The licensing wording is broad: a person who determines the purposes and means of personal-data processing is generally required to apply for a data controller licence, subject to the specific exemptions in the regulations.
What to know
- ✓Controller status depends on decision-making, not simply on organisation size or sector.
- ✓Licences are valid for 12 months and renewal should be initiated at least three months before expiry.
- ✓The regulations define four tiers beginning at 50 data subjects.
- ✓Some exempt activities follow a registration route instead of licensing.
Who is a controller?
A controller decides key matters about processing: why it occurs, how it is carried out, what information is collected, whose information is involved or what outcome is sought. Joint decision-making can create joint-controller responsibilities. A provider acting only on documented instructions may instead be a processor, but titles do not decide the issue.
The four published tiers
Tier 1 covers 50–1,000 data subjects; Tier 2 covers 1,001–100,000; Tier 3 covers 100,001–500,000; and Tier 4 covers more than 500,000.
The regulations do not clearly resolve the position for 1–49 data subjects or define the measurement period. Exactly 50 is also described inconsistently in the later implementation guide. Those cases should be confirmed with the Data Protection Authority or a qualified adviser.
Licensing exemptions are narrow
Processing for personal, family or household affairs is exempt from licensing. Law-enforcement processing and processing for journalistic, historical or archival purposes are exempt from licensing but the regulations state that these activities must register and remain subject to the Act’s principles.
Mixed purposes, multiple entities, changing data volumes and processor/controller uncertainty need a documented review.
Renewal and evidence
A licence is valid for 12 months. The regulations state that renewal should be applied for at least three months before expiry. Keep the application, supporting records, licence conditions and renewal calendar in the organisation’s compliance evidence pack.
Read the underlying material
- S.I. 155 of 2024: sections 3–9
- Implementation Guidelines: MSME licensing guidance