Privacy notice
This Privacy notice explains how Fáilte Ireland collects, uses, shares, stores and protects personal data when carrying out its statutory functions, delivering services and engaging with individuals and organisations.
Last updated in July 2026.
About this Privacy notice
This Privacy notice describes the types of personal data we process, the purposes for which it is used, the lawful bases we rely upon, how long it is retained, who it may be shared with and the rights available to individuals under data protection legislation.
Any personal data is processed in accordance with applicable data protection legislation, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
Who we are (Data Controller)
The National Tourism Development Authority, known as Fáilte Ireland (referred to as "we", "us" or "our"), is the Data Controller for the personal data described in this Privacy notice. Under the National Tourism Development Authority Act, 2003, our role is to sustain Ireland's economy by developing and enable a competitive and resilient tourism sector. We do this by delivering meaningful and impactful services to our tourism business clients to help them grow and compete; by encouraging more people to consider a career in tourism, by partnering and collaborating to develop world-class destinations and quality experiences and facilities for our visitors and by promoting Ireland as a holiday destination. This means we engage with a broad range of people, whose personal data we process in the course of delivering the services and activities under our mandate. These services include, but are not limited to training and grants, and other business services to drive competitiveness.
How to contact us
If you have any queries about this Privacy notice or how your personal data is processed, you can contact us using the contact form, via email or through the address below.
Address: Fáilte Ireland, 88-95 Amiens Street, Dublin 1, Ireland, D01 WR86.
You may also contact our Data Protection Officer (DPO) using the contact details above. The DPO can provide advice regarding your rights and on Fáilte Ireland's processing of personal data.
What personal data we collect and why
This section provides a summary of the main categories of personal data processed by Fáilte Ireland, why we process that information and the lawful basis we rely upon.
Under data protection law, Fáilte Ireland must have a lawful basis for processing personal data. Depending on the activity, this may include carrying out our statutory functions, complying with legal obligations, fulfilling contractual requirements, protecting legitimate interests, or relying on consent where appropriate.
In certain circumstances, providing personal data is a statutory or contractual requirement, or necessary to access our services. Failure to provide required information may result in our inability to deliver services or fulfil our legal obligations.
Details of personal data processed by category
| Personal data categories | Description (may include the following) |
| Contact data | Name, postal address, email address, telephone number, and IP address. No Special Category Data is normally processed. |
| Recruitment data | Personal data relating to a job application, including contact data, qualifications, employment history, references, interview notes, and documentation required to establish eligibility to work in Ireland (e.g., work visa and permit). Special Category Data may arise where documentation reveals racial or ethnic origin and relevant health information; or unsolicited special category of data such as trade union membership. |
| Employment data | Personal data relating to employment and workforce management, including contact data, next of kin, personnel records, payroll information, attendance records, training records, and performance information. Health information Special Category Data may arise where documentation reveals racial or ethnic origin or unsolicited special category data such as trade union membership. may be processed to comply with employment law, health, and safety obligations, or to provide reasonable workplace accommodations. |
| Service data | Personal data relating to (i) clients and their employees (ii) people working in tourism communities and (iii) stakeholders/partners who avail of Fáilte Ireland services. Data includes contact data, attendance/service activity records). No Special Category Data is normally processed. |
| Sole Trader Client data (including their employees) | Business name, trading name, business contact details, tax reference number (PPSN), bank account details (where required for payments), and data relating to engagement with Fáilte Ireland services. No Special Category Data is normally processed. |
| Statutory Register data | Personal data required to establish and maintain entries in statutory registers operated by Fáilte Ireland. This personal data includes business or personal name, business or personal contact details, registration information, required to administer statutory registers operated by Fáilte Ireland. No Special Category Data is normally processed. |
| Imagery (still or video) | Photographs, video recordings, and other visual media of staff/contractors and persons captured at events, promotional activities, or meetings. Images may be used to identify people who work for us (contract) and demonstrate the use of public funds promote tourism (legitimate interest/ consent/public task). |
Table of personal data collected by subject, purpose and legal basis
| Individuals (Subjects) | Personal data categories | Purpose | Legal basis |
| Staff and contractors |
| Employment and workforce management | Purpose of a Contract; Legal Obligation |
| Job applicants |
| Recruiting staff | Pre-contract |
| Business clients |
| Delivering client services and statutory functions | Public Task |
| People working in tourism communities and volunteers |
| Community and destination development initiatives | Public Task |
| Users of information services |
| To provide information | Public Task |
| Members of the public |
| To promote tourism | Consent |
| Students |
| Delivery of tourism education programmes | Public Task |
| Strategic partners |
| Collaboration on tourism initiatives | Public Task |
Children and vulnerable individuals' personal data
Fáilte Ireland is committed to protecting the privacy and rights of children and vulnerable individuals. We do not knowingly collect or process personal data relating to children or vulnerable individuals without appropriate consent, authorisation, or another lawful basis for processing.
Where personal data relating to children or vulnerable individuals is processed, additional safeguards are applied to protect their rights, freedoms, and interests. These safeguards may include parental, guardian or authorised representative consent where appropriate, enhanced privacy risk assessments, restricted access controls, age-appropriate and accessible communications, increased management oversight, and additional monitoring of processing activities.
We take particular care to ensure that any processing involving children or vulnerable individuals is lawful, fair, transparent, necessary, and proportionate to the purpose for which the personal data is collected and used.
If you believe that personal data relating to a child or vulnerable individual has been collected, processed, or disclosed without appropriate authorisation or safeguards, please contact us using the details provided in this Privacy notice.
CCTV imagery
We operate CCTV systems at certain premises for security, health and safety and asset protection purposes. Your image may be processed because of you attending one of our offices. CCTV footage is accessed only by authorised personnel and retained only for approved periods unless required for legal or investigative purposes.
Automated decision-making statement
We do not carry out automated decision-making, including profiling, which produces legal effects or similarly significant impacts. All recruitment decisions involve human review.
Use of our websites
When you visit our website, certain information is automatically collected, including your IP address, device information, browser type, operating system, referring website, pages visited, general location data, and the date and time of access.
We use this information to improve website performance, analyse trends, diagnose technical issues, and understand how visitors use our websites. For further information, please refer to our Cookie policy.
Linked services, third party sites and content
Our website may include links to third-party websites, services, or content. These sites are not under our control, and this Privacy notice does not apply to them. We are not responsible for their privacy practices. If you follow a link to another site, you should review its privacy notice before providing personal data. This includes services such as YouTube or Google.
How we protect your personal data
We take the security of your personal data seriously and use a range of robust technical and organisational measures to protect it from unauthorised access, loss, misuse, disclosure, or alteration. Access to personal data is restricted to personnel and service providers who require access to perform their duties.
Additional safeguards are applied when processing special category data.
Security measures implemented by Fáilte Ireland include:
- Secure network infrastructure;
- Access controls and role-based permissions;
- Multi-factor authentication where appropriate;
- Firewalls;
- Anti-virus and anti-malware protections;
- Encryption technologies; and
- Ongoing monitoring and security reviews.
Any misuse or unauthorised disclosure of personal data is treated as a serious matter and managed in accordance with Fáilte Ireland's internal policies and procedures.
Who we share your data with
We may share personal data with trusted service providers, professional advisers, government departments, public bodies, regulators, auditors, and other organisations where this is necessary to provide services, fulfil our statutory functions, comply with legal obligations, or protect our legal interests.
Where personal data is shared, appropriate contractual, organisational, and technical safeguards are applied to ensure that information remains protected.
International data transfers
In limited circumstances, personal data may be transferred or accessed outside the European Economic Area (EEA).
Where this occurs, Fáilte Ireland ensures that appropriate safeguards are in place in accordance with GDPR. These safeguards may include:
- An adequacy decision issued by the European Commission;
- Standard Contractual Clauses approved by the European Commission; or
- Other lawful transfer mechanisms recognised under data protection legislation.
These safeguards are designed to ensure that personal data continues to receive an equivalent level of protection when transferred internationally.
Retention of personal data
Fáilte Ireland retains personal data only for as long as necessary to fulfil the purpose for which it was collected and in accordance with legal, regulatory, and operational requirements. The criteria used to determine retention periods include:
- The nature of the relationship with the individual;
- Legal or statutory requirements;
- Regulatory obligations;
- Operational requirements; and
- The need to establish, exercise or defend legal claims.
Personal data is securely deleted, anonymised or destroyed when it is no longer required and retention is no longer necessary for the purpose for which it was collected.
What we never do with your personal data
We are committed to ensuring that personal data is processed lawfully, fairly, and transparently. In particular, we do not:
- Process personal data for purposes unrelated to our statutory functions or services.
- Sell, trade, or otherwise commercially exploit personal data.
- Use personal data in a manner that would be inconsistent with individuals’ reasonable expectations.
- Retain personal data beyond defined retention periods.
- Disclose personal data except where necessary, lawful, and subject to appropriate safeguards.
Your data protection rights
You have the right to:
- Access your personal data;
- Request correction of inaccurate personal data;
- Request deletion of your personal data in certain circumstances;
- Request restriction of processing;
- Object to processing in certain circumstances;
- Request a copy of your personal data in a portable format where applicable;
- Withdraw consent where consent is relied upon; and
- Lodge a complaint with the Data Protection Commission.
To exercise your rights, you may contact us using the contact details provided. We may need to verify your identity before processing your request.
To exercise your rights, you may complete a personal data access request form. We may need to verify your identity before processing your request.
We will respond to requests in accordance with applicable data protection legislation. For your protection, we may request proof of identity before processing a request. This may include photographic identification and proof of address where necessary.
Changes to this Privacy notice
We may update this Privacy notice from time to time. Where material changes are made, we will update the “last updated” date.
Complaints, questions and assistance
If you have any questions about how your data is processed, you can contact us through the contact form or by emailing the team.
Complaining to the Data Protection Commission
You have the right to lodge a complaint with the Data Protection Commission (DPC).
Address: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963.
- Telephone: (01) 765 0100
- LoCall: 1800 437 737
- Email: info@dataprotection.ie
- Visit the Data Protection website
You also have the right to lodge a complaint with the supervisory authority in your country of residence, who will liaise with the Data Protection Commission, where appropriate.
We encourage you to contact us first so we can address your concerns.