← Ireland

S.I. No. 350/2026 - Data Protection Act 2018 (Section 60(6)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day an

S.I. No. 350/2026 - Data Protection Act 2018 (Section 60

(6)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations 2026 Skip to content Disclaimer Feedback Helpdesk Gaeilge Léim go dtí an t-ábhar Séanadh Aiseolas Deasc chabhrach English Gaeilge English Produced by the Office of the Attorney General Táirgthe ag Oifig an Ard-Aighne Home Legislation Acts of the Oireachtas Statutory Instruments Pre-1922 Legislation Constitution External Resources Bills (Houses of the Oireachtas) Iris Oifigiúil / Official Gazette Revised Acts (LRC) Classified List of Legislation (LRC) Translations (acts.
  1. ie)Translations (Houses of the Oireachtas) Government Publications for Sale EU Law (EUR-Lex) FAQ Disclaimer Feedback Helpdesk Search Baile Reachtaíocht Achtanna an Oireachtais Ionstraimí Reachtúla Reachtaíocht Réamh-1922 Bunreacht Acmhainní Seachtracha Billí (Tithe an Oireachtais) Iris Oifigiúil Achtanna Athbhreithnithe (CAD) (An Coimisiún um Athchóiriú an Dlí) Liosta Rangaithe Reachtaíochta Aistriúcháin (achtanna.
  2. ie)Aistriúcháin (Tithe an Oireachtais) Foilseacháin Rialtais ar Díol Dlí AE (EUR-Lex) CCanna (Ceisteanna Coitianta) Séanadh Aiseolas Deasc chabhrach Cuardach TitleTeideal Year(
  3. s)or rangeBliain nó blianta nó raon TypeCineál All Legislation Acts Statutory Instruments Advanced SearchCuardach Casta HomeBaile Statutory InstrumentsIonstraimí Reachtúla 2026 S.I. No. 350/2026 - Data Protection Act 2018 (Section 60
(6)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations 2026 S.I. No. 350/2026 - Data Protection Act 2018 (Section 60
(6)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations 2026 AmendmentsLeasuithe Download PDF Íoslódáil PDF Notice of the making of this Statutory Instrument was published in “Iris Oifigiúil” of 24th July, 2026. I, HILDEGARDE NAUGHTON, Minister for Education and Youth, in exercise of the powers conferred on me by section 60
(6)of the Data Protection Act 2018 (No. 7 of 2018), and having duly complied with subsections
(9)(b) and
(10)of section 60 of that Act, hereby make the following regulations, with respect to which, pursuant to section 6 of that Act, a draft has been laid before each House of the Oireachtas and a resolution approving the draft has been passed by each such House: Citation 1. These Regulations may be cited as the Data Protection Act 2018 (Section 60
(6)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations
  1. Definitions
  2. In these Regulations— “Act of 2004” means the Commissions of Investigation Act 2004 (No. 23 of 2004); “Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018); “Article 10 data” has the meaning assigned to it by section 55 of the Act of 2018; “Commission” means the commission of investigation established under the Commissions of Investigation Act 2004 (No. 23 of 2004) by the Establishment Order; “Commissioner” means a person appointed to the Commission in accordance with section 7
(2)of the Act of 2004; “Establishment Order” means the Commission of Investigation (Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Order 2025 ( S.I. No. 388 of 2025 ); “relevant function” has the meaning assigned to it by Regulation 3; “relevant objective” has the meaning assigned to it by Regulation 4; “relevant person” means— (
  1. a)a Commissioner, or (
  2. b)any other person acting for, appointed by or working under the direction of a Commissioner in connection with the performance of the functions of the Commission under the Act of 2004; “terms of reference” means the terms of reference of the Commission. Relevant function 3. In these Regulations, “relevant function” means— (
  3. a)a function of the Commission under the Act of 2004 to— (
  4. i)investigate, (
  5. ii)report on, or (iii) make such findings and recommendations as it sees fit to the Minister for Education and Youth in relation to, the matters within the Commission’s terms of reference, or (
  6. b)a function of the Commission relating directly or indirectly to a function referred to in paragraph (a). Relevant objective 4. In these Regulations, “relevant objective” means an objective— (
  7. a)referred to in paragraph (
  8. b)of section 60
(7)of the Act of 2018, and (b) pursued by the Commission in exercising a relevant function. Scope: categories of personal data 5.
(1)These Regulations apply to personal data (including special categories of personal data and Article 10 data) processed by a relevant person and in respect of which the Commission is the controller.
(2)The categories of personal data processed by the Commission shall be specified in policies prepared by the Commission and published on a website maintained by or on behalf of the Commission or in such other manner as the Commission considers appropriate. Scope: purpose of processing 6. These Regulations apply to the processing by a relevant person of personal data to which these Regulations apply that is necessary for the achievement of a relevant objective. Restriction 7.
(1)The rights and obligations provided for in Articles 12 to 22, Article 34 and Article 5 (in so far as any of its provisions correspond to the rights and obligations in Articles 12 to 22) of the Data Protection Regulation, in respect of processing to which these Regulations apply, are restricted to the extent that such a restriction is— (
  1. a)necessary, and only for so long as is so necessary, to safeguard a relevant objective, and (
  2. b)proportionate to the need to safeguard that relevant objective, including where the exercise of the right or compliance with the obligation, as the case may be, would— (
  3. i)obstruct or otherwise prejudice, in whole or in part, the performance by the Commission of a relevant function, (
  4. ii)disclose that the Commission is performing a function in pursuit of a relevant objective, in a case in which such disclosure would obstruct or otherwise prejudice the achievement of the relevant objective, or (iii) prevent the Commission processing personal data to which these Regulations apply for a period of time, in a case in which any delay to the processing may prejudice the achievement of a relevant objective.
(2)Matters which are relevant, for the purposes of paragraph
(1), in determining whether a restriction of a right or obligation is necessary to safeguard a relevant objective, and proportionate to the need to safeguard the relevant objective, include— (
  1. a)whether or not the exercise of the right or compliance with the obligation would obstruct or otherwise prejudice the achievement by the Commission of the relevant objective, (
  2. b)the need to respect the essence of the right to data protection of the data subject, (
  3. c)the risks to the rights and freedoms of a data subject that may result from such a restriction, and (
  4. d)the need to balance the essence of the right to data protection with the impacts on the rights and freedoms of other persons which may result from the Commission being unable to perform a relevant function or achieve the relevant objective. Information to be provided where right or obligation restricted 8.
(1)Where a right or obligation referred to in Regulation 7
(1)is restricted in accordance with that Regulation, the Commission shall notify the data subject concerned of the restriction, in writing within one month of the restriction unless, in the opinion of the Commission, notifying the data subject may be prejudicial to the achievement of a relevant objective.
(2)A notification under paragraph
(1)shall inform the data subject concerned of the following, unless informing the data subject may, in the opinion of the Commission, obstruct or otherwise prejudice the achievement of a relevant objective: (a) the right or obligation referred to in Regulation 7
(1)affected by the restriction; (
  1. b)whether the right or obligation concerned has been restricted in whole or in part; (
  2. c)the reasons for the restriction; (
  3. d)the categories of personal data to which the restriction applies; (
  4. e)the purposes for which the personal data is being processed; (
  5. f)the controller or categories of controllers processing the personal data; (
  6. g)the policies and procedures referred to in Regulation 10
(1)and in compliance with which the restriction and processing are undertaken; (h) that the data subject concerned may lodge a complaint with the Data Protection Commission pursuant to Article 77
(1)of the Data Protection Regulation; (
  1. i)that the right referred to in subparagraph (
  2. h)is without prejudice to any other rights or remedies which the data subject concerned may have.
(3)Where requested to do so by a data subject notified in accordance with paragraph
(1), the Commission shall provide information on the policies and procedures referred to in Regulation 10
(1)to the data subject. Communication with data subject 9. The Commission shall ensure that all information provided to a data subject under or in relation to these Regulations is provided in a concise, intelligible and easily accessible form using clear and plain language. Safeguards 10.
(1)The Commission shall prepare and implement policies and procedures to provide for the matters referred to in Article 23
(2)(
  1. d)and (
  2. f)of the Data Protection Regulation.
(2)The policies and procedures referred to in paragraph
(1)shall be published on a website maintained by or on behalf of the Commission or in such other manner as the Commission considers appropriate.
(3)Without prejudice to the generality of paragraph
(1), the policies and procedures referred to in that paragraph shall provide for the following: (
  1. a)the use of secure storage, passwords, encryption, logging mechanisms and other methods, to ensure personal data can only be accessed by the Commission or by a relevant person authorised by the Commission to access that data; (
  2. b)the use of controls to ensure that personal data is only disclosed to— (
  3. i)a relevant person authorised by the Commission, or (
  4. ii)a person entitled or permitted by law to receive that personal data; (
  5. c)processes to ensure the accuracy of the personal data, that it is kept up to date, and that an accurate record of the data provided to the Commission is kept; (
  6. d)the determination of appropriate storage periods for personal data or classes of personal data taking into account the nature, scope and purpose of the processing of the data or class of data, as the case may be; (
  7. e)the treatment, including erasure where relevant, of personal data or classes of personal data at the expiry of the storage periods referred to in subparagraph (d); (
  8. f)the use of data minimisation, including the use of anonymisation and pseudonymisation; (
  9. g)the designation by the Commission of a data protection officer in respect of the Commission; (
  10. h)processes to ensure that relevant persons have undertaken to maintain the integrity and confidentiality of personal data or are under an appropriate statutory obligation to do so; (
  11. i)the treatment of personal data disclosed, orally or otherwise, during meetings or private sessions, including circumstances in which such treatment constitutes processing for the purposes of the Act of 2018.
(4)The Commission shall— (a) review the policies and procedures referred to in paragraph
(1)on a regular basis, and (b) update those policies and procedures as the Commission considers appropriate. Interaction with other law 11. The restriction referred to in paragraph
(1)of Regulation 7 is in addition to and not in substitution for any restriction of the rights and obligations referred to in that paragraph under any other enactment or law of the European Union. GIVEN under my Official Seal, 16 July, 2026. HILDEGARDE NAUGHTON, Minister for Education and Youth. Privacy Statement Accessibility European Legislation Identifier (PDF) Open Data License Ráiteas Príobháideachais Inrochtaineacht Aitheantóir Eorpach Reachtaíochta (ELI) Ceadúnas Sonraí Oscailte Liosta Fianán © Government of Ireland. Oireachtas Copyright Material is reproduced with the permission of the Houses of the Oireachtas © Rialtas na hÉireann. Atáirgtear ábhar faoi Chóipcheart le cead ó Thithe an Oireachtais

🔗 To official source

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.