Schools Administration

Wednesday, 24 June 2026

Ceisteanna (183)

Donna McGettigan

Ceist:

183. Deputy Donna McGettigan asked the Minister for Education and Youth whether her Department has issued guidance, instructions, policies, protocols, circulars or other documents to schools concerning the transmission, sharing, storage, retention, disclosure or other processing of students' personal data and special category personal data, including diagnostic, disability-related, psychological and medical information; whether any such guidance addresses the use of personal email accounts, rather than school-managed or institutional email systems, by Board of Management members or school staff when conducting school or Board of Management business; the safeguards, security measures, access controls, confidentiality requirements and retention arrangements schools are expected to apply where student records or special category personal data are transmitted, accessed, stored or retained through such accounts or on associated personal devices; whether copies of any such guidance will be made available; and if she will make a statement on the matter. [48213/26]

Amharc ar fhreagra

Freagraí scríofa

Minister for Education and Youth

The responsibility for compliance with data protection legislation rests with each school board of management. Schools/Education and Training Boards are separate data controllers from the department under data protection law and are responsible for their own compliance with the General Data Protection Regulation (GDPR) and Data Protection Act 2018. Schools can consult with their management body and/or the Data Protection Commission (DPC) if they require further advice.

The DPC recently published a "Data Protection Toolkit for Schools" to assist with specific concerns and challenges faced by schools and following consultation with a number of organisations in the education sector. The Toolkit includes guidance on the use of technology in schools, including the arrangements of third-party service providers and on the use of personal email, laptops and devices.

The DPC is the national independent authority responsible for upholding the fundamental right of individuals to have their personal data protected. It is the supervisory authority responsible for monitoring the application of the GDPR. The statutory powers, duties and functions of the DPC are as established under the Data Protection Act.