23 September 2026 · 7 min read · Oscar Markham
GDPR basics for an Irish small business website
Most Irish small business websites are not compliant, and most of the advice about it is either sold by someone with a product or so vague it is useless. Here is the practical version: what actually applies to a small site, in plain terms. This is general information rather than legal advice, and anything unusual is worth a solicitor's time.
Cookies and consent
The rule is prior consent. Analytics, advertising pixels and anything that tracks a visitor must not load until the visitor agrees. A banner that says 'by continuing you accept' is not consent, and neither is a banner that loads the trackers and then asks.
Accept and Reject must be equally easy. A prominent Accept with a hidden Reject is the most common failure on Irish sites and it is one the Data Protection Commission has been explicit about.
What counts as necessary
Strictly necessary cookies do not need consent — the ones that keep a session alive or remember a basket. Analytics is not strictly necessary, however useful you find it. Neither is a Meta pixel.
The practical consequence is that your analytics will under-report once you do this properly. That is the correct number, not a loss.
Contact and enquiry forms
You need a lawful basis, which for an enquiry form is usually that processing is necessary to respond to the request. You do not need consent to reply to somebody who contacted you.
You do need to say what you do with the data, how long you keep it, and who else sees it — which includes the form provider, your email host and anyone else in the chain.
- Say what you collect and why, in plain language
- Name the third parties: form provider, email host, analytics, ad platforms
- State a retention period and actually apply it
- Keep marketing consent separate from the enquiry itself
- Give a contact point for data requests
Marketing email
An enquiry is not consent to a newsletter. If you want to send marketing, ask separately with an unticked box, and keep a record of when and how consent was given.
There is a narrow exemption for existing customers being sold similar products, but it is narrower than most businesses assume and it still requires an opt-out in every message.
What actually happens if you ignore it
For a small business, the realistic risk is a complaint rather than a fine, and complaints usually come from a competitor or a disgruntled customer rather than from a regulator sweeping the internet.
The more immediate cost is commercial: enterprise customers and public sector buyers increasingly ask, and a site with no privacy notice at all is an easy reason to be dropped from a shortlist.
Written by Oscar Markham, founder of Dublin Growth Digital. We run lead generation for Irish estate agents and trades, reported every Friday in enquiries and booked work.