From 25 May 2018 the Act ceased to apply to the processing of personal data, other than processing for the purposes of safeguarding the security of the State, the defence of the State or the international relations of the State, or processing under the Criminal Justice (Forensic Evidence and DNA Database System) Act 2014 or the Vehicle Registration Data (Automated Searching and Exchange) Act 2018 to the extent this Act is applied in those Acts. The Act remains applicable to complaints under section 10 and to contraventions that occurred before 25 May 2018 (see section 8 of the Data Protection Act 2018 (No. 7)).

An appeal may be made to the Court against a requirement in an enforcement or information notice, a prohibition in a prohibition notice, and a decision of the Commissioner under section 10(1)(a); appeals must be brought within 21 days of service or receipt. The Court’s jurisdiction is exercised by the judge assigned to the appellant’s circuit or, at the appellant’s option, by a judge assigned to the Dublin circuit. A Court decision is final subject to appeal to the High Court on a point of law. Where an appeal is brought in time and the Commissioner has stated that urgent compliance is required by reason of special circumstances, the Court may determine that non-compliance during the appeal period does not constitute an offence.