DPIAs for AI Tools: When Irish Employers Need One

Before an employer rolls out an AI tool that touches personal data, the question that comes up is whether a data protection impact assessment is needed. This guide looks at a DPIA for AI tools from an Irish employer's point of view, using what the Data Protection Commission (DPC) says on its own pages. The short answer from the DPC's material is that a DPIA is required where processing is likely to result in a high risk to individuals, and that new technology can trigger one. Whether a given tool crosses that line depends on how you use it. For the DPC's wider position on large language models, see our guide to DPC guidance on AI and large language models for employers.

When the DPC says a DPIA is required

The DPC's page on Data Protection Impact Assessments says a DPIA is mandatory where processing "is likely to result in a high risk to the rights and freedoms of natural persons". It gives examples such as large-scale processing of special category data and systematic monitoring of publicly accessible areas, and it cites ten criteria from the Article 29 Working Party. Its rule of thumb is that processing meeting at least two of the criteria will require a DPIA.

The page does not show a last-updated date. It also does not mention artificial intelligence by name, though it discusses automated decision-making and profiling. One criterion it lists is "innovative use or applying technological or organisational solutions", and the page says that using a new technology "can trigger the need to carry out a DPIA".

The DPC's list of processing operations

The DPC also published a list of types of processing operations that require a DPIA, in a document dated 15 November 2018 (revised). It says a DPIA is required where an organisation:

• uses systematic and extensive profiling with significant effects;
• processes special category or criminal offence data on a large scale; or
• systematically monitors publicly accessible places on a large scale.

It then lists further operations that require a DPIA where a documented screening or preliminary risk assessment indicates a likely high risk. Several are relevant to AI tools:

• using profiling or algorithmic means, or special category data, to decide access to services, or where the outcome has legal or similarly significant effects;
• systematically monitoring, tracking or observing individuals' location or behaviour;
• profiling individuals on a large scale;
• processing biometric data to uniquely identify or authenticate individuals, combined with other criteria;
• combining or cross-referencing separate datasets where this significantly supports profiling or behavioural analysis; and
• using personal data on a large scale for a purpose other than the one for which it was first collected.

The document says the list is not exhaustive and that a DPIA is good practice for any major new project involving personal data. The list pre-dates today's generative AI tools, so it does not mention them. Reading how its categories apply to a tool is a judgement for the controller.

What the DPC says about AI tools specifically

The DPC blog "AI, Large Language Models and Data Protection" (18 July 2024) is the closest DPC statement we read to the question. According to the blog:

• If your organisation is a controller using an AI product that processes personal data, a formal risk assessment should be considered.
• Before adopting a system, identify what personal data it uses, how it uses it, and where the data goes when a third party is involved. Check whether the provider retains or reuses the data.
• Risks to an organisation using AI systems include unplanned or unnecessary processing (including through staff inputs), insecure handling of data sent to a third-party tool, models reproducing training data, and inaccurate or biased outputs relied on without human review. The blog also says that without a retention schedule an organisation risks breaching the storage limitation principle.
• The DPIA bullet, which sits in the section for AI product designers, developers and providers, says a DPIA may be needed, particularly where the technology is new to you, where you combine datasets, or where you process data about minors or vulnerable people, and may be good practice even where not strictly required.

The blog's DPIA guidance is aimed mainly at AI product designers and providers, and it does not state outright that every organisation deploying a third-party AI tool must complete a DPIA. That is why it is sensible to carry out and record a screening of each tool rather than assume either way.

Common employer scenarios: our reading

This section is our reading of how the DPC material may apply. It is not legal advice and not a DPC statement.

• Staff pasting text into a general chatbot. Our reading: the DPC blog's risks of unplanned processing through staff inputs and third-party handling are most relevant. A policy and a risk assessment are likely to matter more here than a full DPIA unless sensitive or large-scale data is involved.
• AI used to rank, score or monitor staff. Our reading: the DPC list items on profiling, algorithmic decisions with significant effects and systematic monitoring of behaviour are close to this scenario, so a DPIA is likely to be needed.
• AI analysing special category data. Our reading: large-scale processing of special category data is on the DPC's first list, so screening should start from the assumption that a DPIA is needed.
• A new tool that combines existing datasets. Our reading: the DPC list includes combining or cross-referencing datasets where it supports profiling, so check this criterion.

What a DPIA must contain

The DPC page cites the GDPR's minimum features: a description of the processing and its purposes, an assessment of necessity and proportionality, an assessment of risks to individuals, and the measures to address those risks and demonstrate compliance. There is no requirement for a formal final report, but the DPC recommends one as good practice. Where a DPO has been designated, the controller must seek the DPO's advice and document it, and the views of data subjects should be sought where appropriate, with the justification documented if they are not.

If identified risks are mitigated, the controller does not need to consult the DPC. If residual risk stays high, the page says "you must consult with the Data Protection Commissioner before moving forward with the project". Publishing the DPIA is not legally mandatory, though the DPC recommends it for transparency. The page also says that, as good practice, all DPIAs should be re-assessed after three years, or sooner if circumstances have changed quickly.

How a DPIA fits with other AI documentation

A DPIA is one record among several. The AI Act has its own assessment for certain deployers, covered in our guide to the fundamental rights impact assessment under Article 27, and your Article 30 records of processing should show the processing activity the tool introduces; see our guide to records of processing under Article 30.

A practical approach for Dublin employers

• A practical approach: keep a short register of AI tools and, for each, a one-page screening that records what personal data goes in, who the provider is, whether data is retained or reused, and which DPC criteria might apply.
• A practical approach: run the screening before rollout, not after, and involve your DPO if you have one.
• A practical approach: record why you decided a DPIA was or was not needed, so the reasoning can be shown later.
• A practical approach: review the screening when the tool's features, provider terms or your use change.

The DPC's AI Insights Report, published on 24 September 2026, covers the DPC's supervision work between 2021 and 2025 and concludes that early regulatory engagement is the most effective path. The page we read does not mention DPIAs, so we cannot say what the full report says about them.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Do we always need a DPIA to use an AI tool?

Not according to the DPC pages we read. A DPIA is mandatory where processing is likely to result in a high risk to individuals, and the DPC says new technology can trigger one. A tool used without personal data may not need one. Screen each tool and record the decision.

Does the DPC list name AI?

The 2018 list and the DPIA page do not mention AI by name. They cover profiling, algorithmic decision-making, monitoring and large-scale processing, which can apply to AI tools.

Who is responsible for the DPIA, the employer or the AI provider?

The DPC page speaks of the controller. An employer deciding to use a tool on personal data is typically the controller for that use, but the DPC blog directs its DPIA advice mainly to providers, so both may have a role. Check your own position.

What happens if a DPIA shows high residual risk?

The DPC page says you must consult the Data Protection Commission before moving forward with the project.

Where can I find the current DPC guidance?

On dataprotection.ie. Some of the pages we read carry no update date and others are several years old, so check for updates.

A short, written screening before rollout is a modest effort compared with unpicking a tool that was adopted without one.