GDPR Access Requests

To make an access request you should contact us at:

Please tell us exactly what information you are seeking to access. To assist you and to guide us, please complete and forward the department’s Subject Access Request (SAR) Application Form.

You will need to include all of the proof of identity information as outlined below, or we will not be able to process your request.

We will respond to your data access request within one month. Usually we will send you our response by email or by post.

A copy of photographic identification, such as a passport or driver’s licence, and a copy of a recent utility bill or official letter, must be submitted with your request. This is because we must be satisfied of your identity before releasing any personal information to you. You can e-mail or post copies of your photographic identification and utility bill to us. We will only be able to start processing your request once we receive this information.

In some instances, your right to access your personal information is limited by the acts.

For example:

• if the information is kept for the purpose of preventing, detecting or investigating criminal offences, where allowing the right of access would be likely to impede such activities
• if the information would be subject to legal professional privilege in court
• if the information consists of an opinion about you given in confidence by another person (subject to certain conditions)

The Department of Education does not have to comply with your access request if it would result in disclosing data about another person, unless that other person has consented to the disclosure. So, if we have a record that contains your personal data as well as another person’s data, unless we have permission from the other person, we may be limited in what data we can give you. We will give you as much of the information as we can, without identifying the other person.

The department will ensure that:

• the rights of children are protected
• personal data is only revealed to those who have a right to it (particularly where a child may have engaged in services involving confidentiality)
• people making requests have confirmed their identity

The Data Protection Commission plans to publish guidance in 2020 on how to best exercise children’s rights under GDPR while balancing them against other rights, including those of parents/guardians.

Until then, the department has adopted the following approach when subject access requests are received in relation to children’s’ data:

• primary school children - parents can request data without the consent of the student. Note: Parent may be required to provide evidence of custody if only one parent applying
• Junior Cycle - parent with student's consent can apply and receive data
• Senior Cycle - Students should apply themselves

Further information on your rights can be found on the Data Protection Commissioner’s website. The website also includes contact information for the Data Protection Commissioner and explains how to submit a complaint, if you are not satisfied with our response to your request.