Privacy notice for NDSWeb

The HPRA operates a secure online licence application system for controlled drugs known as NDSWeb. NDSWeb allows users to apply for import and export licences online. The HPRA manages the application and issue process for controlled drug licences on behalf of the Department of Health.

What information do we process?

Your professional contact information (name, email address, job title and company name and address) is collected by the HPRA when you register to use NDSWeb. This personal data will only be used by the HPRA in relation to your NDSWeb registration and on-going use of the system. 

Legal basis for processing

The legal basis for processing personal data for registration in NDSWeb is Article 6(1)(f) of the General Data Protection Regulation (GDPR), which states:

processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

How is your information processed and shared?

Your data may be shared with the Department of Health. 

The HPRA uses third party service providers and suppliers (also known as data processors) to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

Personal data collected in NDSWeb is not transferred to third countries by the HPRA. 

The data is retained indefinitely. Your NDSWeb registration and access will be terminated on request. 

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.  

What are your rights under data protection law?

Data protection law provides you with the following rights regarding the processing of your personal data:

  • The right to request access to your data
  • The right to request your data be rectified or erased if it is inaccurate
  • The right to request processing of your data be restricted
  • The right to object to the processing of your data
  • The right to lodge a complaint to the Data Protection Commission

How to contact us

The data controller for this activity is the HPRA and the data protection officer can be contacted at the details provided below.

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query.

Further information regarding data protection at the HPRA can be found in our main privacy notice.