EFFECTIVE 1^st SEPTEMBER 2026

What is the purpose of this document?

The Institute of Bankers in Ireland, trading as “IOB” takes privacy and the protection of our customer, affiliate, member, student and designate data very seriously. In this notice, we explain how we collect your personal information, how we use it and how you can interact with us about it.

Who are we?

When we talk about “IOB”, or “us” or “we” in this notice, we are talking about IOB and, where applicable, its wholly owned subsidiary company “IFS DAC” (trading as Institute of Financial Services Designated Activity Company).

What is this notice?

This privacy notice describes how we collect and use the personal information of individuals we engage with (such individuals are referred to in this notice as “data subject” or “you”).

The table below describes the categories of individuals who this notice applies to.

Categories of individuals this notice applies to table

This notice does not form part of any contract to provide services. We may update this notice at any time.

Supplementary Privacy Notices

IOB may provide supplementary privacy notices where particular processing activities require more detailed transparency information than is contained within this Data Protection Notice. Such notices should be read together with this Notice and may apply to recruitment and applicant activities, employment-related processing, online assessment and invigilation activities, photography, filming and audio recording, research activities and other specific processing activities where additional transparency information is appropriate.

It is important that you read this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are aware of how and why we are using such data.

Data Controller

IOB is a “data controller”. This means that we are responsible for deciding how we hold and use personal data about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

Joint Controller Arrangements

For certain educational programmes, professional designations, certification schemes, accreditation activities and continuing professional development ("CPD") services, IOB may act as a joint controller with an educational institution, professional body, accreditation body or other organisation where both organisations jointly determine the purposes and means of processing personal data.

Where a joint controller arrangement applies, personal data may be exchanged between the joint controllers for purposes including:

• programme administration;

• learner and member support;

• assessment and certification activities;

• designation administration and renewal;

• CPD monitoring and compliance activities;

• quality assurance and governance;

• regulatory reporting;

• audit and compliance activities; and

• the exercise, establishment or defence of legal claims.

Examples of organisations with which IOB may act as a joint controller include educational partners, professional bodies, designation providers, accreditation organisations and examination bodies (e.g. UCD, the Compliance Institute, the Central Bank of Ireland, Insolvency Service of Ireland (ISI), Chartered Institute of Bankers in Scotland (CIOBS)).

Where IOB acts as a joint controller, responsibilities for compliance with data protection legislation are allocated between the parties in accordance with applicable law. Further information regarding applicable joint-controller arrangements, including the essence of those arrangements, is available on request from the Data Protection Officer.

Workforce and Business Relationships

We process personal data for the purposes of recruitment and for the formation and administration of the contract of employment and employee relationship in support of IOB’s operations. A detailed privacy notice for IOB employees is available from Human Resources and is provided to new members of staff with their contract. Additional information regarding recruitment and employment processing is contained within the Recruitment & Applicant Privacy Notice and Employee Privacy Notice.

Suppliers, Service Providers and Business Contacts

We process personal data relating to suppliers, contractors, consultants, associate faculty, educational partner representatives and other business contacts for the purposes of supplier onboarding, due diligence, contract administration, procurement, payment processing, relationship management, regulatory compliance, governance, audit and business operations.

This may include contact details, professional information, contractual information, financial information, payment records, bank account details, taxation information and records of communications with IOB.

Further information regarding the purposes, lawful bases and categories of personal data processed is provided in the processing activities table below.

Children and Younger Learners

Some IOB programmes, educational activities or apprenticeship-related services may involve the processing of personal data relating to children or individuals under the age of 18.

Where IOB processes personal data relating to children, we will do so in accordance with applicable data protection legislation and will implement additional safeguards appropriate to the nature of the processing and the age of the individual concerned.

Where required, IOB may communicate with a parent, guardian, employer, sponsor, training provider, educational institution or other authorised representative regarding matters connected with programme administration, learner welfare, regulatory obligations, assessment activities or the provision of educational services.

Additional information regarding specific processing activities may be provided in supplementary privacy notices where appropriate.

What kind of information does IOB collect and hold about you?

Personal Data

“Personal data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). There are “special categories of personal data” which require a higher level of protection. These include information about a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health or condition or sexual life.

We collect different types of personal data depending on your relationship with us. To make this easier to understand, we have grouped personal data into the categories below.

Personal data categories table

Where relevant, additional governance controls and safeguards may apply to certain types of personal data, including criminal offence data, government identifiers, biometric data, children's data and international transfers

Criminal Convictions and Offences Data

IOB does not routinely collect or systematically process personal data relating to criminal convictions or offences. Such data is only processed where necessary and proportionate in accordance with applicable law. Where personal data relating to criminal convictions is processed, IOB will ensure that appropriate safeguards are applied, including restricted access, strict retention controls and oversight by authorised personnel.

How does IOB collect and hold personal information about you?

We collect personal information from you, for example when you become a member; or a customer in order to create an account on IOB Learn; register to an educational programme; apply for information on our products and services; apply for a designation/CPD scheme or express an interest in one of our programmes or a programme offered in association with one of our educational partners; provide a service to IOB; become a Council member; apply for a job with IOB etc. We also collect information through our websites, web-conferencing, social media, the IOB Learn application, CCTV footage and through communication between you and IOB by telephone, email and chat (via our websites) (for example, when you make enquiries about a programme or when you are raising concerns or queries).

We will create some data internally (e.g. when we assign you an IOB customer number or you become a council member or determine assessment results or exchange correspondence with you).

We will also collect additional personal information throughout the period you remain a member or student of IOB, council member, corporate customer, or you continue to interact/work with or provide a service to IOB or purchase products/services from us.

In some circumstances, we obtain personal data about you from sources other than directly from you. The source of the information depends on your relationship with IOB and the service or activity concerned.

We may obtain personal data from:

• employers, sponsors, educational institutions, professional bodies or other organisations that nominate, sponsor, fund or administer your participation in IOB programmes, services, membership schemes, professional designations or continuing professional development activities;

• referees, previous employers, recruitment agencies, educational institutions, qualification-awarding bodies and other third parties involved in recruitment, employment or workforce-related processes;

• educational partners, lecturers, tutors, examiners, moderators, invigilators, mentors and other contributors involved in the delivery, assessment or administration of educational, professional development or examination services;

• parents, guardians or authorised representatives acting on behalf of a learner where appropriate.

• service providers and suppliers who support the delivery of our programmes, examinations, online services, customer support, technology platforms and business operations;

• regulators, accreditation bodies, professional standards bodies, government departments and public authorities where information is provided to us in connection with legal, regulatory or professional requirements;

• publicly available sources, including publicly accessible registers, professional directories, company records, regulatory publications, websites and other publicly available information sources where permitted by law; and

• individuals acting on your behalf, including authorised representatives, guardians, attorneys or other persons authorised to communicate with us in relation to your affairs.

Where we obtain personal data from third parties, we will process that information in accordance with applicable data protection legislation and provide any additional transparency information required by law, including information regarding the source of the data and how it will be used.

Cookies and similar technologies

IOB websites and digital services may use cookies and similar technologies to operate our websites, improve functionality, understand usage and support online services. Some third-party tools, including chat, help centre or analytics tools, may also use cookies or similar technologies. Further information is provided through our cookie settings or cookie notice, where applicable. Where chat or help centre functionality is provided by a third-party provider, that provider may use cookies or similar technologies in connection with that service.

How does IOB use your information?

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we have entered into with you;

• Where we need to comply with a legal obligation;

• Where we obtain your consent;

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;

• Where processing is necessary for the performance of a task carried out in the public interest, where applicable;

• We may also use your personal data, which is likely to be rare, where we need to protect your interests (or someone else’s interests).

Purposes for which IOB uses your personal information

The table below describes the legal basis that applies to our purposes for processing your personal data and for the categories of individuals that applies to. Depending on the circumstances, more than one legal basis may apply.

Learner Engagement Information

IOB uses information generated through its educational systems, learning management systems, educational platforms and associated learning technologies to help administer programmes, support learners and improve educational services. Engagement information may include attendance records, participation in online learning activities, access to learning resources, viewing of recorded educational content, completion of learning activities, assessment participation and other indicators of academic engagement. Such information is reviewed by appropriately authorised staff and is used to support learners and enhance the quality and effectiveness of IOB's educational services. IOB does not make decisions producing legal or similarly significant effects based solely on automated analysis of learner engagement information.

Educational Technologies and Assessment Systems

IOB uses a range of educational, assessment and examination technologies to support the delivery of programmes, assessments, academic integrity processes, online examinations, identity verification, examination monitoring, online invigilation and learner support activities. Additional information regarding these activities, including the categories of personal data processed, applicable retention periods, recipients and safeguards, is provided in relevant supplementary privacy notices where applicable.

IOB may use AI-enabled educational technologies to support learning, revision, information retrieval, learner engagement and student support activities. Such systems may process information submitted by learners during their interactions with the service, together with associated usage and technical information. Where AI-enabled services are deployed, IOB will implement appropriate governance, security and human oversight measures and will provide additional information in supplementary privacy notices where required.

Direct marketing and preferences

IOB may contact you with information about our membership services, professional designations, educational programmes, examinations, events, CPD activities, publications and other products or services which may be relevant to your relationship with IOB.

Such communications may be provided by post, telephone, email, SMS or other digital communication channels where permitted by law.

You may update your marketing preferences at any time through available self-service facilities, where provided, or by contacting IOB directly.

Photography, Filming and Audio Recording

IOB may capture photography, film and audio recordings in connection with educational activities, conferences, events, ceremonies, promotional activities and organisational communications. Additional information regarding the purposes, lawful bases, retention arrangements, publication of images and the exercise of privacy rights is available in the IOB Photography, Filming and Audio Recording Privacy Notice.

If you fail to provide personal data

If you fail to provide certain data when requested, we may not be able to perform the contract we have entered into with you (such as paying you or providing a service to you) or we may be prevented from complying with our legal obligations.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

How do we use special categories of personal data?

“Special categories of personal data” require higher levels of protection. We have in place appropriate safeguards which we are required by law to maintain when processing such data. We may process your special categories of personal data, in limited circumstances, with your explicit written consent. Within this notice, these data types are classified as Category M - Special Category Personal Data

Less commonly, we may process this type of data where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.

The situations in which we will use your special categories of personal data in are as follows:

• We will consider your physical or mental health information, or disability status, to determine eligibility of students for special assistance requirements for assessments or the postponement of programmes (Leave of Absence applications “LOA”) or deferral of assessments/programme modules (Extenuating Circumstances applications “IX”).

• We will consider your physical or mental health information to determine eligibility of members, students, designates for fee waivers.

• We will consider your physical or health information to assess the eligibility of designates for reduced CPD requirements (Pro-rata applications).

• We may consider health, disability, medical, welfare or other special category information where you provide it in connection with an appeal, complaint, academic integrity process, disciplinary matter, extenuating circumstances request, special considerations request, fee waiver, pro-rata CPD application or other support request.

• We will consider information about your health for the purpose of determining food and beverages that should be served at our events, provide you with information about accessibility to our events and/or your attendance needs at our events as well as to facilitate same.

Supporting medical evidence submitted in connection with any of these processes will only be accessible to authorised personnel with a legitimate need to know and will be retained only for as long as necessary to assess and administer the application, after which it will be securely deleted in accordance with IOB's Records Retention Schedule.

Additional information regarding the processing of special category personal data in specific contexts may be provided in supplementary privacy notices.

Do we need your consent?

We do not need your consent if we use special categories of your personal data in accordance with the provisions set out under law. However, in certain circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we require and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your contract with us that you agree to any request for consent from us.

Data about criminal convictions

We will collect information about criminal convictions where we are notified of this directly by you or we are notified of this by third parties. We will only use your personal data when the law permits us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to comply with a legal obligation.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

We will use information about criminal convictions and offences in the following ways:

• With your explicit written consent

• Where it is necessary to perform a contract with you or to take steps at your request prior to entering into a contract with you

• Where it is needed to obtain legal advice or for the purposes of or in connection with legal claims or legal proceedings (including prospective claims or proceedings)

We have in place appropriate safeguards which we are required by law to maintain when processing information about criminal convictions.

Automated decision-making

Examinations are marked by human markers who access exam scripts and mark the questions according to the marking standard specified by IOB. The online invigilation system will flag activities that could indicate suspected non-conformance with Examination Regulations. However, no automated decisions will be made based on these flags.

IOB uses Multiple Choice Questions (MCQs) for some assessments. These questions are marked using automated software against an answer key which is developed by the Examiner. The evaluation methods are regularly reviewed and tested to ensure they remain fair, effective and unbiased. As part of our Quality Assurance (QA), the questions are reviewed by an external examiner for accuracy and fairness. You may ask us not to make decisions about you that are based solely on automated processing.

We do not envisage that any decisions will be taken about you using automated means. However, we will notify you in writing if this position changes.

Data Sharing

Why might IOB share your personal data with third parties?

We will share your personal data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.

Which third-party service providers process my personal data?

“Third parties” includes third-party service providers (including contractors and designated agents). The following activities are carried out by third-party service providers: payroll and administration, hosting CRM systems, customer support and case management platforms, credit card and payment providers, providers of online registration and direct debit forms, media monitoring, printers, IT service and support providers, online assessment/exam and online invigilation, webcasting and video hosting providers, educational technology providers and cloud service providers.

Examples of service providers used by IOB include:

• Learning Management System providers

• Video learning and lecture recording platforms

• Online examination and invigilation providers

• Customer relationship management platforms

• Customer support and case management systems

• Cloud hosting providers

• Web conferencing platforms

• Finance and payment service providers

• Communications and marketing platforms

How secure is my data with third-party service providers?

All our third-party service providers are required to take appropriate security measures to protect your personal data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

When will you share my data with third parties?

We may share your personal data with:

• affiliate associations with whom IOB operate joint qualification schemes in order to support and administer such schemes or with whom IOB co-host events and seminars (such as the Chartered Accounts Ireland, Chartered Institute of Management Accountants, the Association of Chartered Certified Accountants, the Society of Trust and Estate Practitioners Ireland, the Institute of Management Consultants and Advisers and LIA)

• your employer, sponsor or membership body, where they pay or administer your membership, programme, examination, CPD scheme or designation fees, or where this is otherwise necessary to administer the relevant arrangement. This may include sharing registration status, attendance, assessment participation, assessment results, awards, CPD/designation status, engagement with IOB programmes, use of learning resources, viewing of online lectures or recorded learning content, and compliance with applicable programme, examination or CPD requirements. Such information may be shared with nominated HR, learning and development, regulatory, compliance or corporate portal contacts, where appropriate.

• Such information may also be shared for the purposes of confirming qualification status, programme participation, designation status, CPD compliance or other matters where the employer, sponsor, educational partner or professional standards body has a legitimate interest in receiving the information and sharing is permitted by law.

• third parties involved in hosting or organising an event such as hotels where you book beverages, food and/or accommodation for an event or conference through IOB, catering companies, hospitality staff at event location.

• other event attendees/delegates by way of an attendee/delegate list, seating plan or conferring booklets.

• personal data relating to suppliers may be shared with banks, payment service providers, auditors, legal advisers, taxation authorities and other professional advisers where necessary.

• our professional and legal advisors and other third parties in order to investigate complaints and disciplinary matters or to establish, exercise or defend our legal rights.

• Internal and external auditors

• third party companies that distribute our publications on our behalf.

In the case of students, we may also share certain personal data with your mentors, subject to obtaining your prior consent. We may also share your personal data with lecturers for the purposes of their confirming your attendance at our courses.

Where an individual participates in a professional designation, certification scheme or CPD programme administered jointly with another professional body, accreditation organisation or educational partner, IOB may share personal data relating to registration, designation status, qualification status, CPD compliance, assessment results, regulatory requirements, membership status and related administrative matters with that organisation where necessary to administer the relevant arrangement.

We may also need to share your personal data with a regulator, law enforcement authorities or to otherwise comply with the law.

Professional Bodies, Accreditation Organisations and Joint Controllers

IOB may share personal data with professional bodies, accreditation organisations, designation providers, educational partners and joint-controller organisations where necessary to administer qualifications, professional designations, CPD schemes, examinations, accreditations, regulatory obligations and associated governance activities.

Transferring Data outside the EEA (European Economic Area)

We may transfer your personal data outside the EEA. This may occur where we use service providers, educational technology providers, cloud platforms, professional advisers, educational partners, employers, sponsors, faculty members, corporate partners or other recipients located outside the EEA.

IOB delivers educational, membership, designation and professional development services both within and outside the EEA. In doing so, personal data may be shared with employers, sponsors, educational partners, learners, faculty members and service providers located outside the EEA.

These countries may include jurisdictions in the Middle East and Asia-Pacific regions where IOB delivers programmes or maintains educational, professional or employer relationships, including (from time to time) the United Arab Emirates, Qatar, Singapore, India and the Philippines.

If we do, we will only transfer your personal data outside the EEA if one of the following conditions applies:

1. The EU has issued regulations confirming that the country to which we transfer the personal data ensures an adequate level of protection for your rights and freedoms; or

2. Appropriate safeguards are in place such as binding corporate rules, standard contractual clauses, an approved code of conduct or a certification mechanism, a copy of which can be obtained from us; or

3. You have provided explicit consent to the proposed transfer after being informed of any potential risks; or

4. The transfer is necessary for one of the other reasons set out in the GDPR including the performance of a contract between us and you, for reasons of public interest, to establish, exercise or defend legal claims or to protect your vital interests where you are physically or legally incapable of giving consent and, in some limited cases, for our legitimate interest.

Should this arise, we will update this Notice and/or notify you.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data Retention

How long will we keep your personal data?

IOB retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, educational, accounting, audit, quality assurance and reporting requirements. Different categories of personal data are retained for different periods depending on the nature of the relationship with IOB and the purpose for which the data is processed.

As a provider of professional education, membership, examinations, designations and continuing professional development services, IOB may retain certain educational, assessment and qualification records for extended periods where necessary to:

• verify qualifications, awards, examination outcomes and academic standing;

• maintain the integrity of professional education records;

• respond to regulatory, accreditation and quality assurance requirements; and

• protect the interests of members, learners, employers and educational partners.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such data without further notice to you.

Typical Retention

Review and deletion

When personal data is no longer required, IOB will securely delete, anonymise or otherwise dispose of the data in accordance with its Records Retention Schedule, Records Management Policy and information security requirements.

Your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your working relationship with us.

Your personal information rights

When your personal information is handled by IOB in relation to a product or service, you are entitled to rely on a number of rights. These rights allow you to exercise control over the way in which your personal information is processed, subject to applicable exemptions.

For example, we may help you in:

Accessing your personal information: You can ask us for a copy of the personal information we hold about you.

Correcting and Updating your personal information: If you believe that any personal information we hold about you is inaccurate or out of date, you can look for the information to be corrected at any time.

Withdrawing consent: You can change your mind wherever you give us your consent, such as for direct marketing, or using your sensitive information, such as medical or biometric data.

Restricting our use of your personal information: You have the right to restrict our use of your personal information in certain circumstances, such as where our use of it is not compliant with applicable law.

Objecting to our use of your personal information: You have the right to object to us using your personal information, where we are doing so based on this being necessary for the performance of a task carried out in the public interest or for the purposes of a legitimate interest. Where you exercise this right to object, we will be obliged to stop using your personal information in that way, unless there are compelling legitimate grounds for us to continue to do so, despite your objection.

Not to be subject to automated decision making: You have a right (subject to limited exceptions) not to be subject to a decision based solely on automated processing of information, including profiling, which produced significant legal effects concerning you or otherwise significantly affects you.

Deleting your information (your right to be forgotten): You may ask us to delete your personal information.

Moving your information in electronic form (your right to Portability): You may request (in certain cases) that your personal information is transferred to you or another organisation in digital form.

How to Exercise your rights?

You may execute any of these rights by contacting us:

Phone: + 353 1 6116500

Email: [email protected]

When you exercise your data protection rights, make a complaint, or contact us about a data protection matter, we may ask you to identify yourself. This is to help protect your information. We will process the personal data you provide, together with relevant information we hold about you, for the purpose of assessing, managing, responding to and documenting your request, complaint or enquiry.

Once we are satisfied that we have effectively verified your identity, we will respond to the majority of requests without undue delay and within a one month period (i.e. 30 calendar days) of receipt of the request. IOB will action your request to have your personal information corrected within 10 calendar days. These periods may be extended in exceptional circumstances and we will inform you where the extended period applies to you along with an explanation of the reasons for the extension.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Right to withdraw consent

In circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact [email protected]. Once we have received notification that you have withdrawn your consent, we will no longer process your data for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Data Protection Policy

IOB, as a provider of Professional Education, CPD (Continuing Professional Development) and Membership Services to the financial services sector in Ireland and beyond, processes personal data for a variety of purposes relating to its members, employees, service providers and other third-parties involved with the organisation. IOB is therefore a data controller, and in some cases a data processor, and is subject to data protection legislation and regulation. IOB's Data Protection policy (available here) sets out data protection requirements which must be complied with by anyone who processes personal data for or on behalf of IOB.

Data Protection Officer

IOB’s Data Protection Officer oversees how we collect, use, share and protect your information to ensure your rights are fulfilled. You may contact our Data Protection Officer at [email protected] or by writing to: Data Protection Officer, IOB, 47-49 Pearse Street, Dublin 2

Making a complaint

If you have a complaint about the use of your personal information, please let a member of staff know, giving them the opportunity to correct things as quickly as possible. If you wish to make a complaint you may do so in writing and by email [email protected]. Please be assured that all complaints received will be fully investigated. We ask that you supply as much information as possible to help our staff resolve your complaint quickly.

You may also contact the Data Protection Commission in Ireland to lodge a complaint (details below).

Data Protection Commission,6 Pembroke Row, Dublin 2, D02 X963, Ireland Web: dataprotection.ie

Updates to this notice and policy

We keep this notice and policy under regular review and will make changes from time-to-time, particularly when we change how we use your information, and change our technology and products or services. We will inform you of material changes to the contents of this Data Protection Notice, through a notification posted on our website or through other communication channels.