Data Protection

The Data Protection Acts 1988 and 2003 provide similar rights of access as the Freedom of Information Acts, the main difference being that the Data Protection Acts do not apply to records of deceased persons. As with the FOI Acts, these rights extend to your own personal records and in specific circumstances, to those of your children. There are exemptions provided for in the Acts, this means that there are specific circumstances when the requested information will not be released. If any of these exemptions are used to withhold information, the reasons will be clearly explained outlined to you. Data Protection is the safeguarding of the privacy rights of individuals in relation to the processing of personal data. The Authority as a Data Controller must adhere to the eight rules of Data Protection. The eight rules, which apply whether the information is held on computer or in a manual form are:

  • Obtain and process information fairly
  • Keep it only for one or more specified, explicit and lawful purposes
  • Use and disclose it only in ways compatible with these purposes
  • Keep it safe and secure
  • Keep it accurate, complete and up-to-date
  • Ensure that it is adequate, relevant and not excessive
  • Retain it for no longer than is necessary for the purpose or purpose
  • Give a copy of his/her personal data to that individual on request.

You must apply in writing and simply refer to the Data Protection Act. The application fee of €6.35 must accompany the request.

When to use the Data Protection Act

You may use either the Freedom of Information Acts or the Data Protection Acts to access personal information held by public bodies. However, the Data Protection Acts apply only to your own personal information (or in certain circumstances that of your child) and requires an application fee of €6.35.

Entitlements under the Data Protection Acts

  • A decision will, in normal circumstances, issue within 40 days of receipt of your request
  • Details of your entitlement to complain to the Data Protection Commissioner will be included in the decision letter

Access to Information

To make an access request under the Data Protection Acts 1988 and 2003, please submit your request in writing to Suzanne O'Brien, Data Protection Officer, Health Information and Quality Authority, Georges Court, Georges Lane, Smithfield, Dublin 7. E-mail: Please ensure that you describe the records you seek in the greatest detail possible to enable us to identify the relevant records. There may be a fee of €6.35 for an application under Data Protection.

HIQA Statement of Information Practices


Statement of Information Practices

The Authority undertakes a periodic review of its information practices and at the end of the review process develops a Statement of Information Practices. This statement provides the general public with information on the types of personal information held by the Authority, the use the Authority makes of such personal information, a data subjects rights, and contact details for making a complaint to the Authority in relation to the personal data it holds.