Charging for parking on your Irish business land — what the DPC cares about more than you'd think

~10 minute read · written by Mehrdad, founder of Mekavo

Ireland sits in an unusual position in European data law. The Data Protection Commission (DPC) is the lead supervisory authority for nearly every American big-tech company operating in the EU — Google, Meta, TikTok, Apple, Microsoft and several others all have their European headquarters in Dublin. That regulatory weight, and the institutional muscle built up around it, spills over into how the DPC treats every other data controller in the country, including a B&B with eight parking spaces in Killarney.

The result, in practice, is that Ireland enforces GDPR at the small-operator level more strictly than almost any other country in Europe. France, Germany and the Netherlands have higher headline-fine totals because their regulators target tech multinationals. Ireland's DPC has both the headline tech cases and a steady stream of smaller enforcement actions against ordinary Irish businesses — many of which did not realise they were processing personal data at the scale that triggered the rules.

For paid-parking operators, the practical question is simple: do you intend to capture vehicle registration plates? If yes, you are processing personal data under GDPR — vehicle registration is "personal data" under the regulation's definition because it can be combined with the Driver and Vehicle Licensing Agency database to identify a person. If you can answer "no" honestly (software-only payment, no cameras, no plate-capture), most of this article does not apply to you and your operating overhead is genuinely small. If you intend to use cameras or any form of plate recognition, read on carefully.

The federal-EU rule — GDPR Article 6 lawful basis

Under GDPR Article 6, any processing of personal data must have at least one of six lawful bases. For private parking, the realistically available ones are:

1. Consent (6.1.a) — the driver gave informed, specific, freely-given consent. In a parking context, this is almost impossible to satisfy: a sign at the entrance does not give "freely given" consent because the driver cannot meaningfully refuse without leaving.
2. Contract (6.1.b) — processing is necessary for performance of a contract with the data subject. This is the cleanest basis: when the driver pays, a contract is formed; processing the registration plate to issue a receipt and to associate the payment with the bay falls within contract.
3. Legitimate interests (6.1.f) — processing is necessary for a legitimate interest of the controller, not overridden by the data subject's rights. This is the most stretched and most disputed basis. It can support some processing — e.g., investigating a single complaint about a specific vehicle — but it does not generally support 24/7 ANPR surveillance of every plate at a small site.

The DPC has consistently held in published decisions that routine ANPR enforcement at small private sites is not justifiable under "legitimate interests" when a less-intrusive alternative (software-only payment with no plate capture) achieves the same legitimate business goal. The "necessary" word in legitimate interests does real work.

The Data Protection Act 2018 (Ireland) — what it adds on top

Ireland implemented and supplemented GDPR through the Data Protection Act 2018. For small operators, the supplementary obligations that matter are:

• Data Protection Impact Assessment (DPIA) requirement (s. 84 plus the DPC's published list) — operating ANPR cameras for enforcement is on the DPC's prescribed-DPIA list. You must complete and document a DPIA before deployment.
• Records of processing (Article 30 GDPR) — even small operators using cameras must maintain a written record of their processing activity. Pure software-only payment operators may qualify for the small-organisation exemption.
• Privacy notice — a visible notice at the camera site explaining who you are, why you are recording, what you do with the footage, and how a driver can exercise their rights under GDPR. Not a small sticker; a properly-readable notice.

The DPC has been clear in published guidance and enforcement actions that none of these are paperwork-formalities — they are substantive requirements and their absence is itself an enforcement-justifying breach.

The "Beavis" question — what Irish courts have actually held

Operators familiar with UK parking law often assume the Beavis-style enforcement logic applies in Ireland. It largely does not. Irish courts have approached private parking charges through a more conventional contract-law lens, with stricter scrutiny of penalty-clause arguments. A "PCN" model that relies on a deterrent-style charge that is several multiples of the underlying parking fee has a harder reception in Irish courts than in courts across the water.

The practical effect on a small Irish operator: an aggressive PCN model with a $100-equivalent charge for an overstay on a $5 hourly rate is more likely to be struck down than upheld. The cleaner path — and the one that survives every court and tribunal review — is the simple posted rate with an obvious payment mechanism. Charge fairly, take payment efficiently, treat non-payers as the cost of doing business at small scale.

Rural Ireland — pubs, B&Bs, garden centres, and the "free for customers" myth

The most common Irish small-operator parking situation is not the urban car park. It is the rural premises — the country pub, the B&B, the garden centre, the agritourism site — whose parking is plentiful at off-peak times and oversubscribed in the season. The traditional rule has been "free for customers, paid for outsiders". The 2026 reality is that this is harder to maintain than it sounds:

• How do you tell who is a customer? The B&B owner can match to a booking; the pub owner cannot.
• Enforcing "non-customers" requires either a check at exit or some form of registration capture — both of which step into camera/GDPR territory immediately.
• The honest framing for most rural operators is "paid for everyone, with a code or voucher for customers" rather than the reverse. This eliminates the enforcement question entirely.

This is also the form most rural operators settle on after a year of running the lot. The economics are similar to "free for customers"; the operational overhead is dramatically lower; the DPC exposure is zero.

Occupiers' liability — the other half of the duty

Irish occupiers' liability sits in the Occupiers' Liability Act 1995. The Act distinguishes between visitors (entered the premises with permission, including for business purposes), recreational users (entered with permission but for a non-commercial purpose), and trespassers. The duty owed varies sharply between these.

When you charge for parking, every driver who pays is a "visitor" entered for business purposes. The full duty of "reasonable care to ensure the visitor does not suffer injury or damage by reason of any danger existing on the premises" applies. A driver whose car is damaged by an obvious pothole, an unlit kerb, or a wandering animal on a rural lot has a stronger occupiers'-liability claim against a paid operator than against a free-parking operator.

This is the second-most-important risk after GDPR. Practical mitigation: document your maintenance, sign clear warnings about uneven surfaces, light the lot if you operate after dark, and keep the insurance broker informed when you transition from "free" to "paid" — the policy will sometimes need a new endorsement to cover commercial-parking exposure.

What "doing it right" looks like at a typical Irish small operator

Take a 12-space lot behind a garden centre outside Cork. Doing it right looks like:

1. One clear sign at the entrance. Rate in EUR/hour and EUR/day. Maximum stay if any. QR code for payment. Name of the operator (the garden centre). One sentence: "This lot is not enforced by camera — pay at entry."
2. No cameras. Not for enforcement, not for capacity-monitoring, not for "general security". If you want general security cameras for non-parking reasons, locate them so they do not point at the lot's number plates.
3. Code-based customer exemption. Customers get a printed code on their receipt that gives them free parking up to the typical visit duration. Tourists pay the going rate.
4. Software-only payment, with the payout landing in the garden centre's bank account directly. Mekavo or any equivalent.
5. Documented maintenance and lighting log. A photograph every six months, a dated receipt for any repair work, the snow-clearance arrangement in writing.

That operation generates approximately EUR 6,000-10,000 per year on a 12-space lot in a regional town, with no GDPR exposure, no camera infrastructure, no PCN reputation cost.

What you need to operate Mekavo Parking in Ireland

1. Confirm your land has no covenant against commercial use — most freehold business land is fine; some agricultural-to-business conversions have conditions in the planning permission.
2. Decide your enforcement model. We strongly recommend software-only payment with no cameras for any operator under 20 spaces. The DPC exposure is asymmetric.
3. Sign up at mekavo.com/ie/parking. The 8-step setup walks you through site naming, rate, EUR bank payout connection (we use Stripe Ireland — direct EUR bank deposits).
4. Print your entrance sign with the QR code, the rate, the GST/VAT status (if VAT-registered), and the operator name.
5. You are live. Five percent platform fee, paid from your share. No monthly subscription, no equipment, no contract.

What to do this week

1. Take down any ANPR camera currently aimed at the lot — or relocate it so it does not capture plates — if you are not certain you have completed a DPIA and posted a privacy notice. Removing the camera is cheaper than the DPC inquiry.
2. Walk past the nearest paid lot in your county town and note its rate. That is your fairness benchmark.
3. Visit mekavo.com/ie/parking and start the 8-step setup. Free to try, no contract, no monthly fee.

And if Mekavo is not the right fit for you, look at any of the other software-first platforms. The principle matters more than the brand: charge fairly, do not install cameras you do not need, and take occupiers' liability seriously now that you are operating a paid commercial service.

Written by Mehrdad, founder of Mekavo. Mekavo Ltd is registered at Companies House (#16477044) in Leicester, UK, and operates Mekavo Parking globally as a software-and-payments service. This article is general guidance, not legal advice — consult an Irish solicitor for your specific situation, especially before deploying any form of camera-based enforcement.