Short answer first: lecture recordings, transcripts and notes can contain personal data where they relate to identifiable people. A subject summary does not become your personal data simply because you uploaded the lecture. In Ireland the rules are the GDPR plus the Data Protection Act 2018, and the Data Protection Commission enforces both. You can ask for a copy, you can ask for deletion, and in some cases you can ask for a file you can take elsewhere. The organisation has one month to answer and normally provides the first copy without charge. The part people get wrong is not the rights. It is what a privacy policy means by European.
Whose data is in a lecture recording?
Usually three sets of people, in one file.
- You. Mostly your account details and how you use the tool.
- The lecturer. Their voice and their teaching material.
- Your classmates. Anyone who asked a question from the floor, and anyone who answered one.
A purely personal activity may fall outside GDPR, but that does not remove university rules, copyright or every privacy concern. The Data Protection Commission describes the household exemption as covering personal data kept by an individual and concerned solely with the management of their personal, family or household affairs, or kept for recreational purposes, and traces it to Article 2(2)(c) of the GDPR.
Read the condition attached to it, because that is the part that bites. The exemption applies only as long as the data is not used in connection with a professional or commercial activity and not made publicly available. Sharing with a large class group is not automatically equivalent to keeping a personal file; do not assume the exemption covers it.
University rules apply alongside data protection law and may impose additional restrictions on recording or sharing. We go through them side by side in can you record lectures in Ireland, and what the university records for you is in lecture capture at Irish universities.
Which law applies to you in Ireland?
Two instruments, one regulator. The GDPR applies directly, and the Data Protection Act 2018 gives it further effect in Irish law and fills in the parts the Regulation left to member states. The Data Protection Commission describes itself as the Irish supervisory authority for the GDPR, with its powers, duties and functions established under the 2018 Act.
That second half matters more than students expect, because some of the rules that decide your case are in the Irish Act rather than in the Regulation. Exam scripts are the clearest example, and they get their own section below. The complaint machinery is another: section 109 tells the Commission to examine a complaint, and lets it take steps to arrange or facilitate an amicable resolution where it considers one reasonably likely within a reasonable time. If a resolution cannot be reached in that time, the section lists what comes next, from rejecting or dismissing the complaint to serving an enforcement notice or opening an inquiry. The Commission's own description of the process follows the same order.
Court remedies also exist, but an access request does not automatically establish a compensation claim. The DPC complaint route below is the practical next step if an organisation fails to respond.
What are the rights worth knowing?
Four of them cover almost everything a student needs.
| Right | Where it sits | What it gets you | The limit on it |
|---|---|---|---|
| Access | Article 15 | Confirmation, a copy of your data, the recipients, the retention period and the source | Article 15(4) says it must not adversely affect the rights or freedoms of others |
| Rectification | Articles 16 and 19 | Inaccurate data corrected and incomplete data completed | Restricted in some cases by sections 43 and 60 of the 2018 Act |
| Erasure | Articles 17 and 19 | Deletion without undue delay where a listed ground applies | A qualifying ground is needed; legal obligations, public tasks and other exceptions can justify retention |
| Portability | Article 20 | A structured, commonly used, machine-readable copy | Data you supplied; automated processing based on consent or a contract, subject to others’ rights |
The Commission's guidance on access is worth reading once, because it lists what comes with the copy: the recipients the data has gone to, in particular recipients in third countries and the safeguards used, the retention period or the criteria for setting it, the source where the data did not come from you, and whether there is automated decision-making. The GDPR sets no particular method for making a request, so it can even be verbal, though the Commission encourages writing to avoid disputes about the details or the timing, and publishes a short template you can copy. Its pages on rectification and erasure list the grounds for each and the restrictions in sections 43 and 60 of the Data Protection Act 2018.
Portability is narrower than people assume. The Commission's page on Article 20 says it concerns personal data supplied by you and applies only where processing is automated and is based on your consent or on a contract with you, and that having your data sent straight to another controller applies only where the transmission is technically feasible.
Name the right you are using when you write. A clear heading and a specific description help the recipient understand the request; you do not have to cite an article for the request to be valid.
How long do they have to reply, and what does it cost?
Normally one month, with no fee. The Commission's own answer is that a controller must provide information on the action taken without undue delay and in any event within one month of receiving the request. That month can be extended by two further months where necessary, taking into account the complexity and number of requests, and if they extend it they must tell you within the first month and explain the reason. If they decide to do nothing, they must still tell you inside the month, and tell you that you can complain to a supervisory authority and seek a judicial remedy.
On money, the Commission is blunt. In most cases you cannot be required to pay a fee. Only where a request is manifestly unfounded or excessive, which the controller has to prove, can it charge a reasonable fee for administrative costs or refuse to act, and the Commission calls that a high threshold with very few cases meeting it. A reasonable fee is allowed for additional copies, so the first copy is the free one.
Keep the clock on your side
- Send the request by email, so the date of receipt is not in doubt.
- Say which right you are using and which data you mean: the recordings, the transcripts, the notes, the account logs.
- Diary the date one month out.
- If nothing arrives, reply on the same thread and ask them to confirm the date they received it.
Can you ask for your exam script?
Yes, and the point was settled through the Irish system. Peter Nowak was a trainee accountant who failed an exam, asked for his script, and was told it was not his personal data. The case went up through the Irish courts to the Court of Justice of the European Union, which ruled on 20 December 2017 that the written answers submitted by a candidate at a professional examination, and any comments made by an examiner on those answers, constitute personal data. The judgment interpreted the 1995 Directive that the GDPR replaced, and the Commission still hosts it on its own site.
When the clock starts on an exam request
Irish law then adds timing that catches people out. Section 56 of the Data Protection Act 2018 says an Article 15 request about an exam result, or about a script you completed in that exam, is taken to have been made on the later of the date the results are first published or the date of your request. The same applies to the result of an appeal. So a request sent while you are still waiting on results does not start the clock early. Section 56(3) adds a specific rule for an appealed Leaving Certificate script: the request is treated as made when the appeal results are first published. The Commission illustrates it with the Leaving Certificate, where exams sit in June and results come out in August, and a June request is treated as made in August.
Section 56 also defines what a script is, and the definition is wide. It covers any work produced by a candidate as part of an examination, including an answer book in written or digital form, a journal, a portfolio, an audio or visual recording, a practical piece or an artefact, plus any marks or comments an examiner added while marking. The definition names a portfolio and an audio or visual recording, so it reaches a recorded presentation as well as a written paper.
One limit to hold on to. Access gives you the data. It does not give you a new mark. If you think a grade is wrong, that is an appeal, and its deadline may be shorter than the access-request response period. Check both independently.
What does your university hold about you?
Check the published student privacy notice. UCC's student data protection notice runs from application, admission and registration through assessment and examinations, fee collection, IT and library administration, and on to graduation, archiving and alumni relations. Further down the same notice are the things students rarely picture: an SMS system every registered student is added to, photographs and video of university events, the campus-wide lecture capture system, insurance and accident claims, examination appeals and the mitigation process, disciplinary matters including suspected breaches of exam regulations and plagiarism, disability supports, health and safety records and CCTV.
Two details in that notice are worth copying into your own checklist. UCC names legitimate interests as its main legal basis, with consent used where appropriate, and it says that where it transfers personal data outside the European Economic Area it relies on legally approved mechanisms including the standard contractual clauses approved by the European Commission. Its data protection officer is the Information Compliance Manager, and the notice gives the address you write to.
The plagiarism line above has a system behind it, and what a similarity report actually compares is a subject in itself, covered in Turnitin at Irish universities.
What does "EU" mean in a privacy policy?
Where your files are stored and where they are processed are two different questions. A tool can keep your recordings and notes on servers inside the EU and still send the audio to a speech-to-text provider in the United States. Both sentences can be true at once, and the storage sentence is the one marketing pages prefer.
Two relevant transfer routes to the United States
- The EU-US Data Privacy Framework. The European Commission adopted its adequacy decision on 10 July 2023, and on the basis of it personal data can flow freely from the EU to US companies that participate in the framework.
- Standard contractual clauses. Still available. The Commission says the national security safeguards the US put in place apply to transfers under the GDPR whatever the mechanism used, and that this also helps the use of other tools such as standard contractual clauses and binding corporate rules.
The Commission describes the decision as following a US Executive Order and a Regulation from the US Attorney General, which introduced binding safeguards addressing the points the Court of Justice raised in its Schrems II decision of July 2020, including an independent redress mechanism for Europeans.
Transfer mechanisms can change. Check the current arrangement and the recipient’s participation or safeguards. A lawful transfer route does not itself authorise recording, remove university restrictions or provide a legal basis for every use of the data.
So do not ask only whether a tool is European. Ask where the audio is processed, and see whether it will tell you. If you are still choosing, we compared the main options on exactly that point in the best note-taking app for students in Ireland.
What should you check before you upload a term of lectures?
Article 13, as the Commission summarises it, requires a controller to tell you certain things when it collects your data, usually through a privacy notice, and the Commission's access guidance expects the same categories to come back in a response. If they are missing from the privacy policy, that is a gap rather than a style choice. Look for:
- Who the controller is. A company name and an address, not just a product name, and the contact details of its data protection officer where it has one.
- Recipients, or categories of recipients. The good version is a named list of sub-processors you can read in one sitting.
- Transfers outside the EU and the safeguard used. Named, so you can tell adequacy from standard contractual clauses.
- How long they keep it. A retention period, or the criteria used to set one.
- Your right to complain to a supervisory authority. In Ireland, the Data Protection Commission.
Two useful product checks
- Export and deletion controls. Check what the product lets you download or delete directly and how to make a broader request to the company.
- Training and secondary uses. Check whether the statement covers both the app and its processing providers, and whether there are opt-in settings or exceptions.
What if they ignore you?
Two steps, in order. Raise it with the organisation first, in writing, and keep the correspondence. The Data Protection Commission says it will generally require you to have done that before it takes up a concern, and that once you raise one through its online form it is obliged to give you an update or an outcome report within three months. It looks first at whether an amicable resolution is realistic, and moves to the complaint-handling steps in section 109 if not.
If the organisation relies on an exception, ask which provision applies and what information is being withheld. Keep the original request, delivery evidence and response together for the complaint.
Where Notibo fits
Notibo is an example of the storage and processing split rather than an exception to it. Notibo stores account records, recordings and notes in its Frankfurt database and storage infrastructure. This does not mean every processor handles data only in the EU. The transcription and the AI notes are generated by processors in the United States under standard contractual clauses, and the audio file itself is deleted from storage once the transcript and notes have been generated. Our privacy policy names each processor, so you can run it through the checklist above the same way you would run any other tool through it, and decide before a full term of lectures is sitting in someone's account.