Student Privacy Statement

How GMIT uses student data


GMIT (“the Institute”) values your privacy and recognises the need to process your personal data in a fair and lawful manner in accordance with the legal obligations as set out in the General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.  This privacy statement is intended to provide you with information about the personal information we collect and how that information is used and shared.


​The information we process about you

The types of personal data processed by GMIT include, inter alia:

Personal details: name, date of birth, country of birth, nationality, telephone numbers, addresses (home and term addresses), PPS number, gender, ID number, email address and car registration number if you apply for a parking permit.
Financial information: Bank details including IBAN, BIC, name of bank/building society credit card details (processed in real time but not stored by GMIT), details of funding and fees paid and outstanding.
Information on others: Next of kin/emergency contact details, parents’ socio-economic grouping, parents’ occupation, parents’ employment status etc.
Academic information: Academic history, academic grades, relevant work experience, exam scripts, continuous assessments, academic marks qualifications awarded, attendance record, library information etc.
Sensitive personal data: Health and disability information, medical assessments, religion, ethnic origin, criminal convictions (for certain programmes which involve contact with minors). This sensitive personal data is collected to meet Government requirements, to monitor whether our equal opportunities policies are working and to ensure that disabled students and other under-represented groups receive appropriate support.  We are obliged to keep this special category of data as securely and as confidential as possible.
Interaction details: Engagement with IT system, LearnOnline/Moodle activity and use of facilities such as the library. Texts, emails and hard copy correspondence.
Online services: IP address, and the type of device you are using when visiting the GMIT website on a mobile device.
Other personal information: Disciplinary information, images in CCTV footage/photography, filming.

​How we obtain your personal data

We process your personal data at various points in your relationship with GMIT. This information is provided by you, either directly or indirectly. It may also be provided by third parties like the CAO, SUSI, Department of Social Protection, etc.

Legal basis for processing your personal information

The processing of your personal data is necessary for the following lawful purposes:

  • To enable us to fulfil our contractual obligations with you;
  • To allow us to comply with legal obligations;
  • For the performance of functions conferred on us by law;
  • To perform a task carried out in the public interest;
  • To perform a task where we have your consent.

How your information is used

The purposes for which GMIT may process your personal information include:

  • To administer your studies, record academic achievements and determine/record your overall award outcome
  • To support you in your studies i.e. we may use information you have given us (e.g. disability) and information we collect about your engagement with services (e.g. Moodle) to identify students who require additional support or specific services and enable analytics for reporting purposes (such as student progress and academic performance)
  • To monitor and evaluate the student experience
  • To administer the financial aspects for your registration as a student (e.g. payment of fees, debt collection)
  • To identify you and enable you to access resources by means of your ID cards
  • To enable effective communication with you
  • To manage Institute facilities and services including computing, library, careers, campus car parks
  • To administer appeals, complaints, grievances, disciplinary matters, and matters relating to conduct and cheating / plagiarism
  • To process scholarships, prizes and bursaries
  • To ensure your health, safety and well-being
  • To provide information to organisations such as the HEA in line with legal and government requirements
  • To comply with statutory reporting requirements
  • To produce reports and aggregated statistics for management and research purposes in order to plan and improve services
  • To administer voluntary surveys of student opinion about your experience and the performance of the Institute
  • To create and publish print & electronic material (e.g. prospectus, brochures, website, etc) for promotional and archival purposes
  • To maintain a proportionate CCTV system for the specific purposes outlined in the CCTV Policy
  • To assist with law enforcement or where required or authorised by law
  • To confirm the details of your academic achievements, and for statistical and historical purposes, a core record of your studies in retained indefinitely
  • To enable our continued contact with you after you complete your studies (e.g. survey of graduate work destinations, alumni networks, marketing, etc)
  • To respond to requests for information made under Data Protection legislation or Freedom of Information legislation.

Additional processing may be required for students registered on specific programmes (e.g. teaching and social work) or with certain funding requirements or for students who choose to pursue studies abroad.

Does GMIT share your data with any third parties?

GMIT may share your relevant personal data with third parties, including the following, where we have a legitimate reason in connection with your studies:

  • Data Processors (sub-contractors used by GMIT in order to carry out a function for the Institute, e.g. cloud services provider Microsoft)
  • Higher Education Authority (HEA)* - please refer to the HEA collection notice below
  • Quality and Qualifications Ireland (QQI)
  • Student Universal Support Ireland (SUSI) for grant eligibility purposes
  • Department of Social Protection to verify employment status and eligibility for allowances
  • Revenue Commissioners
  • Professional and regulatory bodies where programmes are accredited by such bodies
  • Work placement providers
  • Research funding bodies
  • Employers where students are studying as an apprentice
  • Other higher education institutions, partners or research organisations to which a student transfers or pursues an exchange programme or where a student’s programme is being run collaboratively
  • Software providers or service providers performing administrative functions on behalf of GMIT (e.g. IT services, clinical tools, carpark management, etc)
  • GMIT Students’ Union to facilitate student elections
  • External examiners
  • Direct mail agencies/printing companies to facilitate the delivery of mailshots
  • Sponsors funding student prizes and awards
  • Plagiarism detection service providers (e.g. Turnitin) to ensure academic standards
  • Potential employers/recruitment companies for verification of qualifications
  • Irish Survey of Student Engagement (ISSE)
  • Insurance companies in respect of accidents occurring within the Institute
  • Institute legal advisors
  • An Garda Síochána to assist in the prevention or detection of crime
  • Auditors
  • Realex (credit card payment provider)

This is not an exhaustive list and any other disclosures to third parties not listed here are made only where there is legitimate reason to do so and in accordance with the law.


All graduating students, including those graduating in absentia, will have their name, home town, award and classification listed in the graduation booklet.  The graduation ceremonies are streamed live on the internet and are recorded for publication on the internet and for archival purposes.
Many GMIT events are recorded and streamed/published on the GMIT website.

Parents, guardians and other relatives
It is your responsibility as a student to communicate and engage with the Institute. GMIT will not normally disclose your data to parents or relatives without your consent, other than in exceptional circumstances i.e. where there is potential danger to the health or well-being of a student.  We may agree to discuss matters relating to you with a parent/relative but only if you consent to this.  Exceptionally, where urgent communication with a student through direct contact details is not possible or has, following repeated attempts, been unsuccessful, contact may be via a student’s parents and/or next of kin using contact details provided by the student.

Transfers outside of the European Economic Area (EEA)

There are certain circumstances where we will transfer personal data outside of the EEA to a country that is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the EEA, e.g. China, Saudi Arabia. We are currently working on getting appropriate transfer mechanisms in place to protect personal data in these circumstances.


Data Retention

The Institute will not hold your data for any longer than is necessary.  GMIT only retains your personal data for purposes described in this notice, or to comply with relevant legal obligations imposed on us. GMIT will hold some of your data indefinitely in support of your lifelong relationship with us, or unless you ask us to do otherwise. More information on our retention schedule is available on request.


We are committed to ensuring that your personal data is secure with us and with the data processors who act on our behalf. We are continuously taking technical and organisational steps to better protect your information. 

Individual Data Subject Rights
You have the following rights under data protection law, although your ability to exercise these rights may be subject to certain conditions:

  • The right to receive a copy of and/or access the personal data that GMIT holds about you, together with other information about our processing of that data;
  • The right to request that any inaccurate data that is held about you is corrected and incomplete data updated;
  • The right, in certain circumstances, to request that we erase your personal data;
  • The right, in certain circumstances, to request that we no longer process your personal data for particular purposes, or to object to our use of your personal data or the way in which we process it;
  • The right, in certain circumstances, to transfer your personal data to another organisation;
  • The right to object to automated decision making and/or profiling; and
  • the right to complain to the Data Protection Commissioner.

In order to exercise any of the above rights please contact us using the contact details set out below.

Website Privacy Policy

The GMIT website privacy policy explains how data may be gathered about users of the Institute’s website.

How GMIT will contact you

We contact students by telephone, email or post.  In addition, we may text you with information related to your studies e.g. exam information, room changes, rescheduled classes, appointment reminders, placement arrangements, etc. This contact is to enable us to fulfil our contractual obligations to you. 

With your consent, we may contact you by email or text with messages of a marketing nature, for example to promote events, new programmes, competitions, etc.

Questions & Complaints

If you are unhappy with the Institute’s handling of your personal data, or believe that the requirements of the Data Protection Act or GDPR may not be fully complied with, you should contact the Institute’s Data Protection Office in the first instance.  You also have the right to submit a complaint to the Data Protection Commissioner.

How to contact us

Please contact us if you have any questions about the information we hold about you or to request a copy of that information:
• By email:
• In writing: Data Protection Office, Room 1063, GMIT Galway Campus, Dublin Road, Galway

Data Controller

Galway Mayo Institute of Technology, Galway Campus, Dublin Road, Galway
Tel: +353 91 753161


Changes to this Privacy Statement

We will update this privacy statement from time to time.  Please visit this page periodically for updates.

Updated on 17 September 2018



Who we are (data controllers)
The Higher Education Authority (HEA) with an address at 3 Shelbourne Buildings, Shelbourne Road, Ballsbridge, Dublin 4. The HEA is a public body with authority derived from the Higher Education Authority Act 1971 (the 1971 Act).
The HEA are responsible for funding higher education institutions and advising the Minister for Education and Skills on policy formulation to develop the highest standards in our higher education system.
This notice sets out the basis on which any personal data collected from you, or from others, will be processed by the HEA.  Please read the following carefully to understand HEA practices regarding your personal data and how the HEA will treat these data.
For the purpose of the Data Protection Acts 1988 and 2018 (as amended) and the General Data Protection Regulation (the GDPR) (the Acts):
• The HEA and the higher education institution are joint data controllers. Data are collected by each higher education institution, including at registration, and are shared with the HEA via annual returns to the student records system in the HEA.

The HEA Data Protection Officer (“DPO”) may be contacted at

The GMIT Data Protection Officer (“DPO”) may be contacted at


What PERSONAL information does the HEA collect from you or obtain from others?
The HEA collect student record and graduate outcome data from higher education institutions so that the HEA can perform their statutory functions under the 1971 Act. The HEA collect and process the following personal data:

  • Student record system data (SRS) based on institution’s registration data;
  • About nine months after you graduate, the higher education institution may contact you to ask you to fill in the HEA Graduate Outcomes Survey. This is voluntary, and the higher education institution will not give your phone or email contact details used for this survey to the HEA.


What other information does the HEA collect from you or obtain from others?

  • Data from the voluntary Equal Access Survey, these are anonymised data;
  • During your studies, you will be invited to participate in the Irish National Survey of Student Engagement. Some of your information may be sent to the HEA to ensure that the survey is offered only to relevant target groups. Your information may be matched to your survey responses in order to allow for anonymous analysis of results, for example, by gender or full-time / part-time. Your responses will be treated confidentially and no individual student will be identifiable in any reports or results generated as a result of this survey.

A list of all individual data items in Schedule 2 to this Notice.


Why does the HEA collect this information?
The HEA uses this data for fact-based statistical analysis to help understand the real needs that higher education should meet, to promote equality of opportunity in higher education and to assist the Government in developing future higher education policies and investment.  The HEA does this by linking data from the Student Records System and information from the Graduate Outcomes Survey through student ID number and/or PPSN for more accurate statistical analysis to help improve education services and policies.
The HEA use student records to produce anonymised aggregate data in annual statistical publications.

The legal bases for the processing of your data are:

  • That you have provided consent for the processing for one or more specified purposes such as when you undertake one of our surveys;
  • Processing necessary for compliance with a legal obligation to which the HEA are subject;
  • Processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the HEA as the controller by virtue of statutory functions as set out in the 1971 Act.

The legal bases for the processing of your special category data or sensitive data are:

  • Processing necessary for compliance with a legal obligation to which the HEA are subject;
  • Processing necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.


Who the HEA shares your data with:
The HEA shares records with other official bodies such as The Department of Education and Skills, City of Dublin Education and Training Board (CDETB) and the Central Statistics Office for the following purposes:

1. Student Grant Application Verification
The HEA will provide your student record to CDETB (SUSI - Student Universal Support Ireland), an agent of the Department of Education and Skills.  This record will include data on any previous enrolment in higher education in the Republic of Ireland. The HEA record is provided to CDETB (SUSI) for the purposes of verifying data supplied as part of grant applications, verifying that a student is enrolled or registered in accordance with the rules of an approved institution, assisting in the processing of applications for grants and determining an applicant’s eligibility for grant support under the education progression requirements of the Student Grant Scheme and the Student Support Act 2011. 

2. Statutory Statistical functions
The HEA records are also used by the Central Statistics Office in order to carry out their statutory functions of measuring population levels and monitoring public expenditure.

3. Research, equal opportunity, journalism, other legitimate interest/public function
HEA student microdata is provided to the Department of Education and Skills to allow for research and analysis using this data within the Department, for instance for transition rate analysis and third level demand projections.
HEA student data (PPSN, name, address, date of birth) is sent to the Department of Employment Affairs and Social Protection Client Identity Services to verify PPSN.
HEA administrative graduate data is linked via PPSN to Revenue administrative employment data, Department of Employment Affairs and Social Protection administrative benefits data and Department of Education and Skills administrative student data in the Central Statistics Office to analyse graduate outcomes and evaluate higher education effectiveness. The HEA graduate data may also be linked to SOLAS, Quality and Qualifications Ireland (QQI), SUSI and State Examinations Commission (SEC) data in the Central Statistics Office.
HEA administrative data are also shared with SOLAS and the Department of Public Expenditure and Reform to allow for policy formulation and statistical analysis.

Anonymised aggregate (non-personal) data to third parties:
The HEA will also supply anonymised aggregate data to third parties for the purposes of equal opportunities monitoring, Freedom of Information, research and journalism in the public interest. These data do not on their own identify any individual:

  • Equal opportunities monitoring - the HEA database may contain details of ethnic group and disability (anonymised). These data are only used where they are needed to promote or maintain equality of opportunity or treatment between persons of different racial or ethnic origins, or different states of physical or mental conditions;
  • Research - this may be academic research, commercial research or other statistical research into education where this is of benefit to the public interest;
  • Journalism, where the relevant publication would be in the public interest;
  • Anonymised aggregate data for the above purposes is supplied by the HEA to the following types of user:
  • Local, regional and national Government bodies who have an interest in higher education;
  • Higher education sector bodies;
  • Higher education institutions;
  • Academic researchers and students;
  • Commercial organisations (e.g. recruitment firms, graduate employers);
  • Unions;
  • Non-governmental organisations and charities;
  • Journalists.

Individuals cannot be identified from these anonymised aggregate data.

How long does the HEA keep hold of your information?
The time periods for which the HEA retain your information depends on the type of information and the purposes for which it is used. The HEA will keep your information for no longer than is required or permitted.
For further details on the applicable retention periods, please contact the HEA Data Protection Officer at


Does the HEA transfer your information outside The European Union or European Economic Area?

What are your rights with respect to your personal data?
You have the following rights:

  • The right to access the personal data the HEA holds about you.
  • The right to require the HEA to rectify any inaccurate personal data about you without undue delay.
  • The right to have the HEA erase any personal data held about you in circumstances such as where it is no longer necessary to hold the personal data or, in some circumstances, if you have withdrawn your consent to the processing.
  • The right to object to the HEA processing personal data about you such as processing for profiling or direct marketing.
  • The right to ask the HEA to provide your personal data to you in a portable format or, where technically feasible, to port that personal data to another provider provided it does not result in a disclosure of personal data relating to other people.
  • The right to request a restriction of the processing of your personal data.

Where HEA processing of your personal data is based on your consent to that processing, you have the right to withdraw that consent at any time but any processing that the HEA have carried out before you withdrew your consent remains lawful.

You may exercise any of the above rights by contacting the HEA Data Protection Officer at
You may lodge a complaint with your local supervisory authority with respect to our processing of your personal data. The local Supervisory Authority in Ireland is the Data Protection Commission. The website is

To ensure your privacy and to protect the integrity of your data, the HEA will require you to verify your identity with a photographic ID before releasing or correcting your information.

What will happen if the HEA change the data collection notice?
This notice may change each year. This notice is applicable to the 2018/19 academic year. A revised notice will issue in the event of any future changes.


How can you contact the HEA?
The HEA Data Protection Officer can be contacted by email at
By phone: 01 2317105
Address: 3 Shelbourne Buildings, Shelbourne Road, Ballsbridge, Dublin 4.


Schedule 1
The table below sets out a list of third parties with whom the HEA share your data.

Third party name Description of services provided
The Department of Education and Skills The HEA share identifiable microdata with the Department of Education and Skills to allow for transitions rate analysis from 2nd level to 3rd level and to produce 3rd level demand projections.
The Central Statistics Office The HEA share identifiable microdata with the CSO to analyse graduate outcomes and to measure the effectiveness of the higher education system. HEA data is linked to other Government administrative datasets in the CSO.
SUSI – part of the CDETB (City of Dublin Education and Training Board) The HEA match SUSI grant application data to HEA student record data using PPSN to verify previous attendance at HEA funded institutions.
The Department of Employment Affairs and Social Protection The HEA share PPSN, name, address and date of birth data to verify PPSN data with Client Identity Services.
SOLAS The HEA may share identifiable microdata with SOLAS to allow for transitions rate analysis from further education to higher education.
The Department of Public Expenditure and Reform The HEA may share disaggregated course level data with DPER to allow for detailed labour market analysis.
External Contractors The HEA, on occasion, contract external bodies to process microdata in order to fulfil statutory functions, e.g. Insight Statistical Consulting to code Equal Access Survey socio-economic data.


Schedule 2
List of data items the HEA collect or obtain from higher education institutions

The data higher education institutions send to the HEA include, student records: 
Return year
Institute code
Academic year
Programme name
Programme code
Programme type
Anticipated length of programme in years
Faculty title & code
NFQ level
Course name
Course code
Subject indicator
CAO code
Co-ordinating institutions
Outreach, off campus marker
Awarding body
Funding indicator
Add-on indicator to mark add-on courses recognising previous credit for entry
Course completion credits Full time credits per year Course class indicator
Teacher training marker
Student ID
CAO number
PPS number
Enrol status, student or graduate
Course code
Course year
Mode of study
ISCED code – field of study
Subject 1
Subject 2
Subject 3
Subject 4
Non-Standard award code
Grade for award
PhD structure indicator
Student code to indicate type of student, e.g. new entrant
Non-Standard attendance tag
Exchange indicator
Date of birth
First name
Domiciliary of origin
Address 1
Address 2
Address 3
Address 4
Address 5
Postal code for Dublin students
Non-EU fee indicator
Residence type during term-time
Fees – free fees indicator
DES grant indictor of grant status
SUSI grant code as per SUSI file
Post-Primary school number
Leaving Cert points
Leaving Cert year
Leaving Cert exam results
Last Institution attended
Year left last institution
Highest qualification
Accumulated credits Current year credits Up-skilling initiative indicator, e.g. Springboard Fund indicator for students funded through the Fund for Students with a Disability
Basis of entry to course

These data form part of the HEA Student Record System (SRS) database.

Equal Access Survey:
Data collected as part of the Equal Access Survey is also returned to the HEA, these data are anonymised. Data sent to the HEA as part of this process include:
Blind or deaf indicator
Physical disability indicator
Learning disability indicator Psychological, emotional, or mental health indicator
Other condition indicator Support requirement
Father Principal Economic Status
Father Occupation
Father Employment Status
Father Socio-economic Group
Father Socio-economic Class
Mother Principal Economic Status
Mother Occupation
Mother Employment Status
Mother Socio-economic Group
Mother Socio-economic Class
Ethnic culture

Graduate Outcomes Survey:
The following Graduate Outcomes Survey data will be sent to the HEA:
PPS number
Student ID
Date of birth
County code
Domiciliary of origin code
Mode of study
Grade of award
Institute name
Course name
ISCED field of study information
NFQ Level
Programme type code
Year of graduation
Return year
Response, yes or no
Principal economic status – main
Principal economic status – full
Job title
Occupation (broad)
Employment (where)
Employment Ireland
Employment overseas
Sector (broad)
Employment type
Contract type
Internship indicator
Internship (time)
Relevance level
Relevance area
Need for qualification indicator
Find out about job indicator
Institution (where)
Institution Ireland
Institution overseas
Further institution indicator
Further course name
Further ISCED field of study
Award sought in further study
Further mode of study
Why do further study indicator
Other activity A – unemployment status
Other activity B – other activities
Barriers to employment
Same qualification again indicator
Same area of study indicator
Follow up willingness indicator

HEA SRS data and Graduate Outcomes Survey data are linked in the HEA for analysis purposes via Student ID and/or PPSN. Equal Access Survey data received by the HEA are anonymised and are not linked to individual student records in the SRS.

Further Information: