IrelandDPC Guidance: AI, Large Language Models and Data Protection
Data Protection Commission, "AI, Large Language Models and Data Protection" guidance (18 July 2024)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 18 July 2024.
A comprehensive regime rule binding public and private bodies.
As of 24 August 2026.
What it requires
- Establish a lawful basis before collecting or otherwise using personal data, including publicly accessible personal data, to train an AI model on people in Ireland, and account for the purpose the person originally made that data public for, not only whether it was public.
- Perform a data protection impact assessment before training or deploying an AI system on personal data of people in Ireland where the processing is new to you, combines data sets, or may involve minors or vulnerable people.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Who enforces it
Enforcement body
Data Protection Commission (An Coimisiún um Chosaint Sonraí), Ireland's supervisory authority under the GDPR and the Data Protection Act 2018.
What it reaches
Obligation class
Disclosure, Governance, DPIA
Who checks it
Audit expectation
none
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
The DPC's July 2024 guidance applies Ireland's existing General Data Protection Regulation (GDPR) and Data Protection Act 2018 duties, lawful basis before collecting personal data for AI training, data minimization, honoring access, rectification and erasure requests where feasible against a trained model, and data protection impact assessments for higher-risk processing, to the specific context of building and operating Large Language Models and other AI systems.
The guidance states directly that publicly accessible personal data still falls within the scope of the GDPR, and that a controller assessing necessity and proportionality for AI training must account for the purposes for which people made their personal data publicly accessible in the first place, not only for the fact of public accessibility.
This interprets Ireland's existing personal-data duties in an AI training context; it does not itself create a duty that attaches because a system is an AI system. The guidance does not itself distinguish a public-sector from a private-sector controller, but GDPR Article 4(7) defines a controller to include a public authority or body on the same footing as a natural or legal person, so the duties it applies to AI training bind either kind alike.
The DPC has since opened a formal inquiry into X Internet Unlimited Company's processing of EU/EEA users' publicly-accessible posts to train the Grok large language models (LLMs). It also engaged with Meta over its plans to train a generative AI model on public Facebook and Instagram content, leading Meta to pause and later revise the rollout.
And it has stated of LinkedIn's AI training that it has not approved or found compliant LinkedIn's use of members' personal data for that purpose, though LinkedIn's added measures have addressed its concerns enough that no further regulatory intervention is planned for now.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
Read the law
Data Protection Commission guidance page, dataprotection.ie
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.