Privacy statement

NCRI is a public body established to collect data relating to the incidence and prevalence of cancer in Ireland.  NCRI has a legal basis to collect data, as set out under the National Cancer Registry Board (Establishment) Order. 

NCRI is the data controller for the personal data it processes. 

Contact details

National Cancer Registry Ireland, 
Building 6800, 
Cork Airport Business Park, 
Kinsale Road, 
Cork 
T12 CDF7 

Tel: 021 4318014 

NCRI’s data protection officer can be contacted at the above address and phone number, or by email at dpo@ncri.ie. 

The personal data the NCRI collects and how it is used 

NCRI collects information about each newly diagnosed individual cancer patient and each tumour that occurs. It also collects relevant information about people who have not been diagnosed with cancer, for example, those who have a pre-invasive cancer or a benign central nervous system tumour.

The data is used for: 

• Maintaining a register of all cancers and related tumours in Ireland
• Providing data for use in approved research projects
• The planning and management of healthcare services, and
• Providing advice, information and assistance to the Minister for Health. 

NCRI obtains data primarily from hospitals and other healthcare service providers. The provision of information in this way and its processing by NCRI is legally authorised in the public interest under the Healthcare (Provision of Information) Act as amended by the Data Protection Act 2018 and the National Cancer Registry Board (Establishment) Order. 

NCRI also collects personal data as an employer, as detailed below, and through requests/forms on the website, where name, address, email address may be collected to facilitate a request. This information is only kept to fulfil the purpose of the request.  

Who the data is shared with 

Data may be shared with hospitals and other healthcare providers for the monitoring of healthcare outcomes and quality control. 

Data is shared with external research organisations for approved research projects. Such projects are subject to a stringent approval process and strict commitments to data protection compliance, in accordance with the Data Protection Act 2018. 

Transfers of personal data outside Europe 

Where necessary, for approved research projects or collaboration with other countries’ cancer registries, data may be transferred to countries outside of the European Economic Area. Some countries may not have been designated by the European Commission as having an adequate level of data protection at a national level. In these cases, NCRI primarily relies on Commission-approved standard contractual clauses with its partners to safeguard data.  

Information about the standard contractual clauses may be found on the European Commission’s website.

Retention of data 

NCRI retains personal data for as long as is necessary to fulfil the purposes for which it is recorded, unless specifically required by law to keep the data for longer. 

Your data protection rights 

• You have the right to be provided on request with a copy of your personal data. For health related data requests, NCRI is obliged to consult with the appropriate health practitioner (normally, your treating clinician) to ensure providing the data to you will not result in serious harm to your physical or mental health.
• You have the right to rectification of inaccurate data NCRI may have recorded about you.
• You have the right to the erasure of your data (“right to be forgotten”) 
• You have the right to object to processing of your data which is being done by the NCRI in the public interest or in the exercise of our official authority.
• You have the right to restrict the processing of your personal data when:
  • the basis for its processing is in dispute;
  • its accuracy is in dispute;
  • we cannot establish a lawful basis for its processing, but you do not wish it to be erased;
  • we no longer need your data, but you need it for the establishment, exercise, or defence of legal claims;
  • you object, where applicable, to our processing of your data, pending verification of whether your interests override our legitimate grounds.
• You have the right to be provided with a copy of your data which NCRI is processing on the basis of a contract to which you are party, or your consent. Your data must be provided to you in machine readable format, or transferred directly to another data controller (“data portability”). In general, this right does not apply to your data which NCRI has collected for research purposes.
• If you are not satisfied with NCRI's responses or are otherwise concerned with how it has processed your personal data, you also have the right to make a complaint to the Data Protection Commissioner.

Processing data for employment purposes 

As an employer, NCRI must process personal data belonging to employees and contractors.  

This is in line with its legal and contractual obligations.  

All data belonging to potential, current or former employees, contractors, internships and placements, including name, address, gender, date of birth, marital status, education and employment history, banking details, training records and health data, is kept in the strictest of confidence and only used for the specific purpose for which it was gathered.  

NCRI uses third-party contractors and service providers to support its Human Resource activities. Certain details belonging to employees will be processed by third-party contractors. This is specific, limited and protected by Data Processing Agreements.  

Website data 

For more information about how the website stores your personal data in webforms and cookies, please see this page.