Policy Notice

Privacy Notice – CESP

CESP is the Common European Submission Portal for making applications to European regulatory authorities and agencies with statutory responsibility for the licensing of healthcare products and activities. CESP is operated by the Health Products Regulatory Authority (HPRA). The HPRA is the sole data controller in respect of registration personal data in CESP. Information about the HPRA is available on the HPRA website:  https://www.hpra.ie/.

The data protection officer can be contacted at dataprotectionofficer@hpra.ie.

What information do we process?

Personal data is collected by the HPRA when you register to use CESP or when a super-user administrator from your organisation adds you as a user to CESP. The personal data that the HPRA collects about you will only be used in relation to your CESP registration and on-going use of CESP. The personal data is limited to your professional contact details.

How is your information processed and shared?

The CESP system allows the exchange of applications simultaneously to multiple regulatory authorities and agencies, who are independent data controllers. Personal data provided upon registration to CESP forms part of the information provided to a regulatory authority you make applications to via CESP.  To use the CESP system, you must consent to the processing of your personal data by the HPRA.

The legal basis for processing CESP registration personal data in CESP is Article 6(1)(a) of the General Data Protection Regulation (GDPR), which states:

The data subject has given consent to the processing of his or her personal data for one or more specific purposes

Personal data collected in CESP is not transferred by the HPRA to third countries. The data is retained unless you request that your personal data be deleted. Your CESP registration and access will be terminated on receipt of such a request.

If you submit an application to United Kingdom regulatory authorities, your personal data will be made available to the United Kingdom regulatory authorities as part of that application process.

What are your rights under data protection law?

You have the following rights regarding the processing of your personal data:

• the right to request access to your data
• the right to request your data be rectified or erased
• the right to object to processing or request processing of your data be restricted
• the right to data portability
• the right to lodge a complaint to the Data Protection Commissioner

Further information

Further details on data protection at the HPRA can be found here.

You can withdraw your consent to the processing of your personal data by the HPRA at any time via the ‘My Account Section’ in the ‘Delete account’ tab.

To make a request regarding your personal data under the GDPR, please submit your request in writing or via email:

Data Protection Officer
Health Products Regulatory Authority 
Kevin O’Malley House, 
Earlsfort Centre
Earlsfort Terrace
Dublin 2
Tel: +353 (1) 6764971
Fax: +353 (1) 6767836

Email: dataprotectionofficer@hpra.ie

Please ensure that you describe the records you seek in the greatest detail possible to enable us to identify the relevant records. The HPRA must confirm within one month if data is held and if so, the description of the data and the purposes for which they are kept. The Irish supervisory authority for data protection is the Data Protection Commission. They may be contacted here. Details of your entitlement to complain to the Data Protection Commissioner will be included in the decision letter or email.