Important terms in Data Protection
The following provides a brief explanation of the key terms which should be understood by management and staff in schools. For access to the full statutory definitions used in the Data Protection Acts, you will find a pre-certified restatement of the Data Protection Acts at 
View Data Protection Act 2018
Data protection is the means by which the privacy rights of individuals are safeguarded in relation to the processing of their personal data.
Data means information in a form which can be processed. It includes both automated data and manual data. Automated data means any information on computer or information recorded with the intention that it is processed by computer. Manual data means information that is kept/recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system.
A relevant filing system means any set of information that, while not computerised, is structured by reference to individuals or by reference to criteria relating to individuals, so that specific information relating to a particular individual is readily accessible. Examples might include student files stored in alphabetical order in a filing cabinet or personnel files stored in schools or in ETB administrative offices.
Personal data is data relating to a living individual who is or can be identified either from the data or, from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller. This can be a very wide definition depending on the circumstances.
Sensitive personal data relates to specific categories of data which are defined as data relating to a person’s:
- racial or ethnic origin
- political opinions or religious or philosophical beliefs
- physical or mental health or condition
- sexual life
- criminal convictions or the alleged commission of an offence, any proceedings for an offence committed or alleged to have been committed, the disposal of such proceedings or the sentence of any court in such proceedings
- trade union membership.
What is meant by the term Data Subject? A data subject is a living individual to whom the data relates.
Data Controllers are those who, either alone or with others, control the contents and use of personal data. Boards of Management of schools are data controllers. In the case of schools under the remit of ETBs, the ETB is the data controller.
What is data processing? Data processing means performing any operation or set of operations on data, including: (i) obtaining, recording or keeping data; (ii) collecting, organising, storing, altering or adapting the data; (iii) retrieving, consulting or using the data, disclosing the information or data by transmitting, disseminating or otherwise making it available; (iv) aligning, combining, blocking, erasing or destroying the data.
Data Processor - a person who processes personal information on behalf of a data controller but does not include an employee of a data controller who processes such data in the course of their employment. For example, an employee of the school (such as the school secretary) would not be a data processor but if the school outsources data to an outside organisation (such as an external payroll company or an archiving service) that organisation could be considered to be a data processor.