Does the Data Protection Act Protect Your Company’s Reputation?

No. The Data Protection Act, 2019 (the DPA) does not protect a company reputation directly, because the rights it creates belong to individuals, and a company is not an individual. It still helps in one situation: where the damaging material contains false personal data about a named director, executive or employee, that person can use the Act. Knowing where the DPA stops saves time that would otherwise go into a complaint aimed at the wrong remedy.

A company is not a data subject

Section 2 of the DPA defines a data subject as an identified or identifiable natural person who is the subject of personal data. A company is a legal person, not a natural one, so it does not fit. The rights in section 26, including the rights to object to processing, to correction of false or misleading data and to deletion of false or misleading data about them, belong to the data subject.

It follows that a company cannot itself rely on those rights over content that is purely about the company as a corporate entity: its financial performance, its business practices or its products. However damaging that content is, the DPA is not the tool that reaches it. A company reputation problem of this kind has to be addressed through other remedies.

Where the Act does help

Damaging content about a company often includes personal data about identifiable individuals connected to it: a named director or executive, photographs, home addresses, or personal details woven into an otherwise corporate story. Those individuals, not the company, are the data subjects for that information. Under section 26 they may object to the processing of their personal data and seek correction and deletion of false or misleading data about them. Section 40(1) adds a right to ask a controller or processor to rectify personal data that is inaccurate, out-dated, incomplete or misleading, and to erase data that is irrelevant, excessive or obtained unlawfully.

If the individual is aggrieved by a decision of any person under the Act, section 56 allows a complaint to the Data Commissioner, made orally or in writing. Section 65(1) provides that a person who suffers damage by reason of a contravention of a requirement of the Act is entitled to compensation from the data controller or data processor. Whether a given piece of content involves a contravention depends on the facts, including whether an exemption applies to the publisher, so an individual should take advice before treating these as certain routes.

Where a damaging piece names a director and includes inaccurate personal details about them specifically, that director’s own complaint can sometimes achieve more than the company’s efforts, because it is aimed at the one legal hook the Act provides. In protecting company reputation this way, the complaint must be genuinely about the individual’s personal data.

Coordinating without confusing the company’s interest with the individual’s

Section 27(c) allows a right conferred on a data subject to be exercised, in cases other than a minor or a person with a disability, by a person duly authorised by the data subject. So the individual may authorise a representative, but the right remains theirs. A company can support and coordinate the response: briefing the affected director on what the Act allows, helping identify which statements about them personally are false, and aligning the timing with the company’s other steps. What the company cannot do is exercise the right in its own name, since it has no data subject right of its own.

Keeping this distinction clear also protects the director. A complaint that reads as a corporate public relations exercise wearing an individual’s name is weaker than one that is genuinely about that person’s own data. The company and the director may also have different interests, so consider whether the director needs separate advice before acting.

What actually protects company reputation

For harm to the company’s own standing, the usual starting points are defamation law, where a false statement of fact has caused real harm, and platform-level takedown requests for content that breaches a platform’s own policies, whether or not it meets a formal legal threshold. Defamation claims turn on their own facts and time limits, which we do not address here.

The Consumer Protection Act, 2012 may be relevant in some cases. Section 12(1) makes it an unfair practice for a person to make a false, misleading or deceptive representation, and section 12(2) lists examples, including false claims about the quality or standard of goods or services. Because that Act is framed around consumers and consumer transactions, whether it reaches a particular statement about your business needs case-by-case analysis. The DPA sits alongside these as a narrow, individual-specific tool, not a general remedy for company reputation, and treating it as one usually means spending time on a complaint that could never reach the content causing the damage.

Practical first steps

Whatever route you take, begin by preserving the evidence: capture the page, its web address and the date, and keep a copy of any version that is later edited. Then separate the content into what concerns the company and what concerns named individuals, and mark every statement you say is false, with the proof. A short, factual correction request to the publisher often resolves matters faster than a formal complaint, and it leaves a record that helps if you later need to escalate.