> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Ireland Number & Sender Rules (ComReg + DPC) > The Ireland posture expanded from the country-requirements matrix: opt-in electronic marketing under the ePrivacy Regulations (S.I. 336/2011) Section 13, GDPR and Data Protection Act 2018 duties enforced by the DPC, ComReg numbering and anti-spoofing context, alphanumeric sender acceptance, STOP and Gaeilge opt-out handling, and quiet hours for +353 traffic. # Ireland Number & Sender Rules (ComReg + DPC) Ireland (`IE`) is a routine destination volume for SaaS marketing traffic, and two bodies split its rulebook. ComReg (Commission for Communications Regulation) owns the numbering and electronic communications rules; the Data Protection Commission (DPC) enforces the GDPR and the Data Protection Act 2018. Marketing SMS to an Irish subscriber sits under Section 13 of the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (S.I. 336/2011), the Irish ePrivacy Regulations, with the GDPR/DPA 2018 layer sitting on top of every piece of personal data behind the send. This page expands the IE row of the [country-requirements matrix](/compliance/country-requirements) so you can put a defensible posture in place before your first Irish campaign. Ireland is a **tenant-owned burden**. Orbit keeps the country-rules reference, the consent and suppression surfaces, and the send-time knobs; the legal posture is yours. This page is documentation, not legal advice. The DPC actively enforces both the ePrivacy Regulations and the GDPR, and Section 13 obligations apply against the sender. Ireland has no national SMS do-not-call register to scrub: exclusion runs through your consent record and your suppression ledger. Have counsel review your consent capture; Orbit supplies the surfaces. *** ## Two regimes: S.I. 336/2011 and the DPC Three sources of law drive the tenant-side configuration: | Irish obligation | What it means for you | Orbit surface | | - | - | - | | Opt-in electronic marketing to individuals (Section 13, S.I. 336/2011) | Consent must exist before you send marketing SMS to an individual subscriber, unless the existing-customer exception below applies. Silence and pre-ticked boxes never count. | [Consent Management](/compliance/consent-management) with `sms` scope; [Double-Opt-In](/compliance/double-opt-in) for the evidence chain. | | Existing-customer exception | You may market your own similar products to a customer whose details were obtained during a sale, only if you offered a free opt-out when you collected the number and you offer one in every message. The exception is exactly as strong as your record of those two offers. | [Consent Management](/compliance/consent-management) source fields, plus the per-message compliance proof below. | | GDPR / Data Protection Act 2018 duties (DPC) | A lawful basis, purpose limitation, retention limits, and data-subject rights attach to every number and consent record you hold, independently of the ePrivacy layer. | [GDPR Posture Guide](/compliance/gdpr-posture-guide); [DSAR](/compliance/dsar) handling for the rights clock. | | Identifiable sender, no concealed identity | Section 13 prohibits concealing the sender's identity: send from a stable alphanumeric sender ID or an Irish long code you hold, never from a masked originator. | [Sender-ID Registration](/compliance/sender-id-registration) where identity stability matters. | | Opt-out honoured on every channel | A recipient who stops your SMS must stop receiving your marketing on every channel you operate. | [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) and the suppression ledger. | *** ## The IE country-rules row Read the live row first; the snapshot here is orientation: ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms®ion=EU" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` ```json theme={null} { "country": "IE", "sender_types": ["alphanumeric", "long_code"], "registration": "none", "content_restrictions": ["opt-in marketing under S.I. 336/2011 Section 13 + GDPR", "no national SMS DNC register; your consent record and suppression ledger carry the exclusion"], "stop_requirement": "STOP honored; add Gaeilge aliases when you send Irish-language traffic" } ``` `registration: none` means there is no statutory alphanumeric sender-ID registry for Irish A2P SMS: dynamic alphanumeric sender IDs are accepted on the route. Carrier relabeling of unregistered senders is still a deliverability posture, so register the sender where identity stability matters. *** ## ComReg sender-ID regime and the NVD context ComReg's enforcement attention on originator identity concentrates on the voice side. The National Voice Database (NVD) is the reference Irish operators use to validate that the CLI presented on Ireland-terminating voice traffic corresponds to a legitimately held Irish number, and it underpins ComReg's anti-spoofing measures: invalid or misused CLI presentations are blocked at the operator edge. Two read-across for your posture: * Voice campaigns into Ireland must present a CLI you hold. A spoofed or unallocated Irish CLI is exactly the traffic the NVD-backed validation exists to block. * SMS has no equivalent registry, but the same principle reads across: an identifiable, stable sender is both the Section 13 requirement and the deliverability posture. Keep one alphanumeric sender per brand rather than rotating originators. Where identity stability matters for your Irish traffic, file the sender through [Sender-ID Registration](/compliance/sender-id-registration) even though the row reads `registration: none`. *** ## Marketing opt-in under Section 13, with a worked consent record The posture in one line: individuals opt in; the existing-customer exception is narrow; and the GDPR layer underneath means every record needs a lawful basis and a retention limit regardless. Capture consent with the four fields that make it provable: the channel, the scope, the method, and the exact prompt text with a timestamp. Orbit keeps the record and binds it to each message it supports; retrieve the pair on demand: ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/messages/msg_7e3d21/compliance" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` ```json theme={null} { "message_id": "msg_7e3d21", "destination": "+353861234567", "consent_record": { "channel": "sms", "scope": "marketing", "method": "web_form", "prompt_text": "Send me order updates and offers by SMS (unchecked by default)", "captured_at": "2026-03-02T14:11:07Z" } } ``` If the DPC ever asks why a given message went to a given Irish subscriber, that pair is the answer: who consented, to what, when, and against which prompt. See [Consent Receipt Integrity](/compliance/consent-receipt-integrity) for the binding between messages and consent records. If you rely on the existing-customer exception instead of express consent, your record must additionally show the two opt-out offers: one at collection and one in every message. A send history that lacks the per-message opt-out text loses the exception. *** ## STOP keywords and Gaeilge `STOP` (English) already ships and maps to the same suppression entry across every channel you send on. Ireland prescribes no mandated keyword list and no separate stop shortcode, unlike France's STOP au 36111: the obligation is a clear, free opt-out in every message, and `STOP` is the keyword Orbit recognises on receipt. Marketing copy into Ireland runs overwhelmingly in English, so no additional alias is required for standard traffic. If you send Gaeilge-language copy, extend the [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) with the Irish opt-out term your copy uses (for example `STAD`) so recognition matches the language on the wire, and point each message at the opt-out in the same language. *** ## Quiet hours Ireland prescribes no statutory no-send window for marketing SMS, unlike France's 20:00–08:00 rule. Treat the absence as a default you set, not as permission: keep sends inside waking hours and configure your organisation's quiet-hours window in recipient-local time (Europe/Dublin), for example holding traffic 21:00–08:00. The control is tenant-owned and defaults off, like every other non-federal gate on the platform; set it per organisation before your first Irish campaign rather than after a complaint. *** ## Related references * [Regional Posture Hub](/compliance/country-rules-directory) — the index this page is listed in. * [Country Compliance Requirements](/compliance/country-requirements) — the live IE row this page expands. * [UK PECR and ePrivacy](/compliance/uk-pecr-eprivacy) — the sibling ePrivacy regime across the Irish Sea. * [GDPR Posture Guide](/compliance/gdpr-posture-guide) — the DPA 2018 layer the DPC enforces. * [Consent Receipt Integrity](/compliance/consent-receipt-integrity) — the message-to-consent binding the worked example relies on. * [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) — where the Gaeilge aliases live. *** ## Regulatory sources * [Commission for Communications Regulation (ComReg)](https://www.comreg.ie/) * [Data Protection Commission (DPC)](https://www.dataprotection.ie/) * [S.I. No. 336/2011 — European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011](https://www.irishstatutebook.ie/eli/2011/si/336/made/en/html) * [Data Protection Act 2018](https://www.irishstatutebook.ie/eli/2018/act/7/enacted/en/html) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.