GDPR for Schools and Creches in Ireland: 2026 Guide

Last updated 2 November 2026. General information only, not legal advice.

Schools, creches, playschools and childcare providers hold some of the most sensitive personal data there is: information about children, their health, their family circumstances and their safety. This guide explains, in plain English, what the GDPR and the Data Protection Act 2018 mean for these organisations in Ireland, using the Data Protection Commission (DPC) guidance as the main reference point. It is written for managers, boards of management and owners rather than for parents.

Why children’s data needs extra care

Under the Data Protection Act 2018 a child is a person under 18 for GDPR purposes. The GDPR itself says children merit specific protection because they may be less aware of the risks and of their rights (Recital 38). The DPC’s Children Front and Centre: Fundamentals for a Child-Oriented Approach to Data Processing sets out 14 principles, including age-appropriate transparency, a “zero interference” approach to legitimate interests where a child’s best interests are at stake, and carrying out a DPIA for children’s data processing.

In practice that means higher expectations on security, on clear notices that parents and, where appropriate, children can understand, and on being able to justify every use of children’s data.

Who is the data controller?

A school’s board of management or a creche’s owner or company is normally the data controller: the organisation that decides why and how personal data is used. Outside providers, such as school management software, cloud storage, payment apps, parent communication apps and IT support, are usually processors acting on your instructions. You remain responsible for them, which is why contracts matter (see below).

Do schools and creches need a Data Protection Officer?

Article 37 requires public authorities and bodies to appoint a DPO, and also organisations whose core activities involve large-scale regular monitoring or large-scale processing of special-category data. The DPC’s toolkit for schools states that the 2018 Act excludes recognised schools from the public-authority definition, but that schools established and maintained by an ETB are included and the ETB must appoint a DPO. Other schools may appoint one voluntarily.

For a private creche, the question is whether the large-scale tests in Article 37 are met, which depends on size and what you do. Most small settings will not trigger them, but it is a judgement you should document. Our guide Do you need a Data Protection Officer in Ireland? walks through the tests. The DPC recommends having a named data protection contact either way.

Lawful bases: what you rely on and why

Every processing activity needs a lawful basis under Article 6. In schools and childcare, the common ones are:

• Legal obligation: for example enrolment and attendance records required by education or childcare legislation, or reporting child protection concerns. You should be able to point to the specific legal requirement.
• Public task or contract: for a school delivering education; for a private creche, the contract with parents.
• Consent: typically used for optional extras such as photographs for a newsletter or social media. It must be specific, informed and easy to withdraw, and there is no such thing as bundled consent. Permission for a school trip does not cover posting photos online.
• Vital interests: genuine emergencies, such as a medical emergency.

The age of digital consent in Ireland is 16 (Data Protection Act 2018, section 31), so parental consent is needed below that age where consent is the basis for an online service offered to a child.

Health data, photographs, CCTV and technology

Allergies, medical conditions and special educational needs are special-category data under Article 9, so you need an Article 9 condition as well as an Article 6 basis, and tight access controls.

Photographs. Consent from a parent or guardian is generally the basis for photographs used outside core educational purposes. Record what each consent covers, make it easy to withdraw, and keep a list so staff know whose images cannot be used.

CCTV. The DPC expects a defined purpose, a lawful basis, proof that CCTV is necessary and proportionate, signage, a retention period and a CCTV policy. Cameras should not operate where people have a higher expectation of privacy, and a DPIA is advisable where children are filmed.

Apps and EdTech. Learning platforms, parent apps and online daily-report tools involve children’s data held by a third party. Check what data is collected, where it is stored (including transfers outside the EEA), whether it is used for the provider’s own purposes, and what the contract says. A written contract with each processor is required under Article 28(3).

DPIAs: when you need one

A data protection impact assessment is required under Article 35 where processing is likely to result in a high risk. The DPC’s schools toolkit says it considers a DPIA necessary whenever children’s data is involved in higher-risk processing, and gives CCTV, third-party EdTech platforms and health-monitoring apps as examples, with a sample template in its appendix. Complete it before the processing starts. If you are considering new cameras, a new app or biometric attendance, a DPIA should come first. Plus Promotions Limited offers DPIA support for Irish businesses and organisations.

Retention: do not keep everything forever

The GDPR sets no fixed retention periods. Each school or creche should decide how long it keeps each category of record, linked to its purpose and any legal requirement, and write it down in a retention policy. The DPC notes that data should not be kept indefinitely just in case, though some records, such as accident reports, may justify longer retention in case of claims. Childcare settings should also check the record-keeping requirements in the Child Care (Pre-School Services) Regulations 2016 and Tusla’s guidance. Dispose of paper records securely by shredding.

Data subject requests and breaches

Parents and, in some cases, children and former pupils can make access requests and exercise other rights. You generally have one calendar month to respond, extendable by up to two further months for complex or numerous requests if you tell the requester within the first month. The deadline keeps running during school holidays. See our guide to data subject access requests in Ireland.

A breach can be as simple as an email sent to the wrong parent, a lost USB stick or a ransomware attack. Assess every incident for risk; if there is a risk to individuals, notify the DPC within 72 hours of becoming aware, and tell affected individuals where the risk is high. Our 72-hour data breach response guide explains the steps.

For the wider picture, see our GDPR and data protection hub.

Need help with this? Plus Promotions Limited provides DPIA support for Irish businesses, from €495. Find out more about DPIA support.

Frequently asked questions

Do schools need a DPO in Ireland?

Not automatically. According to the DPC’s Data Protection Toolkit for Schools, the Data Protection Act 2018 excludes recognised schools from the definition of public authority for the purposes of Article 37, but schools established and maintained by an Education and Training Board (ETB) are covered and their ETB must appoint a DPO. Other schools may appoint one voluntarily, and the DPC still recommends a named data protection contact.

Can a creche use CCTV under GDPR?

Possibly, but it needs a defined purpose, a lawful basis, and evidence that CCTV is necessary and proportionate. Signage, security controls, a retention period and a CCTV policy are expected. Cameras should not cover areas where privacy expectations are higher, such as changing and toileting areas. Because children are filmed, a DPIA is advisable before cameras go live.

Do creches need parental consent to take photographs of children?

Where a creche relies on consent for photographs, it is usually the parent or guardian who gives it. Consent should be specific to each purpose, so permission for in-setting display does not cover posting on social media. It must be easy to withdraw, and older children may have a say depending on their maturity.

How long can a school keep pupil records?

GDPR sets no fixed period. Each school decides a retention period for each category of record based on its purpose, and records the decision in a retention policy. Some records may need to be kept longer, for example where they may be needed to defend a legal claim. Do not keep data just in case.

Do schools have to report a data breach to the DPC?

If a breach poses any risk to individuals, the DPC must be notified without undue delay and, where feasible, within 72 hours of the school becoming aware of it. High-risk breaches must also be reported to the people affected. The 72 hours includes weekends and school holidays.

OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.