational measures (TOMs) that Article 32 of GDPR requires.

The IT compliance checklist

1. Encryption at rest

Any device that stores personal data, laptops, desktops, servers, NAS drives, must have full-disk encryption enabled. On Windows this means BitLocker. On macOS it means FileVault. On servers it means LUKS or equivalent.

If a staff member's laptop is stolen and BitLocker is active, the DPC considers the data protected, the incident still needs to be logged, but there's no reportable breach. If encryption is off, you have a reportable breach and potentially a fine.

2. Encryption in transit

Personal data transmitted over the internet must travel over an encrypted connection. HTTPS for web applications. TLS for email. A VPN for staff connecting to internal systems from home or public Wi-Fi.

Relying on "we use HTTPS for our website" is not enough. Internal systems accessed over unencrypted connections (HTTP, FTP, plain SMB over the internet) are out of compliance.

3. Access controls

Staff should only be able to access personal data they need for their role, the principle of least privilege. In practice this means:

• Individual user accounts (no shared logins)
• Role-based permissions on file shares and systems
• Admin rights only for staff who genuinely need them
• Prompt account deprovisioning when staff leave

4. Multi-factor authentication

Every account that can access personal data should require MFA, especially email, cloud storage, and any web-based systems. Passwords are routinely compromised in credential stuffing attacks. MFA stops the majority of account takeovers even when a password is known.

This applies to Microsoft 365, Google Workspace, CRM systems, accounting software, and any remote access method.

5. Patch management

Unpatched software is the most common vector for ransomware and data theft. GDPR requires “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures.” In practice this means: Windows Update is on and not suppressed. Server software is updated within a reasonable timeframe. Third-party applications (browsers, Office, PDF readers) are kept current.

6. Backup and recovery

Article 32 explicitly requires "the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.” You need tested backups. Untested backups are not backups.

A backup strategy should include: at minimum one off-site copy, a defined recovery time objective (how long can you be down?), and a documented test of restoration at least once per year.

7. Audit logging

You need to be able to demonstrate what happened with personal data. Who accessed it, when, and from where. This requires audit logs on file servers, email systems, and any application that holds personal data. Logs need to be retained for a meaningful period (typically 12 months) and stored somewhere they can't be tampered with.

8. Incident response plan

GDPR requires you to notify the DPC within 72 hours of becoming aware of a breach that poses a risk to individuals. You cannot meet that deadline if you don't have a plan. The plan needs to cover: how you detect a breach, who decides whether it's reportable, and who files the notification.

9. Staff training

Most data breaches involve a human element, a phishing email clicked, a file emailed to the wrong address, a password shared. Annual GDPR and security awareness training for all staff is a technical and organisational measure. It also demonstrates due diligence if you ever face an investigation.

What RAIT can do

We carry out IT compliance assessments for Irish businesses, a structured review of your infrastructure against these requirements, with a prioritised remediation plan. Most clients are surprised how few actual changes are needed once the gaps are identified clearly.