Local authority compliance

Two quick questions so we only show what's relevant to your organisation. These aren't scored.

1. Is your organisation a county, city or city and county council?
2. Does your organisation operate CCTV, mobile cameras or other recording devices in public places, including for litter, dumping or traffic enforcement, or a community CCTV scheme?

FOI, environmental information and data protection access rights all run side by side.

1. Is your FOI publication scheme published, complete and reviewed in the last year? FOI officer
2. In the last 12 months, how often were FOI decisions issued within four weeks? FOI officer
3. Are requests for environmental information recognised and handled under the AIE Regulations, within one month, with the right to appeal to the Commissioner for Environmental Information explained? FOI officer
4. In the last 12 months, how often were data protection access requests answered within one month (or a valid extension)? Data Protection Officer
5. Is there an approved records retention schedule covering electronic and paper records, and is it applied? Records manager

From the help text

Section 8 of the Freedom of Information Act 2014 requires proactive publication in line with the model scheme. 'Yes' means a current scheme with working links.

Councils hold some of the most widely used public datasets. These questions apply because you're a council.

Asked only if you answer “Yes” to: Is your organisation a county, city or city and county council?

1. Is access to the register of electors and the edited register controlled so the full register is supplied only for the purposes the electoral law allows? Franchise section
2. Before planning applications and submissions are published online, are personal details that aren't needed for public participation redacted (for example signatures, phone numbers, email addresses and any health or other sensitive information)? Planning section
3. Is access to housing applications, medical priority information and tenancy files limited to the staff who need it, and audited? Housing section
4. Are annual declarations of interests collected from councillors and relevant staff under Part 15 of the Local Government Act 2001, and is the register kept up to date? Ethics registrar

From the help text

Electoral law limits who can receive the full register and for what. The edited register is the version that can be used for other purposes, and people can opt out of it. 'Yes' means a written procedure for every request and a log of supplies.

Recording people in public places needs a clear legal basis and strong safeguards. These questions apply because you use cameras.

Asked only if you answer “Yes” to: Does your organisation operate CCTV, mobile cameras or other recording devices in public places, including for litter, dumping or traffic enforcement, or a community CCTV scheme?

1. For each camera system, have you recorded the specific legal basis, such as Garda Commissioner authorisation for a community CCTV scheme or the statutory powers and approved codes of practice for litter and dumping enforcement? Data Protection Officer
2. Has a DPIA been completed for each camera system, including mobile and body-worn cameras? Data Protection Officer
3. Are there clear signs where cameras operate, and is footage kept only for a short, fixed period unless needed for an investigation? Environment section
4. Is access to footage limited to named people, with every viewing and disclosure (including to An Garda Síochána) logged? Environment section

From the help text

The DPC has found councils operating cameras without a clear legal basis. Community CCTV schemes need Garda authorisation under the Garda Síochána Act 2005 and the Garda Síochána (Recording Devices) Act 2023, and waste and litter enforcement cameras rely on powers that require approved codes of practice. 'Yes' means a register of systems with the basis for each.

Most services rely on suppliers and other public bodies. Integrity duties keep public trust.

1. Do contracts with suppliers who process personal data include Article 28 terms, and do tenders include data protection and security requirements? Procurement lead
2. Is every data sharing arrangement with other public bodies covered either by a data sharing agreement under the Data Sharing and Governance Act 2019 or by a recorded statutory basis? Data Protection Officer
3. Are internal reporting channels in place under the Protected Disclosures Act 2014 (as amended in 2022), with acknowledgements within seven days, feedback within three months and an annual report published? Chief Executive or Secretary General
4. Is the list of designated public officials published under section 6(4) of the Regulation of Lobbying Act 2015? Corporate services
5. Are annual statements of interests collected from people in designated positions under the Ethics in Public Office Acts, where those Acts apply to you? Corporate services

From the help text

'Yes' means standard clauses in tender templates, signed processing terms with every processor and a supplier register.

Councils and departments are frequent targets. These questions check the basics and your NIS2 position.

1. What is your position under the NIS2 law? Head of IT
2. Does your incident procedure cover early warning to the NCSC within 24 hours of a significant cyber incident, and notification to the DPC within 72 hours where personal data is affected? Head of IT
3. Is there a personal data breach procedure in use, with a breach register that records every breach and the decision on notification? Knock-out Data Protection Officer
4. Is two-step login enforced for all remote access, email and administrator accounts? Head of IT
5. When did you last test restoring a critical service from backup? Head of IT
6. I confirm these answers reflect the organisation's current position and have been reviewed by the DPO, FOI officer and Head of IT. Chief Executive or Secretary General

From the help text

NIS2 brings public administration entities into scope as essential or important entities. Ireland's transposing legislation (the National Cyber Security Bill) sets the detail; the NCSC is the competent authority. If you're unsure, start with the NCSC's NIS2 pages.