The Office of the Data Protection Commissioner has written to three Vocational Education Committees outlining concerns over information being sought from parents applying to new primary schools being run by them.
Admission forms for the five schools request information on religious affiliation and the form states that this information may be shared with other local primary schools, which the Commissioner's office has taken issue with.
The concerns raised relate to five schools, two existing and three due to open in September, run by the Co Dublin, Co Kildare and Co Meath VECs.
In the letter to the VECs, the Commissioner's office says religious affiliation is sensitive information with special protections under legislation.
It says parents need to be told exactly who will have access to this information and for what purpose and it says explicit consent has to be sought.
Co Meath's VEC told RTÉ News the wording was a mistake.
It says it was never its intention to share this information with other schools.
The Department of Education and many schools could be in breach of Data Protection legislation in the way they are gathering and processing sensitive personal information related to pupils.
The Commissioner's office says schools are gathering Personal Public Service numbers and other sensitive personal information from pupils on behalf of the Department, but many parents are unaware that the information is being passed on and the extent to which it may be used in the future.
The Office said it has been in ongoing communication with the Department of Education for two years now on this issue.
In recent years the Department of Education has been requesting, and in some cases requiring, primary- and second-level schools to gather and pass on private information related to pupils, such as their PPS number, medical card status, and membership of the Travelling Community.
The Commissioner says any personal data collected in this way and processed by the Department is being processed unlawfully under the Data Protection Acts.
In a statement, the Department of Education has said any issue brought to its attention by the Data Protection Commissioner is taken seriously and the Department has worked and continues to work with the Commissioner's office to proof its data processes against the requirements of the legislation.
The Department said that in discussions with the Office earlier this year it confirmed that it will arrange for acquiring the explicit consent of parents in relation to the collection of such sensitive personal data.
The Department said it is also preparing a notice for parents so they are fully aware of the data that is being collected and the purposes for which it will be used.