Data Protection Notice for Students

How GMIT uses student data

This privacy notice explains how GMIT (the Institute) collects, uses and shares your personal data.  It also explains your rights in relation to the personal data we hold.

As a student, past student or prospective student of the Institute, some of your personal data will be processed by us. The Institute is the data controller and all personal data that it holds & processes is subject to data protection legislation. 

The data held by the Institute is collected from a range of sources including the CAO, previous education providers, and directly from yourself during the application and registration process.  During the course of your studies, additional information is added to your record.

The Institute may share information between different internal departments for operational reasons as is necessary and proportionate for the purposes intended.

What information do we collect about you?

The types of personal data processed by GMIT include, inter alia:

  • Student ID number(s)
  • Name, date of birth, country of birth, nationality and telephone numbers
  • Addresses (home and term addresses)
  • PPS number
  • Email address
  • Next of kin/emergency contact details
  • Details of previous examination results
  • Schools/colleges attended
  • Course application details
  • Image in digital photograph for ID card
  • Financial information (including details of funding and fees paid and outstanding)
  • Bank details, including IBAN, BIC, Name of bank/building society
  • Credit card details (processed in real time but not stored with GMIT)
  • Academic history
  • Academic marks
  • Attendance records
  • Qualifications awarded
  • Engagement with IT system, LearnOnline/Moodle activity and use of facilities such as the library
  • Health and disability information
  • Parents socio economic grouping
  • Parents occupation
  • Parents employment status
  • Gender
  • Religion
  • Ethnic origin
  • Disciplinary information
  • Details of criminal convictions as provided through Garda Vetting (for specific courses involving contact with minors)
  • CV
  • Image in CCTV footage/photography/filming
  • Exam scripts
  • IP address, and the type of device you are using when visiting the GMIT website on a mobile device
  • Car registration number if you apply for a parking permit

Some of the information about you that the Institute holds, such as your ethnic origin, is classified as special category data, or sensitive personal data.  This sensitive personal data is collected to meet Government requirements, to monitor whether our equal opportunities policies are working and to ensure that disabled students and other under-represented groups receive appropriate support.  For certain programmes which involve contact with minors, information about past criminal convictions is processed.  In addition to the normal standards of confidentiality, we also carefully control access to sensitive data within the Institute so that it is only available to people who 'need to know'.

How do we use the information about you?

The Institute holds your personal data in order to implement and manage services & processes relating to your recruitment, admission, registration, teaching & learning, examining, graduation and other services such as student support services. Without this information, the Institute would not be able to provide its services. The Institute only obtains & processes information required for these purposes. The Institute shares information between different internal departments for operational reasons only as is necessary & proportionate for the purposes intended.

Under data protection law, we are required to ensure that there is an appropriate legal basis for the processing of your personal data, and we are required to let you know what that basis is. The primary legal bases that we use are:

  • processing that is necessary for the performance of our contract with you;
  • processing that is required under applicable law;
  • processing that is necessary in the public interest; and
  • processing where we have your consent.

Where the processing of your personal data is based on your providing consent, you have the right to withdraw consent at any time by contacting the department or service who obtained that consent, or the Institute’s Data Protection Office (contact details below).

The purposes for which GMIT may process your personal information include:

  • To administer your studies, record academic achievements and determine/record your overall award outcome
  • To support you in your studies i.e. we may use information you have given us (e.g. disability) and information we collect about your engagement with services (e.g. Moodle) to identify students who require additional support or specific services and enable analytics for reporting purposes (such as student progress and academic performance)
  • To monitor and evaluate the student experience
  • To administer the financial aspects for your registration as a student (e.g. payment of fees, debt collection)
  • To identify you and enable you to access resources by means of your ID cards
  • To enable effective communication with you
  • To manage Institute facilities and services including computing, library, careers, campus car parks
  • To administer appeals, complaints, grievances, disciplinary matters, and matters relating to conduct and cheating / plagiarism
  • To process scholarships, prizes and bursaries
  • To ensure your health, safety and well-being
  • To provide information to organisations such as the HEA in line with legal and government requirements
  • To comply with statutory reporting requirements
  • To produce reports and aggregated statistics for management and research purposes in order to plan and improve services
  • To administer voluntary surveys of student opinion about your experience and the performance of the Institute
  • To create and publish print & electronic material (e.g. prospectus, brochures, website, etc) for promotional and archival purposes
  • To maintain a proportionate CCTV system for the specific purposes outlined in the CCTV Policy
  • To assist with law enforcement or where required or authorised by law
  • To confirm the details of your academic achievements, and for statistical and historical purposes, a core record of your studies in retained indefinitely
  • To enable our continued contact with you after you complete your studies (e.g. survey of graduate work destinations, alumni networks, marketing, etc)
  • To respond to requests for information made under Data Protection legislation or Freedom of Information legislation.

Additional processing may be required for students registered on specific programmes (e.g. teaching and social work) or with certain funding requirements or for students who choose to pursue studies abroad.

Does GMIT share your data with any third parties?

Below are some examples of when the Institute will release data about you to third parties (i.e. outside GMIT) where we have a legitimate reason in connection with your studies.

GMIT may share your relevant personal data with bodies including the following:

  • Data Processors (sub-contractors used by GMIT in order to carry out a function for the Institute, e.g. cloud services provider Microsoft)
  • Higher Education Authority (HEA)* - please refer to the HEA collection notice below
  • Quality and Qualifications Ireland (QQI)
  • Student Universal Support Ireland (SUSI) for grant eligibility purposes
  • Department of Social Protection to verify employment status and eligibility for allowances
  • Revenue Commissioners
  • Professional and regulatory bodies where programmes are accredited by such bodies
  • Work placement providers
  • Research funding bodies
  • Employers where students are studying as an apprentice
  • Other higher education institutions, partners or research organisations to which a student transfers or pursues an exchange programme or where a student’s programme is being run collaboratively
  • Software providers or service providers performing administrative functions on behalf of GMIT (e.g. IT services, clinical tools, carpark management, etc)
  • GMIT Students’ Union to facilitate student elections
  • External examiners
  • Direct mail agencies/printing companies to facilitate the delivery of mailshots
  • Sponsors funding student prizes and awards
  • Plagiarism detection service providers (e.g. Turnitin) to ensure academic standards
  • Potential employers/recruitment companies for verification of qualifications
  • Irish Survey of Student Engagement (ISSE)
  • Insurance companies in respect of accidents occurring within the Institute
  • Institute legal advisors
  • An Garda Síochána to assist in the prevention or detection of crime
  • Auditors
  • Realex (credit card payment provider)

This is not an exhaustive list and any other disclosures to third parties not listed here are made only where there is legitimate reason to do so and in accordance with the law.


All graduating students, including those graduating in absentia, will have their name, home town, award and classification listed in the graduation booklet.  The graduation ceremonies are streamed live on the internet and are recorded for publication on the internet and for archival purposes.
Many GMIT events are recorded and streamed/published on the GMIT website.

Parents, guardians and other relatives
It is your responsibility as a student to communicate and engage with the Institute. GMIT will not normally disclose your data to parents or relatives without your consent, other than in exceptional circumstances i.e. where there is potential danger to the health or well-being of a student.  We may agree to discuss matters relating to you with a parent/relative but only if you consent to this.  Exceptionally, where urgent communication with a student through direct contact details is not possible or has, following repeated attempts, been unsuccessful, contact may be via a student’s parents and/or next of kin using contact details provided by the student.

Transfers outside of the European Economic Area (EEA)

There are certain circumstances where we will transfer personal data outside of the EEA to a country that is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the EEA, e.g. China, Saudi Arabia. We are currently working on getting appropriate transfer mechanisms in place to protect personal data in these circumstances.

Individual Rights

You have the following rights, subject to certain exemptions, in relation to your data:

  • The right to be informed about the data processing the Institute does
  • The right to request access to your personal data held by the Institute – to have a copy of the personal data that we hold about you
  • The right to rectification – to have inaccurate or incomplete personal data rectified
  • The right to erasure of personal data where there is no legitimate reason for the Institute to continue to process your personal data. If you exercise this right, the Institute will continue to hold some personal data which, for graduates, will include name, subject(s) studied, graduation details, date of birth and unique identification number, so that we do not inadvertently contact you in the future and to maintain your education records for archive purposes. We may also continue to hold some financial records about you for statutory purposes
  • The right to restrict the processing of personal data – you have the right to block the processing of your personal data in specific situations
  • The right to data portability  - you have the right to request that the Institute provides some elements of your information (e.g. academic progress records) in a commonly used machine readable format in order to provide it to other organisations
  • The right to object – you can object to the processing of your personal data by the Institute in certain circumstances, including the sending & receipt of direct marketing material
  • The right to object to automated decision making & profiling. GMIT does not currently make decisions affecting students by automatic means without human intervention.

In order to exercise any of the above rights please contact us using the contact details set out below.

Data Retention

The Institute will retain your personal data in accordance with our retention policy in our data inventories. The policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it. It is also kept in accordance with any legal requirements that are imposed on us. This means that the retention period for your personal data varies depending on the type of personal data.

The Institute will hold some of your data indefinitely in support of your lifelong relationship with GMIT, or unless you ask us to do otherwise. See ‘The right to erasure of personal data’ above.


We are committed to ensuring that your personal data is secure with us and with the data processors who act on our behalf. We are continuously taking technical and organisational steps to better protect your information. Data Protection training has been made available to all staff.

Website Privacy Policy

The GMIT website privacy policy explains how data may be gathered about users of the Institute’s website.

How GMIT will contact you

We may contact you by telephone, email or post.  In addition, if you have provided us with your mobile number, we may text you with Institute-related information e.g. exam information, grant information, appointment reminders, etc. We are reviewing the legal basis for sending you texts, and in the event that it is consent, we will review how your consent will be captured and maintained in line with the requirements of the GDPR.

Questions & Complaints

If you are unhappy with the Institute’s handling of your personal data, or believe that the requirements of the Data Protection Act or GDPR may not be fully complied with, you should contact the Institute’s Data Protection Office in the first instance.  You also have the right to submit a complaint to the Data Protection Commissioner.

How to contact us

Please contact us if you have any questions about the information we hold about you or to request a copy of that information:
• By email:
• In writing: Data Protection Office, Room 1063, GMIT Galway Campus, Dublin Road, Galway

Data Controller:

Galway Mayo Institute of Technology, Galway Campus, Dublin Road, Galway
Tel: +353 91 753161




Who we are (controller)

The Higher Education Authority, Statistics Unit, Manager Mr. Victor Pigott, email:

GMIT, Data Protection Office, Room 1063, Galway Campus, Dublin Road, Galway, email:


What we’re doing and why we’re doing it
We share student record and survey data that we collect from you with the Higher Education Authority (HEA) so they can perform their statutory functions under the Higher Education Authority Act, 1971.  This data may come from the following sources:

  • Student record data (SRS) based on institution’s registration data
  • Data from the voluntary Equal Access Survey
  • About nine months after you graduate, we may contact you to ask you to fill in the HEA Graduate Outcomes Survey. This is voluntary, and we will not give your phone or email contact details used for this survey to the HEA.
  • During your studies, you will be invited to participate in the Irish National Survey of Student Engagement. Some of your information may be sent to the HEA to ensure that the survey is offered only to relevant target groups. Your information may be matched to your survey responses in order to allow for anonymous analysis of results, for example, by gender or full-time / part-time. Your responses will be treated confidentially and no individual student will be identifiable in any reports or results generated as a result of this survey.

What the HEA does with your data
The HEA uses this data for fact-based statistical analysis to help understand the real needs that higher education should meet, to promote equality of opportunity in higher education and to assist the government in developing future higher education policies and investment.  The HEA does this by linking data from the Student Records System, information from the Equal Access Survey and information from the Graduate Outcomes Survey through student ID number and/or PPSN for more accurate statistical analysis to help improve education services and policies.
The HEA use student records to produce anonymised aggregate data in annual statistical publications.

Who the HEA shares your data with:
The HEA shares records with other official bodies such as The Department of Education and Skills,  CDETB and the Central Statistics Office for the following purposes:

1. Student Grant Application Verification
The HEA will provide your student record to CDETB (SUSI), an agent of the Department of Education and Skills.  This record will include data on any previous enrolment in higher education in the Republic of Ireland. The HEA record is provided to CDETB (SUSI) for the purposes of verifying data supplied as part of grant applications, verifying that a student is enrolled or registered in accordance with the rules of an approved institution, assisting in the processing of applications for grants and determining an applicant’s eligibility for grant support under the education progression requirements of the Student Grant Scheme and the Student Support Act 2011. 

2. Statutory Statistical functions
The HEA record may also be used by the Central Statistics Office in order to carry out their statutory functions of measuring population levels and monitoring public expenditure.

3. Research, equal opportunity, journalism, other legitimate interest/public function
HEA student microdata is provided to the Department of Education and Skills to allow for research and analysis using this data within the Department, for instance for transition rate analysis and third level demand projections.
HEA student data (PPSN, name, address, date of birth) may be sent to the Department of Social Protection Client Identity Services to verify PPSN.
HEA administrative graduate data is linked via PPSN to Revenue administrative employment data in the Central Statistics Office to analyse graduate outcomes in terms of sector and salary etc.

Anonymised aggregate (non-personal) data to third parties.
The HEA will also supply anonymised aggregate data to third parties for the purposes of equal opportunities monitoring, Freedom of Information, research and journalism in the public interest. This data does not on its own identify any individual:

  • Equal opportunities monitoring - the HEA student record may contain details of ethnic group and disability. This data is only used where it is needed to promote or maintain equality of opportunity or treatment between persons of different racial or ethnic origins, or different states of physical or mental conditions
  • Research. This may be academic research, commercial research or other statistical research into education where this is of benefit to the public interest.
  • Journalism, where the relevant publication would be in the public interest

Anonymised aggregate data for the above purposes is supplied by HEA to the following types of user:

  • Local, regional and national government bodies who have an interest in higher education
  • Higher education sector bodies
  • Higher education institutions
  • Academic researchers and students
  • Commercial organisations (e.g. recruitment firms, graduate employers)
  • Unions
  • Non-governmental organisations and charities
  • Journalists

Individuals cannot be identified from this anonymised aggregate data.


What kinds of data we collect
Student Records:  The data we send to the HEA, if available, includes:
Date of Birth
CAO Number
CAO Points
Leaving Certificate Year
Leaving Certificate Exam Results
Post Primary School Number
Student Grant Status
Institution Code
Student ID
Enrol Status
Return Year
Academic Year
Programme Type
NFQ Level
Course Code
Course Name
Course Year
Mode of Study
Grade (for graduates)

This data forms part of the HEA Student Record System (SRS) database.


Equal Access Survey:
Data collected as part of the Equal Access Survey is also returned to the HEA. Data sent to the HEA as part of this process includes:

Disability Indicators:
Blind or Deaf
Physical Disability
Learning Disability
Psychological, Emotional or Mental Health
Other Condition
Support Requirement

Socio-economic Background:
Father Principal Economic Status
Father Occupation
Father Employment Status
Father Socio-economic Group
Father Socio-economic Class
Mother Principal Economic Status
Mother Occupation
Mother Employment Status
Mother Socio-economic Group
Mother Socio-economic Class
Farm Size

Ethnicity Indicator:
Ethnic/Cultural Background

Status of Non-EU Students:
Student Visa Holder
Work Permit Holder
Leave to Remain
Other Status


Graduate Outcomes Survey:
The following Graduate Outcomes Survey data will be given to the HEA:
• Data on graduate qualifications and employment both within Ireland and overseas
• Data on relevance of employment to area of study
• Data on graduate further study
• Data on graduate unemployment and unavailability for work
• Longitudinal data to track career progression of graduates
• Graduate perceptions of the quality and relevance of their higher education experience

HEA SRS data, Equal Access Survey data and Graduate Outcomes Survey data are linked in the HEA for analysis purposes via Student ID and/or PPSN (one or both are collected and given to the HEA as part of all three data collection processes).


Your Data Rights
Under the General Data Protection Regulation, you have a right to access the data the HEA holds about you, to have incorrect information about you corrected, and to object to the processing of data that violates your human rights.  You may contact The Higher Education Authority, Statistics Unit, Manager Mr. Victor Pigott, email: to exercise these rights.  To ensure your privacy and to protect the integrity of your data, the HEA will require you verify your identity with a photographic ID before releasing or correcting your information.
If you believe your right to privacy or the protection of your personal data have been infringed, you have the right to bring a complaint to the Data Protection Commissioner at You can find more information about your rights at