Student Privacy Statement

How GMIT uses the personal data of students


GMIT (“the Institute”) processes your personal data in order to carry out its functions.  Your personal data is processed in line with data protection legislation and GMIT’s Data Protection Policy.  The Institute is a Data Controller for personal data we process about you. The purpose of this privacy statement is to explain how your personal data is used and shared by GMIT.


The types of personal data we process about you include, inter alia:

Personal details: Name, date of birth, country of birth, nationality, telephone numbers, addresses, PPSN, gender, GMIT ID number, email addresses and car registration number.
Financial information: Bank details including IBAN, BIC, name of bank/building society credit card details (processed in real time but not stored by GMIT), details of funding and fees paid and outstanding.
Academic information: Academic history, academic marks & grades, relevant work experience, exam scripts, continuous assessments, qualifications awarded, attendance record, library information etc.
Special category (sensitive) personal data: Health and disability information, medical assessments, religion, ethnic origin, criminal convictions (for certain programmes which involve contact with minors).
Interaction details: Engagement with IT system, LearnOnline/Moodle activity and use of facilities such as the library. Texts, emails and hard copy correspondence.
Online services: IP address, and other personal information when you visit the GMIT website – more information available on the GMIT Website Privacy & Cookies Policy
Other personal information: Disciplinary information, image, CV, visa information (international students).

You will be required to provide Next of Kin/Emergency Contact Details for use only in emergency situations.


We process your personal data at various points in your relationship with GMIT. This information is provided by you, either directly or indirectly. It may also be provided by third parties like the CAO, PAC, SUSI, Department of Employment Affairs and Social Protection, etc.


We process your personal data because it’s necessary in order to:

  • Fulfil our contractual obligations with you;
  • Comply with legal obligations that apply to us;
  • Perform functions conferred on us by law and which are carried out in the public interest;
  • Perform tasks to which you have consented;
  • Protect your legitimate interests and the legitimate interests of GMIT and third parties (limited scenarios).

Where sensitive personal data is concerned, we process it where:

  • You have provided your explicit consent;
  • It’s necessary for the purposes of preventative or occupational medicine, for the general provision of medical care and, in some instances, for medical diagnosis;
  • It’s necessary for employment/social security purposes
  • It’s necessary for research or statistical purposes e.g. to meet Government requirements, to monitor whether our equal opportunities policies are working and to ensure that disabled students and other under-represented groups receive appropriate support.



  • Admission and Registration
  • Academic affairs – teaching and learning, assessment, examination, graduation, attendance, grievance and disciplinary issues
  • Financial affairs – grants, fee collection, scholarships, prizes, bursaries
  • Provision of IT services
  • Provision of Library services
  • Provision of Student Support services – Access, Disability, Learning Support, Chaplaincy, Counselling, Medical, Careers
  • Identification e.g ID cards, Moodle, class lists
  • Parking permits
  • Visas (international students)
  • Health & Safety
  • To communicate effectively with you by post, email and phone.
  • CCTV purposes (as per CCTV policy)
  • To support you in your studies by using information processed via Moodle to present a picture of your engagement and identify those who require additional support/specific services
  • To enable placements with employers
  • To ensure academic standards are maintained
  • Recruitment and Selection for paid positions e.g. Student Ambassador
  • To comply with statutory reporting requirements and to provide information to organisations such as the HEA in line with legal and government requirements
  • To track progress in achieving the criteria for designation as a Technological University via the Connacht-Ulster Alliance
  • To enable the preparation and analysis of student statistics relating to registration, performance, progression and retention at sectoral level via THEA
  • To administer voluntary surveys of student opinion about your experience and the performance of the Institute
  • To enable research and archiving
  • To facilitate elections by the Students' Union
  • To promote the Institute in print & electronic media
  • To assist the Gardai or where required by law
  • To enable our continued contact with you after you complete your studies (e.g. survey of graduate work destinations, alumni networks, marketing, etc)
  • To respond to requests for information made under Data Protection legislation or Freedom of Information legislation.

Additional processing may be required for students registered on specific programmes (e.g. teaching and social work) or with certain funding requirements or for students who choose to pursue studies abroad.



The Institute will share your personal data with third parties (outside GMIT) in the following circumstances:

Where we contract a third party to process data on our behalf, for example software service providers (e.g. Microsoft 365), plagiarism detection service provider (Urkund), CCTV companies, etc., and

Where the data is required in the normal course of performing the Institute’s functions e.g.

  • Higher Education Authority (HEA)* - please refer to the HEA collection notice below
  • Quality and Qualifications Ireland (QQI)
  • Student Universal Support Ireland (SUSI)
  • Department of Employment Affairs and Social Protection
  • Department of Justice & Equality/INIS (international students)
  • Revenue Commissioners
  • Professional/Accreditation/Regulatory bodies
  • Connacht-Ulster Alliance (CUA) Data Analyst and GMIT CUA Project Manager
  • THEA
  • Work placement providers
  • Research funding bodies
  • Employers (apprentices & students funded by employers)
  • Partner institutions/organisations for student transfers/exchanges/joint programmes
  • Garda Vetting Bureau
  • GMIT Students’ Union to facilitate student elections
  • Direct mail agencies/printing companies to facilitate the delivery of mailshots
  • Sponsors funding student prizes and awards
  • Prospective employers/recruitment companies for verification of qualifications
  • Irish Survey of Student Engagement (ISSE)
  • Insurance companies in respect of accidents occurring within the Institute
  • An Garda Síochána to assist in the prevention or detection of crime
  • Auditors
  • Realex (credit card payment provider)
  • Press/media

This is not an exhaustive list and any other disclosures to third parties not listed here are made only where there is legitimate reason to do so and in accordance with the law.

Parents, guardians and other relatives

It is your responsibility as a student to communicate and engage with the Institute. GMIT will not disclose your data to parents or relatives without your consent (even if you’re under 18 years), other than in exceptional circumstances, for example where there is potential danger to your health or well-being.  If you wish to provide consent for matters to be discussed with your parent, you must send an email to this effect to the relevant GMIT staff member.  Exceptionally, where urgent communication with you has proved unfruitful, contact may be made with your next of kin/emergency contact using the details provided by you at registration.


All graduating students, including those graduating in absentia, will have their name, home town, award and classification listed in the graduation booklet.  The graduation ceremonies are streamed live on the internet and are recorded for publication on the internet and for archival purposes.

Many GMIT events are recorded and streamed/published on the GMIT website.



In so far as is practicable, GMIT endeavours to hold all personal data within the European Economic Area (EEA).  Where your personal data is transferred outside of the EEA, it is done only when appropriate safeguards are in place.



GMIT retains your personal data for the purposes described in this notice. The Institute will not hold your data for any longer than is necessary, but some data will be held indefinitely in order, for example, to verify your award, provide transcripts of your marks, provide opportunities for further study, careers support, alumni and networking services. More information on our retention schedule is available on request.



We are committed to ensuring that your personal data is secure with us and with the data processors who act on our behalf.



You have the following rights under data protection law, although your ability to exercise these rights may be subject to certain conditions:

  • The right to receive a copy of and/or access the personal data that GMIT holds about you, together with other information about our processing of that data;
  • The right to request that any inaccurate data that is held about you is corrected and incomplete data updated;
  • The right, in certain circumstances, to request that we erase your personal data;
  • The right, in certain circumstances, to request that we no longer process your personal data for particular purposes, or to object to our use of your personal data or the way in which we process it;
  • The right, in certain circumstances, to transfer your personal data to another organisation;
  • The right to object to automated decision making and/or profiling; and
  • the right to complain to the Data Protection Commissioner.

In order to exercise any of the above rights please contact us using the contact details set out below.



You must inform the Institute if your contact details change so that your data is accurate at all times.

You must comply with GMIT’s Data Protection Policy which is available on the Student Portal.



The GMIT website privacy policy explains how data is gathered through use of the GMIT website.



You may be contacted by telephone, email or post.  In addition, we may text you with information related to your studies e.g. exam information, room changes, rescheduled classes, appointment reminders, placement arrangements, etc. This contact is to enable us to fulfil our contractual obligations to you.



If you are not satisfied with the Institute’s handling of your personal data or believe that the requirements of data protection legislation may not be fully complied with, you should contact the Institute’s Data Protection Office in the first instance.  You also have the right to submit a complaint to the Data Protection Commission.



Please contact us if you have any questions about the data we hold about you or if you wish to exercise any of your rights:

Data Protection Officer, Room 1063, GMIT Galway Campus, Dublin Road, Galway H91 T8NW



Galway-Mayo Institute of Technology, Galway Campus, Dublin Road, Galway

Tel: +353 91 753161


Changes to this Privacy Statement

We will update this privacy statement from time to time.  Please visit this page periodically for updates.

Updated on 17 October 2019



Who we are (data controllers)
The Higher Education Authority (HEA) with an address at 3 Shelbourne Buildings, Shelbourne Road, Ballsbridge, Dublin 4. The HEA is a public body with authority derived from the Higher Education Authority Act 1971 (the 1971 Act).

The HEA are responsible for funding higher education institutions and advising the Minister for Education and Skills on policy formulation to develop the highest standards in our higher education system.

This notice sets out the basis on which any personal data collected from you, or from others, will be processed by the HEA.  Please read the following carefully to understand HEA practices regarding your personal data and how the HEA will treat these data.

Data are collected by each higher education institution, including at registration, and are shared with the HEA via annual returns to the student records system in the HEA pursuant to a data sharing agreement, a copy of which is available on request from the HEA Data Protection Officer.


The HEA Data Protection Officer (“DPO”) may be contacted at

The GMIT Data Protection Officer (“DPO”) may be contacted at 


What personal information does the HEA collect from you or obtain from others?
The HEA collect student record, equal access survey and graduate outcome data from higher education institutions so that the HEA can perform their statutory functions under the 1971 Act. The HEA collect and process the following personal data:

  1. Student record system data (SRS) based on institution’s registration data;
  2. Equal Access Survey data based on the voluntary equal access survey presented to students;
  3. About nine months after you graduate, the higher education institution may contact you to ask you to fill in the HEA Graduate Outcomes Survey. This is voluntary, and the higher education institution will not give your phone or email contact details used for this survey to the HEA.


What other information does the HEA collect from you or obtain from others?
During your studies, you will be invited to participate in the Irish National Survey of Student Engagement. Some of your information may be sent to the HEA to ensure that the survey is offered only to relevant target groups. Your information may be matched to your survey responses in order to allow for anonymous analysis of results, for example, by gender or full-time / part-time. Your responses will be treated confidentially and no individual student will be identifiable in any reports or results generated as a result of this survey.


Why does the HEA collect this information?
The purpose for which the HEA uses this data is

  1. for assessing the funding needs of HEIs, and,
  2. for fact-based statistical analysis to help understand the real needs that higher education should meet, to promote equality of opportunity in higher education and to assist the Government in developing future higher education policies and investment.

The HEA does this by linking data from the Student Records System, the Equal Access Survey and information from the Graduate Outcomes Survey through student ID number and/or PPSN for more accurate statistical analysis to help improve education services and policies.

The HEA use student records to produce anonymised aggregate data in annual statistical publications.

The legal bases for the processing of your data are:

  1. You have given your consent to the processing of your personal data for one or more specific purposes as set out in this document or,
  2. The processing is necessary for compliance with a legal obligation to which the HEA and HEI are subject, in particular, but without prejudice to the generality of the obligations of the Higher Education Act 1971 or,
  3. The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the HEA pursuant to the Higher Education Act 1971 and the Social Welfare (Consolidation) Act 2005, or, 
  4. The processing of special category data is necessary for reasons of substantial public interest, on the basis of EU or Irish law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures  to safeguard the fundamental rights and the interests of the data subject or,
  5. Statistical data may be processed in accordance with Article 89 of the GDPR and Section 42 of the Data Protection Act 2018.


Who the HEA shares your data with:
The HEA shares records with other official bodies such as the City of Dublin Education and Training Board (CDETB) and the Central Statistics Office for the following purposes:

1. Student Grant Application Verification
The HEA will provide your student record to CDETB (SUSI - Student Universal Support Ireland), an agent of the Department of Education and Skills.  This record will include data on any previous enrolment in higher education in the Republic of Ireland. The HEA record is provided to CDETB (SUSI) for the purposes of verifying data supplied as part of grant applications, verifying that a student is enrolled or registered in accordance with the rules of an approved institution, assisting in the processing of applications for grants and determining an applicant’s eligibility for grant support under the education progression requirements of the Student Grant Scheme and the Student Support Act 2011.

2. Statutory Statistical functions
The HEA records are also used by the Central Statistics Office in order to carry out their statutory functions of measuring population levels and monitoring public expenditure.

3. Research, equal opportunity, journalism, other legitimate interest/public function
HEA student data is provided to the Department of Education and Skills to allow for research and analysis using this data within the Department, for instance for transition rate analysis and third level demand projections.

Public Service Identity (PPSN, name, address, date of birth) is sent to the Department of Employment Affairs and Social Protection Client Identity Services to verify PPSN for data quality purposes.

HEA administrative graduate data is linked via PPSN to Revenue administrative employment data, Department of Employment Affairs and Social Protection administrative benefits data and Department of Education and Skills administrative student data in the Central Statistics Office to analyse graduate outcomes and evaluate higher education effectiveness.

HEA administrative data are also shared with SOLAS and the Department of Public Expenditure and Reform to allow for policy formulation and statistical analysis.

Anonymised aggregate (non-personal) data to third parties:
The HEA will also supply anonymised aggregate data to third parties for the purposes of equal opportunities monitoring, Freedom of Information, research and journalism in the public interest. The data shared does on its own identify any individual.

How long does the HEA keep hold of your information?
The time periods for which the HEA retain your information depends on the type of information and the purposes for which it is used. The HEA will keep your information for no longer than is required or permitted.

For further details on the applicable retention periods, please contact the HEA Data Protection Officer at


Does the HEA transfer your information outside The European Union or European Economic Area?

What are your rights with respect to your personal data?
You have the following rights:

• The right to access the personal data the HEA holds about you.
• The right to require the HEA to rectify any inaccurate personal data about you without undue delay.
• The right to have the HEA erase any personal data held about you in circumstances such as where it is no longer necessary to hold the personal data or, in some circumstances, if you have withdrawn your consent to the processing.
• The right to ask the HEA to provide your personal data to you in a portable format or, where technically feasible, to port that personal data to another provider provided it does not result in a disclosure of personal data relating to other people.
• The right to request a restriction of the processing of your personal data.

Where HEA processing of your personal data is based on your consent to that processing, you have the right to withdraw that consent at any time but any processing that the HEA have carried out before you withdrew your consent remains lawful.

You may exercise any of the above rights by contacting the HEA Data Protection Officer at

You may lodge a complaint with the Office of the Data Protection Commission in respect to our processing of your personal data. The website is

To ensure your privacy and to protect the integrity of your data, the HEA will require you to verify your identity with a photographic ID before releasing or correcting your information.

What will happen if the HEA change the data collection notice?
This notice may change each year. This notice is applicable to the 2019/20 academic year. A revised notice will issue in the event of any future changes.

How can you contact the HEA?
The HEA Data Protection Officer can be contacted by email at
By phone: 01 2317100
Address: 3 Shelbourne Buildings, Shelbourne Road, Ballsbridge, Dublin 4.


Schedule 1
The table below sets out a list of third parties with whom the HEA share your data.

Third party name Description of services provided
The Department of Education and Skills The HEA may share, subject to a data sharing agreement in 2019/20, identifiable microdata with the Department of Education and Skills to allow for transitions rate analysis from 2nd level to 3rd level and to produce 3rd level demand projections.
The Central Statistics Office The HEA share identifiable microdata with the CSO to analyse graduate outcomes and to measure the effectiveness of the higher education system. HEA data is linked to other Government administrative datasets in the CSO.
SUSI – part of the CDETB (City of Dublin Education and Training Board) The HEA match SUSI grant application data to HEA student record data using PPSN to verify previous attendance at HEA funded institutions.
The Department of Employment Affairs and Social Protection The HEA share PPSN, name, address and date of birth data to verify PPSN data with Client Identity Services.
SOLAS The HEA may share identifiable microdata, subject to a data sharing agreement in 2019/20, with SOLAS to allow for transitions rate analysis from further education to higher education.
The Department of Public Expenditure and Reform The HEA may share disaggregated course level data with DPER to allow for detailed labour market analysis.
External Contractors The HEA, on occasion, contract external bodies to process microdata in order to fulfil statutory functions, e.g. geocoding of student address data.


Schedule 2
List of data items the HEA collect or obtain from higher education institutions, 2019/2020 Academic Year

The data higher education institutions send to the HEA include, student records: 

Return year
Institute code
Academic year
Programme name
Programme code
Programme type
Anticipated length of programme in years
Faculty title & code
NFQ level
Course name
Course code
Subject indicator
CAO code
Co-ordinating institutions
Outreach, off campus marker
Awarding body
Funding indicator
Add-on indicator to mark add-on courses recognising previous credit for entry
Course completion credits Full time credits per year Course class indicator
Teacher training marker
Student ID
CAO number
PPS number
Enrol status, student or graduate
Course code
Course year
Mode of study
ISCED code – field of study
Subject 1
Subject 2
Subject 3
Subject 4
Non-Standard award code
Grade for award
PhD structure indicator
Student code to indicate type of student, e.g. new entrant
Non-Standard attendance tag
Exchange indicator
Date of birth
First name
Domiciliary of origin
Address 1
Address 2
Address 3
Address 4
Address 5
Postal code for Dublin students
Non-EU fee indicator
Residence type during term-time
Fees – free fees indicator
DES grant indictor of grant status
SUSI grant code as per SUSI file
Post-Primary school number
Leaving Cert points
Leaving Cert year
Leaving Cert exam results
Last Institution attended
Year left last institution
Highest qualification
Accumulated credits Current year credits Up-skilling initiative indicator, e.g. Springboard Fund indicator for students funded through the Fund for Students with a Disability
Basis of entry to course

These data form part of the HEA Student Record System (SRS) database.

Equal Access Survey:
Data collected as part of the Equal Access Survey is also returned to the HEA. Data sent to the HEA as part of this process include:

Return year
Institution code
Academic year
Student ID
Course code
Blind or deaf indicator
Physical disability indicator
Learning disability indicator Psychological, emotional, or mental health indicator
Other condition indicator Support requirement
Parental status
One parent allowance status
Ethnic culture

Graduate Outcomes Survey:
The following Graduate Outcomes Survey data will be sent to the HEA:

PPS number
Student ID
Date of birth
County code
Domiciliary of origin code
Mode of study
Grade of award
Institute name
Course code
Course name
ISCED field of study information
NFQ Level
Programme type code
Year of graduation
Return year
Response, yes or no
Principal economic status – main
Principal economic status – full
Job title
Occupation (broad)
Employment (where)
Employment Ireland
Employment overseas
Sector (broad)
Employment type
Contract type
Internship indicator
Internship (time)
Relevance level/area
Need for qualification indicator
Find out about job indicator
Institution (where)
Institution Ireland
Institution overseas
Further institution indicator
Further course name
Further ISCED field of study
Award sought in further study
Further mode of study
Why do further study indicator
Other activity A – unemployment status
Other activity B – other activities
Barriers to employment
Same course again indicator
Follow up willingness indicator

HEA SRS data, Equal Access Survey data and Graduate Outcomes Survey data are linked in the HEA for analysis purposes via Student ID and/or PPSN.