S.I. No. 215/2026 - Automatic Enrolment Retirement Savings System Regulations (Amendment) Regulations 2026
Notice of the making of this Statutory Instrument was published in | ||
“Iris Oifigiúil” of 26th May, 2026. | ||
I, DARA CALLEARY, Minister for Social Protection, in exercise of the powers conferred on me by sections 3 and 112 of the Automatic Enrolment Retirement Savings System Act 2024 (No. 20 of 2024) HEREBY MAKE the following Regulations: | ||
Citation | ||
1. These Regulations may be cited as the Automatic Enrolment Retirement Savings System Regulations (Amendment) Regulations 2026. | ||
Definitions | ||
2. In these Regulations— | ||
“the Principal Regulations” means the Automatic Enrolment Retirement Savings System Regulations 2025, S.I. No. 637 of 2025 ; | ||
“the 2024 Act” means the Automatic Enrolment Retirement Savings System Act 2024 (No. 20 of 2024). | ||
Commencement | ||
3. These Regulations shall come into operation on 1 June 2026. | ||
Interpretation | ||
4. In these Regulations, save where the context otherwise requires— | ||
(a) a reference to a section is to a section of the 2024 Act; | ||
(b) a reference to a Part or an article is to a Part or article of these Regulations; | ||
(c) a reference to a Schedule is to a Schedule to these Regulations; | ||
(d) a reference to a sub-article is to a sub-article of the article in which the reference occurs, and | ||
(e) a reference to a paragraph is to a paragraph of the sub-article or article in which the reference occurs; | ||
(f) a reference to a sub-paragraph is to a sub-paragraph of paragraph in which the reference occurs. | ||
Definition | ||
5. Article 2 of the Principal Regulations is amended by the insertion of the following definition after the definition of “the Authority’s Medical Assessor”: | ||
“the GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 20161 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);” | ||
Data protection | ||
6. The Principal Regulations are amended by the insertion of the following Part after Part 7: | ||
“Part 7A | ||
DATA PROTECTION | ||
Permissible types and forms of processing | ||
32A. The following are prescribed, pursuant to section 112(a), as the types and forms of processing which may be carried out for the purposes of the 2024 Act: | ||
(a) processing that is necessary and proportionate for compliance with all legal obligations arising under, or in consequence of, the 2024 Act; | ||
(b) processing that is necessary and proportionate for the performance of the tasks carried out in the public interest or in the exercise of official authority vested in the Authority. | ||
Personal data that may be processed | ||
32B. The following are prescribed, pursuant to section 112(b), as personal data that may be processed for the purposes of the 2024 Act: | ||
(a) data, the processing of which is necessary and proportionate for compliance with all legal obligations arising under, or in consequence of, the 2024 Act; | ||
(b) data, the processing of which is necessary and proportionate for the performance of the tasks carried out in the public interest or in the exercise of official authority vested in the Authority. | ||
Circumstances in which personal data may be processed | ||
32C. The following are prescribed, pursuant to section 112(c), as circumstances in which personal data may be processed for the purposes of the 2024 Act: | ||
(a) in circumstances where the processing of such data is necessary and proportionate for compliance with all legal obligations arising under, or in consequence of, the 2024 Act; | ||
(b) in circumstances where the processing of such data is necessary and proportionate for the performance of the tasks carried out in the public interest or in the exercise of official authority vested in the Authority. | ||
Persons to whom personal data may be disclosed | ||
32D. The following are prescribed, pursuant to section 112(c), as persons to whom personal data may be disclosed by the Authority, for the purposes of the 2024 Act: | ||
(a) a specified body, within the meaning of section 108(5), but only where such disclosure is necessary and proportion for the purpose of the performance of a function of the Authority the specified body under the 2024 Act; | ||
(b) a service provider engaged under section 32, but only to the extent that is necessary and proportionate for the performance of the Authority’s functions under the 2024 Act, and where the Authority has put in place an appropriate data processing contract with the service provider; | ||
(c) the Minister for Enterprise, Tourism and Employment, and the Workplace Relations Commission, but only to such extent as is permissible under section 109(1). | ||
Measures to be taken to safeguard fundamental rights and freedoms of data subjects | ||
32E. The following are prescribed, pursuant to section 112(d), as suitable and specific measures to be taken by the Authority, to safeguard the fundamental rights and freedoms of data subjects in the processing of personal data, including special categories of personal data under this Act, for the purposes of the 2024 Act: | ||
(a) the data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures; | ||
(b) the Authority shall impose limitations on access to the personal data processed by or on its behalf in order to prevent unauthorised consultation, alteration, disclosure or erasure of personal data; | ||
(c) the Authority shall ensure that specific targeted training, regarding data protection norms and obligations, is given to those involved in its processing operations; | ||
(d) having had regard to— | ||
(i) the state of the art, | ||
(ii) the context, nature, scope and purposes of its data processing; and, | ||
(iii) the likelihood of risk to, and the severity of any risk to, the rights and freedoms of data subject, | ||
the Authority shall ensure— | ||
(I) that, where the Authority deems it necessary, personal data is held on an encrypted basis; | ||
(II) that logging mechanisms are in place to permit verification of whether and by whom personal data have been consulted, altered, disclosed or erased; | ||
(III) that, where the Authority deems it necessary, personal data is pseudonymised. | ||
Additional measures to safeguard the processing of data relating to the health of a data subject | ||
32F. The following are prescribed, pursuant to section 112(e), as additional measures to be taken to safeguard the processing of data relating to the health of a data subject, for the purposes of the 2024 Act: | ||
(a) the data shall be consulted and used only by— | ||
(i) such members of the staff of the Authority (within the meaning of section 30(1)) as are designated from time to time by the chief executive for the purposes of this sub-paragraph as the persons to deal, in the first instance, with applications for early payment; | ||
(ii) such member or members of the staff of the Authority (holding a more senior grade than the staff members referred to in sub-paragraph (i)) as are designated from time to time by the chief executive for the purposes of this sub-paragraph as persons entitled to consult and use such data in the context of a review pursuant to section 114; | ||
(iii) the chief executive, or such other member of the staff of the Authority who reports directly to the chief executive and is designated from time to time by the chief executive to for the purposes of this sub-paragraph; | ||
(iv) an appeals officer within the meaning of section 115; | ||
(v) the Authority’s Medical Assessor; | ||
provided that and no such person may consult and use such data except when a specific and legitimate need to do so has arisen; | ||
(b) the data may be consulted and used in the context of any appeal to the High Court under section 117, or in any other legal proceedings properly commenced in a court of competent jurisdiction, but only to such extent as is necessary for the proper conduct of such proceedings; | ||
(c) it shall not be permissible for such data to be shared pursuant to section 108 or section 109.” | ||
Fixed Payment Notices: Prescribed amounts | ||
7. Article 35 of the Principal Regulations is amended by the insertion after paragraph (a) of the following paragraph: | ||
“(aa) €250 in the case of the offences under sections 50(8) and 53(9);”. | ||
| ||
GIVEN under my Official Seal, | ||
21 May, 2026. | ||
DARA CALLEARY, | ||
Minister for Social Protection. | ||
EXPLANATORY NOTE | ||
(This note is not part of the Instrument and does not purport to be a legal interpretation.) | ||
These Regulations are designed to exercise powers conferred on the Minister of Social Protection by the Automatic Enrolment Retirement Savings System Act 2024 (the Act) to give more detail to the operation of that system where it is warranted. | ||
These relate to: | ||
(i) The arrangements relating to the data protection provisions set out in the Act. | ||
(ii) The arrangements in relation to the fixed payment notices provisions that the Authority may use in the event of an employer failing to give notice to an employee of the determination to the employee’s enrolment and the date of their enrolment. | ||
