← Ireland

S.I. No. 352/2026 - Data Protection Act 2018 (Section 51(3)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day an

S.I. No. 352/2026 - Data Protection Act 2018 (Section 51

(3)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations 2026 Skip to content Disclaimer Feedback Helpdesk Gaeilge Léim go dtí an t-ábhar Séanadh Aiseolas Deasc chabhrach English Gaeilge English Produced by the Office of the Attorney General Táirgthe ag Oifig an Ard-Aighne Home Legislation Acts of the Oireachtas Statutory Instruments Pre-1922 Legislation Constitution External Resources Bills (Houses of the Oireachtas) Iris Oifigiúil / Official Gazette Revised Acts (LRC) Classified List of Legislation (LRC) Translations (acts.
  1. ie)Translations (Houses of the Oireachtas) Government Publications for Sale EU Law (EUR-Lex) FAQ Disclaimer Feedback Helpdesk Search Baile Reachtaíocht Achtanna an Oireachtais Ionstraimí Reachtúla Reachtaíocht Réamh-1922 Bunreacht Acmhainní Seachtracha Billí (Tithe an Oireachtais) Iris Oifigiúil Achtanna Athbhreithnithe (CAD) (An Coimisiún um Athchóiriú an Dlí) Liosta Rangaithe Reachtaíochta Aistriúcháin (achtanna.
  2. ie)Aistriúcháin (Tithe an Oireachtais) Foilseacháin Rialtais ar Díol Dlí AE (EUR-Lex) CCanna (Ceisteanna Coitianta) Séanadh Aiseolas Deasc chabhrach Cuardach TitleTeideal Year(
  3. s)or rangeBliain nó blianta nó raon TypeCineál All Legislation Acts Statutory Instruments Advanced SearchCuardach Casta HomeBaile Statutory InstrumentsIonstraimí Reachtúla 2026 S.I. No. 352/2026 - Data Protection Act 2018 (Section 51
(3)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations 2026 S.I. No. 352/2026 - Data Protection Act 2018 (Section 51
(3)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations 2026 AmendmentsLeasuithe Download PDF Íoslódáil PDF Notice of the making of this Statutory Instrument was published in “Iris Oifigiúil” of 24th July, 2026. I, HILDEGARDE NAUGHTON, Minister for Education and Youth, in exercise of the powers conferred on me by subsection
(3)of section 51 of the Data Protection Act 2018 (No. 7 of 2018), having had regard to the matters referred to in subsection
(8)of section 36 and subsection
(7)of section 51 of that Act and having duly complied with subsections
(5)(b) and
(6)of section 36 and subsection
(6)(b) of section 51 of that Act, hereby make the following regulations with respect to which, pursuant to section 6 of that Act, a draft has been laid before each House of the Oireachtas and a resolution approving the draft has been passed by each such House: Citation 1. These Regulations may be cited as the Data Protection Act 2018 (Section 51
(3)) (Commission of Investigation into the Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Regulations
  1. Definitions
  2. In these Regulations— “Act of 2018” means the Data Protection Act 2018 (No. 7 of 2018); “Article 10 data” has the meaning assigned to it by section 55 of the Act of 2018; “Commission” means the commission of investigation established under the Commissions of Investigation Act 2004 (No. 23 of 2004) by the Establishment Order; “Commissioner” means a person appointed to the Commission in accordance with section 7
(2)of the Act of 2004; “Establishment Order” means the Commission of Investigation (Handling of Historical Child Sexual Abuse in Day and Boarding Schools) Order 2025 ( S.I. No. 388 of 2025 ); “relevant person” means— (
  1. a)a Commissioner, or (
  2. b)any other person acting for, appointed by or working under the direction of a Commissioner in connection with the performance of the functions of the Commission under the Act of 2004; “relevant personal data” means— (
  3. a)special categories of personal data, and (
  4. b)without prejudice to the Criminal Justice (Spent Convictions and Certain Disclosures) Act 2016 (No. 4 of 2016), Article 10 data; “special categories of personal data” has the meaning assigned to it by section 2 of the Act of 2018; “terms of reference” means the terms of reference of the Commission. Processing of special categories of personal data and Article 10 data for reasons of substantial public interest 3. The processing by a relevant person of relevant personal data is authorised only in so far as is necessary for, and proportionate to, the substantial public interest referred to in Regulation 4. Substantial public interest 4. For the purposes of Regulation 3, “substantial public interest” means the performance by the Commission of functions in connection with a matter which is specified in the terms of reference as a matter of public interest and which the Commission was established to investigate by the Establishment Order. Persons to whom special categories of personal data and Article 10 data may be disclosed 5. Relevant personal data may be disclosed to a relevant person where— (
  5. a)the data is disclosed in accordance with such policies and procedures as may be provided for under Regulation 6, and (
  6. b)the data is required by the relevant person for the performance of their functions. Suitable and specific measures to be taken to safeguard fundamental rights and freedoms of data subject in processing relevant personal data by these Regulations 6. The Commission shall, for the purposes of safeguarding the fundamental rights and freedoms of a data subject in processing relevant personal data in accordance with these Regulations, take the following suitable and specific measures: (
  7. a)prepare and implement policies and procedures for the processing of relevant personal data under these Regulations, including in relation to the following: (
  8. i)the use of secure storage, passwords, encryption, logging mechanisms and other methods to ensure that relevant personal data can only be accessed by the Commission or by a relevant person authorised by the Commission to access that data; (
  9. ii)the use of controls to ensure that relevant personal data is only disclosed to— (I) a relevant person authorised by the Commission, or (II) a person entitled or permitted by law to receive that relevant personal data; (iii) processes to ensure the accuracy of relevant personal data, that it is kept up to date, and that an accurate record of the data provided to the Commission is kept; (
  10. iv)the determination of appropriate storage periods for relevant personal data or classes of relevant personal data, taking into account the nature, scope and purpose of the processing of relevant personal data or class of relevant personal data, as the case may be; (
  11. v)the treatment, including erasure where relevant, of relevant personal data or classes of relevant personal data at the expiry of the storage periods referred to in subparagraph (iv); (
  12. vi)the use of data minimisation, including the use of anonymisation and pseudonymisation; (vii) the designation by the Commission of a data protection officer in respect of the Commission; (viii) processes to ensure that relevant persons have undertaken to maintain the integrity and confidentiality of relevant personal data or are under an appropriate statutory obligation to do so; (
  13. ix)the treatment of relevant personal data disclosed, orally or otherwise, during meetings or private sessions, including circumstances in which such treatment constitutes processing for the purposes of the Act of 2018; (
  14. b)without prejudice to the generality of paragraph (a), take such other measures as the Commission considers appropriate to ensure that— (
  15. i)relevant personal data are processed, or further processed, under these Regulations only to the extent strictly necessary and proportionate for the purposes of the functions of the Commission, and (
  16. ii)on a regular basis, an assessment is made by the Commission of the risks to the fundamental rights and freedoms of data subjects in respect of whom relevant personal data are processed under these Regulations by reason of such processing or further processing; (
  17. c)review the policies and procedures referred to in paragraph (
  18. a)and any measures referred to in paragraph (
  19. b)on a regular basis; (
  20. d)update the policies and procedures referred to in paragraph (
  21. a)as the Commission considers appropriate. GIVEN under my Official Seal, 16 July, 2026. HILDEGARDE NAUGHTON, Minister for Education and Youth. Privacy Statement Accessibility European Legislation Identifier (PDF) Open Data License Ráiteas Príobháideachais Inrochtaineacht Aitheantóir Eorpach Reachtaíochta (ELI) Ceadúnas Sonraí Oscailte Liosta Fianán © Government of Ireland. Oireachtas Copyright Material is reproduced with the permission of the Houses of the Oireachtas © Rialtas na hÉireann. Atáirgtear ábhar faoi Chóipcheart le cead ó Thithe an Oireachtais

🔗 To official source

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.