Ireland Guidelines for the Responsible Use of AI in the Public Service (2025) 4.3b: Settle the legal basis for personal data processing, consulting the Data Protection Commission where required

What does 4.3b require?

The legal basis for processing follows the risk identified in the Data Protection Impact Assessment: consent may serve low-risk uses such as a chatbot built with privacy-by-design limits on what it processes, while high-risk processing such as large-scale profiling for a public-interest task may need a specific mandate in primary legislation or regulations. Processing that requires legislative change triggers mandatory consultation with the Data Protection Commission and its legislative consultation form, and processing of special categories of data calls for extra precautions and early contact with the Commission.