
Contact with Third Parties Policy
Dublin City University (DCU) commits to providing students with a positive and excellent university experience and a professional standard of service. This policy aims to promote good practice that staff within the DCU Community should adhere to when dealing with third party requests for student data or when needing to contact a student’s third party/next of kin contact. The purpose of this policy is to guide staff in situations where a third party requests personal information about a student or there is a need to contact a student’s third party contact or next of kin. Additionally, the policy aims to guide third parties, and next of kin, who seek information about a DCU student and to clarify a student’s right to confidentiality.
Inappropriate or unwarranted contact with third parties or disclosure of student data can be a breach of personal data protection legislation and this policy aims to provide clear information on how to manage a data breach. All personal data breaches will be dealt with by the DCU Data Protection Unit.
For the purposes of this document, ‘third parties’ means any person or persons other than the two parties to the contract between the University and the student. The phrase includes, but is not restricted to, parents, siblings, spouses, relatives, employers, sponsors, landlords, partner universities, the media, and agencies wishing to carry out student surveys.
This policy applies to the following:
-
information held in relation to a currently registered student or former student / graduate;
-
any person who is employed by the University who receives, handles, or processes personal data in the course of their employment; &
-
any person requesting personal information about a current or formerly registered student.
The University is committed to ensuring that every student can have an excellent university experience. To achieve this, DCU staff members aspire to high levels of competency, fairness, and professionalism. The University is committed to a professional environment where students can expect their data to be protected and used only for business matters. The policy will outline the general principles for protecting student data, managing third party requests for information about a DCU student, and guiding DCU staff that may need to contact a third party such as a next-of-kin.
1) Each student of DCU has entered a contract with the University. Third parties are not parties to this contract in any way. In cases where third parties (e.g. parents) have paid fees or have had their means assessed for purposes of the Higher Education Grant, the relationship remains between the University and the student only.
2) All information held on all systems, whether manual or electronic, about a student (e.g., name, address, course of study, examination results, disciplinary matters, debts owed to the University) is confidential.
3) All information is confidential regardless of the student’s age, including those under 18. Similar to students under 18 entering into a contract with an employer, they can enter into a contract with the University. However, the University is not in loco parentis.
4) Student data will never be made available in such a way as to make individual students identifiable.
There are five exceptions to this confidentiality:
● in cases of emergency, or in cases where the student has given express permission in writing/email;
● in cases where personal data is shared:
(a) with another statutory body, a public body, or a government Department where there is a lawful basis to do so;
(b) with selected third parties including subcontractors or partner exchange universities;
(c) if we are under a legal obligation to disclose Personal Data (e.g. to the Gardaí).
● when, in accordance with legislation, student data is provided on a confidential basis to the Department of Social Protection for the purpose of identifying possible abuses of the Social Welfare System;
● when a written signed request is made by the Gardaí stating that the information is needed to prevent, detect or investigate a criminal offence; &
● in compliance with an Order for Discovery by the Courts.
5) Inappropriate or unwarranted contact with third parties or disclosure of student data can be a breach of data protection legislation. Further guidance on this can be obtained from the DCU Data Protection Unit.
6) This policy is binding on all university employees. However, some university employees (e.g. Counsellors, medical staff, etc.) will have their own professional code of ethics, including stipulations on confidentiality and contact with third parties, but it is not envisaged that there will be any conflict between such codes and this policy.
7) All mailings to students (for example, posting of examination results) should be marked ‘Confidential’ and sealed, as the addresses used in such mailings are frequently the parental address.
8) Students wishing to have a third party accompany them to a meeting with an Officer of the University and therefore may need to discuss data or information related to their student record, must confirm the third party’s attendance in advance of the meeting with the University Officer.
1) The University is committed to ensuring all students have a positive university experience. To achieve this, a student has the right to decide who should have access to confidential information. A student who wishes to give consent for a third party to discuss their records can email the relevant University unit to find out what local arrangement is in place. In most cases, a request is emailed via the DCU email account. Any third party contacting the University seeking general information about a DCU student can expect to be met with professionalism, courtesy and respect.
2) The University will normally not initiate contact with a student, if a third party is concerned about their welfare. Students are encouraged to contact the University themselves to seek support from, for example, Registry, Student Support Services or Academic staff. The Dean of Students or the Chief Operating Officer can, however, on a discretionary basis, initiate contact with a student.
3) Third parties trying to trace or contact a student cannot be provided with any contact details such as an address, email or telephone number. However, the University can offer to attempt to pass on a letter or a message to a student, with the proviso that the student may not have provided us with up-to-date data. In this case, DCU will not confirm or deny that the student is a student at the University. If a letter is passed on, it should be accompanied by a covering note explaining that the address has not been conveyed to the third party. Remember that the student may have severed links with the third party for very good reasons; whatever the reason, the decision is the students.
4) In the case of students with a disability, and where a third party is heavily involved in their life, normal confidentiality and data protection legislation are still applicable. However, as per section 1 above, a student can contact the Disability and Learning Support Unit to arrange for consent to be provided, if needed.
5) For third party complaints, the University does not provide scope for a complaint to be made by a third party on behalf of a student. If a student wishes to make a complaint to the University, the Student Policy Officer can provide guidance based on the nature of the complaint.
1) For staff who wish to contact a third party connected to a student, normal confidentiality and data protection legislation are still applicable. Students have at registration, given the name and address of their next of kin (normally, a parent) for use in emergencies only.
2) In the first instance, advice should always be sought from the Dean of Students or the Chief Operations Officer to determine if a situation is an emergency or not.
3) If it is agreed, contact can be made as per section 2 above, if practicable, permission should be sought from the student in advance of contact being made with a third party or next-of-kin.
4) If a student withholds permission to contact a third party/next of kin and this decision is against his or her best interests (for example, after admission to hospital), it is the judgement of the Dean of Students or the Chief Operations Officer to determine how to proceed.
5) Emergency cases where contact can be made could include the following:
-
where there are good grounds for believing that serious harm may occur to the student or to others;
-
where a student appears to have disappeared; &
-
serious concern is being expressed by classmates or friends and the student is not engaging or is unable to engage in the support available.
6) Situations where contact with next of kin is not warranted includes the following:
-
to pursue debts;
-
check on a student’s whereabouts;
-
discuss cases of unacceptable behaviour or breaches of the code of discipline;
-
fundraising; &
-
publicising events or facilities on campus (e.g. concerts, Open Days, DCU Sport membership, Campus Residences, etc.).
7) In situations where a student dies on campus, or the University receives news about a student death, please refer to the Death of a Student policy. There are specific procedures to follow in relation to contacting family/next of kin.
The roles and responsibilities of those engaging with this policy are as follows.
Staff of the University
-
The obligation of university staff is to maintain confidentiality and protect the students’ right to decide who should have access to confidential information. It is expected that this is dealt with in a professional manner.
-
All information held on all systems, whether manual or electronic, about a student (e.g., name, address, course of study, examination results, disciplinary matters, debts owed to the University) is confidential.
-
Inappropriate or unwarranted contact with third parties or disclosure of student data can be a breach of data protection legislation Further guidance on this can be obtained from the DCU Data Protection Unit.
-
If a third party seeks to contact a student, it is useful to inquire whether the matter is urgent (e.g. serious illness, or the death of a family member or relative). In such cases the University will attempt to contact the student quickly, while explaining to the third party that this may be difficult.
Students
-
Must seek to provide consent in advance of any meeting with a University Officer where a third party will be attending the Student-Officer meeting.
-
In the case of students with a disability, and where a third party is heavily involved in their life, normal confidentiality and data protection legislation are still applicable.
Third Parties
Familiarise themselves with this policy and respect the limitations of providing information about a student.
The ‘General Data Protection Regulation’ (GDPR) is the law which applies to most kinds of processing of personal data and it applies directly in Ireland (and across the EU), along with further national rules set out in the Irish Data Protection Act 2018. Any breach in relation to the disclosure of a student’s data without their consent could lead to a complaint and/or fine for the University. Additionally, the University reserves the right to implement proceedings should a staff member recklessly or intentionally cause a breach.
Third Party |
This is any person or persons other than the two parties to the contract between the University and the student. The phrase includes, but is not restricted to, parents, siblings, spouses, relatives, employers, sponsors, landlords, partner universities, the media and agencies wishing to carry out student surveys. |
Next-of-Kin | A legal concept which refers to a person's nearest blood relatives or the designated as an emergency contact |
‘in loco parentis’ | ‘In loco parentis’ refers to the concept of being ‘in the place of the parent’. It is a legal principle where a person or institution takes on some of the responsibilities and duties of a parent, particularly regarding the care and supervision of minors. |
Personal Data | The term ‘personal data’ means any information concerning or relating to a living person who is either identified or identifiable. |
This policy should be read in conjunction with the following policies, procedures or guidelines.
-
Death of a Student Policy
-
Protocol for Staff Dealing with a Student Death
Any queries regarding this policy should be directed to the Student Policy Officer.
Email deirdre.moloney@dcu.ie
This policy will be reviewed as and when changes are required. If no reviews are requested, the policy will be reviewed in 2030.
Policy Name | Contact with Third Parties Policy | ![]() |
|
Unit Owner | Student Support & Development | ||
Version Reference | Original Version – 2.0 | Reviewed Version – N/a | |
Approved by | Executive | N/a | |
Effective Date | April 15th 2025 | N/a |