This Flowchart illustrates how to manage a data protection breach (including a cybersecurity breach) under the EU General Data Protection Regulation (EU GDPR). It reflects personal data breach reporting and recording requirements under the EU GDPR together with data breach management guidance issued by the Irish Data Protection Commission (DPC). It maps out a data breach process, providing guidance and links to relevant precedents for each stage of that process. See Precedents: Ireland—Personal data breach plan, Ireland—Data breach report form—internal and Ireland—Data breach assessment and action plan, which guide you through each stage of this workflow. Note 1—assemble data breach team The first step is to assemble your data breach team. Consider who within the organisation would be best placed to react swiftly to the breach and who should be involved with the subsequent investigation (it may also involve externals).The DPC’s data breach notification guide offers practical advice on managing data breaches and navigating the mandatory notification regime introduced by the EU GDPR. It underscores the necessity for organisations to have procedures in place for breach detection,

This Precedent personal data breach plan can be used by organisations to inform their staff and managers of the actions to take on discovering a personal data breach (including a cybersecurity breach). It reflects reporting requirements in the EU General Data Protection Regulation (GDPR) and takes into account relevant guidance from the Data Protection Commission (DPC). It incorporates a process for dealing with actual or suspected personal data breaches. A personal data breach plan may also be known as a data breach policy. This Precedent can also be used for cybersecurity breaches that involve the loss of, damage to or unauthorised access to personal data. On discovering a data breach, the first thing you should do is assemble a data breach team comprising the various people within your organisation who are best placed to respond to the breach, eg the data protection officer (if you have one), risk partner, head of IT, head of compliance, head of legal and, if employee data is involved, your head of HR. Having assembled your data breach team, you can then take appropriate

General rule If a person is claiming damages in respect of personal injuries caused by negligence, nuisance or breach of duty, they have two years from the date on which the cause of action accrued or the date of knowledge (whichever is later) of the person injured ( Statute of Limitations (Amendment) Act 1991 (Ireland), s (3)(1) (SLAA 1991 (IRL)). The Legal Services Regulation Act 2015 (Ireland), s 221 seeks to extend the statute of limitations for clinical negligence actions to three years. This provision remains uncommenced. Date of knowledge Sometimes in personal injuries actions, the harm might have occurred, but the person may not have been aware that such harm has occurred and thus, would not think of pursuing a claim. The time limit of two years from the ‘date of knowledge‘ means that a plaintiff has two years from when they know they have been injured to pursue a claim. SL(A)A 1991 (IRL), s 2(1) defines ‘date of knowledge‘ as the date on which the person first

This Practice Note provides an outline of the key elements of personal injury litigation in Ireland. It considers applications to the Injuries Resolution Board and personal injuries actions in the District Court, Circuit Court and High Court. This Practice Note sets out the key elements of personal injury litigation. This area is a broad one and covers the entire spectrum of injuries—from trip and fall accidents to medical negligence. The process governing personal injuries actions is highly regulated and was recently overhauled by the commencement of the Judicial Council Guidelines and the Resolution Board Act 2022 (Ireland) (PIRBA 2022 (IRL)). This Practice Note will cover the procedure to be followed in bringing a personal injuries case in each of the relevant courts and will deal with the following topics: • the Personal Injuries Assessment Board Act 2003 and PIRBA 2022 (IRL) • the Judicial Council Personal Injuries Guidelines • Injuries Resolution Board applications and authorisations • statutory time limits • issuing proceedings • adding

This Practice Note will cover general damages in respect of personal injuries and will deal with the following topics: • What are general damages • Personal Injuries Resolution Board (PIRB) • Level of damages in each court • Book of Quantum (BOQ) • Personal Injuries Guidelines (PIG) • Assessing damages for multiple injuries • How payments of damages awards are made • Reduction in awards of general damages What are general damages General damages are a form of compensation paid to someone for the pain and suffering they have endured as a result of a personal injury. This compensation includes pain and suffering to date and into the future. It covers both physical and psychiatric injuries. General damages are different to special damages, which are damages for out-of-pocket expenses (such as medical or travel expenses) and loss of earnings which a person has suffered as a result of the personal injury. When assessing general damages, there should be an assessment of the loss of capacity of the victim’s ability

This Practice Note will cover special damages in respect of personal injuries and will deal with the following topics: • What are special damages • Injuries Resolution Board (IRB) • Loss of earnings and Recovery of Benefits and Assistance (RBA) scheme • Future loss of earnings • Calculating future losses • Duty to mitigate losses • Fraudulent claims What are special damages Special damages refer to out-of-pocket expenses and loss of earnings that a person incurs as a result of their personal injury. Past special damages are losses that the person has already incurred, and are usually verified by vouching documentation, such as receipts. These can include payments made in relation to medical expenses, travel and loss of earnings that a person incurred. Special damages can also continue into the future, and include items such as future medical expenses, future care costs or future loss of earnings. Special damages differ from general damages, as they directly relate to losses incurred or out-of-pocket expenses. Special damages are not covered by the

Introduction The Planning and Environment Court is a specialised division of the Irish High Court designed to provide efficient and proportionate case management of legal actions, judicial reviews, and disputes related to planning and environmental law. The Planning and Environmental Court was established with effect from 11 December 2023 by Practice Direction HC124. PD HC137 took effect on 13 April 2026 and was amended with effect from 1 August 2026. The purpose of this Practice Note is to summarise the rules governing practice and procedure in this specialised list. For an overview of the civil courts in Ireland and the principal features of each level of civil court, see Practice Note: Ireland—Civil courts structure. Applicable legislation and rules of court The governing legislation of planning and environmental cases, the Planning and Development Act 2024 (Ireland) (PDA 2024 (IRL)) has been enacted and is being implemented in a staged manner. This has resulted in significant planning reform that the Planning and Environmental Court has had to adapt to accommodate. The

This Precedent is a sample parental leave policy for inclusion in a staff handbook or use as a stand-alone policy. The policy reflects the basic rights under the Parental Leave Acts. The basic statutory right is to take 26 weeks of unpaid leave per child up to the 12th birthday of that child (or the 16th birthday in the case of a child who has a disability or a long-term illness). Discrimination issues When drafting and operating this policy the employer will need to bear in mind discrimination issues. Direct discrimination on the grounds of sex could for example arise if an employer operated the policy differently as between male and female staff, or relaxed rules in the policy only for one sex. Parental leave The legislation provides for certain basic rights which cannot be reduced by agreement with employees, whether that agreement is by a workforce or collective agreement or individually with employees. However, the legislation does give employers some flexibility as to how the parental leave is arranged. Check with the employer before drafting whether there are any existing contractual rights to

1 Introduction 1.1 Paragraph 1.1—Introduction: rights to take parental leave Parent’s leave is a protected statutory right in Ireland available to each parent in the two years following the birth of their child, or in the case of adoption, in the two years following placement of the child with the family. The length of parent’s leave available to each parent of the relevant child is nine weeks (for children born or placed after 1 August 2024), pursuant to the Parent’s Leave and Benefit Act 2019 (Ireland), 5(1) (PLBA 2019 (IRL)) as amended by the Family Leave and Miscellaneous Provisions Act 2021 (Ireland). The length of parent’s leave was increased in 2024, therefore for parents whose children were born or adopted before 1 August 2024 and were still under two years old (or in the case of adoption, had been placed with the family less than two years prior), they are entitled to the full nine weeks leave rather than the previous period of seven weeks leave. The additional two weeks’ leave must be taken on or before the relevant child’s second

This Precedent is a sample policy (stand alone or for inclusion in a staff handbook) setting out the employer’s approach if employees are late for work or cannot make it into work at all because of adverse weather, transport disruption or other major incidents affecting travel or public safety. The policy outlines employees’ responsibilities to attend work during periods of adverse weather conditions or transport disruption, how the employer will treat any absences and the appropriate procedures to be followed. For further information on the legal position for employers and employees where such absences occur, and the practical steps that can be taken by businesses, see WRC guidance: Absence during extreme weather events. 1 Introduction Paragraph 1.1—Introduction Add the words in square brackets if the employer has more than one site. Employers should ensure that a degree of flexibility and discretion is exercised when deciding how to deal with employee absence. Hard and fast rules are rarely appropriate. Employers should take a pragmatic approach and deal with situations on a case-by-case basis, taking into account a range of considerations

This Precedent is an internal-facing bring your own device (BYOD) policy for use in relation to employees, other workers and contractors (staff), designed to be used with other policies and privacy notices. It is intended for all staff who bring their own computing devices (eg laptops or smartphones) to work and use these to connect to the company’s IT systems. Its main aim is to ensure Company information is adequately protected. This Precedent takes into account the requirements under Regulation (EU) 2016/679 (EU GDPR) and the Data Protection Act 2018 (Ireland) (DPA 2018 (IRL)), and guidance from the Data Protection Commission (DPC) and European Data Protection Board (EDPB). This Precedent has been drafted in short form and plain, non-technical English so that it can be easily understood. It is also intended to supplement other related policies such as those covering data protection and information security, see Ireland—Policy—data protection and Ireland—Policy—information security.. This policy will need to be adapted to reflect the technical basis on which access is granted to company IT

General This Precedent is an internal-facing data protection policy for use in relation to employees, or other workers and contractors. This material considers the EU GDPR regime, and legislative links are to Regulation (EU) 2016/679, General Data Protection Regulation (EU GDPR) and Data Protection Act 2018 (Ireland) (DPA 2018 (IRL)), except where expressly stated otherwise. This Precedent takes into account guidance issued by the Data Protection Commission (DPC). It also takes into account the Data Protection Commission (DPC), the European Data Protection Board (EDPB) and its predecessor, the Article 29 Working party. It identifies, at a high level: • how the employer complies with its obligations under Regulation (EU) 2016/679, EU GDPR and DPA 2018 (IRL), in particular the data protection principles which the employer, as a controller, is required to follow • how staff are expected to handle personal data and sensitive personal data (special category data under EU GDPR and DPA 2018 (IRL)) • the role of the data protection officer (DPO), if there is one • the need for staff to seek further guidance from the DPO or other role holder