Data Protection

The National Museum of Ireland (NMI) is committed to a policy of protecting the rights and privacy of individuals in relation to the processing of personal data, in both paper and electronic format. This is undertaken in accordance with the Data Protection Act 1988 and the Data Protection (Amendment) Act 2003 as well as the General Data Protection Regulations (EU 2016/679) which came into effect on 25 May 2018.

NMI Data Protection Policy

The NMI requires, for administrative purposes, to process personal data about its staff, visitors, suppliers and other individuals with whom it has dealings. To comply with the law, personal data will be collected and used fairly, stored safely and securely and not disclosed to any third party unlawfully.

The purpose of our Privacy Statement is to outline how we process personal data, including special categories of data and the basis on which personal data is obtained from you or collected about you from third parties.

Who is the Data Controller?

As a Data Controller the National Museum of Ireland is committed to fulfilling its obligations to protect your privacy as imposed by Council Regulation (EU) 2016/679. This is known as the General Data Protection Regulation (GDPR). The Data Controllers for NMI are the Board of the National Museum of Ireland.

Subject Access Request

Under Data Protection law, you have the right to be informed by us whether we hold personal data about you, and if so, how it is used and shared. You also have the right to obtain a copy of the personal data relating to you that we hold (Subject Access Request). Please note that you cannot make a Subject Access Request for access to another person’s personal data. In most cases, we will provide a response to a Subject Access Request free of charge.

If you have any queries or concerns regarding Data Protection in the National Museum of Ireland, or if you would like to make a Subject Access Request, please contact our Data Protection Officer using the contacts details shown below:

Your request should be as specific as is possible to enable us to identify where the particular data is held. A response to your access request will issue to you as soon as possible and, in any event within 30 days. If, due to the complexity and number of requests, more time is needed to process it, this period may be extended by a further two months.

Records which contain your personal data may contain other information which does not relate to you. We are not obliged to release that information as part of a Subject Access Request.
There are certain exemptions that restrict the right of access and allow for a refusal of a request. An appeal against a refusal can be made direct to the Data Protection Commission, 21 Fitzwilliam Square, Dublin 2 or by visiting www.dataprotection.ie