Unsolicited Marketing and Your Rights Under the Data Protection Act

The Data Protection Act, 2019 gives individuals real, enforceable rights over how their personal data is collected and used — and gives organisations real, enforceable obligations.

For individuals

You have the right to know why your data is being processed, to withdraw consent, and to object to processing for direct marketing specifically. Unsolicited marketing without valid consent is a recognised basis for a formal complaint to the Office of the Data Protection Commissioner (ODPC) — a process that doesn't require a lawyer, though one can make it faster and more precisely framed.

For organisations

Businesses that collect customer data — including for marketing — must have a lawful basis for processing, a clear privacy policy, and mechanisms for people to withdraw consent. Organisations handling data at scale may also need to register with the ODPC and appoint a data protection officer.

Where we come in

We draft data protection policies, conduct compliance audits, handle ODPC registration, and represent both complainants and organisations responding to complaints or investigations.

This article is general information, not legal advice, and reflects the law as it currently stands. Rates, fees, and procedures are subject to change.