What Is Personal Data? A Plain-English GDPR Guide for Irish Businesses Using AI

Personal data is any information relating to an identified or identifiable living person. The word doing the work is "identifiable": the law does not care whether you have identified someone, only whether someone reasonably could. The Irish Data Protection Commission puts it plainly: "any information about a living person, where that person either is identified or could be identified" (DPC).

Thursday, 4.15pm, a two-partner firm in Kilkenny. A trainee has a 30-page medical report in a personal-injury file and a client meeting at nine tomorrow. She pastes the conclusions into a chatbot on her phone and asks for a one-page summary. Sixty seconds later she has one, and it is good. She has also just handed a name, a date of birth, a GP's name, a diagnosis and a prognosis to a company in California. Nobody in the office thought of it as processing. It felt like reading.

What constitutes personal data: the four parts of the definition

Article 4(1) GDPR defines personal data as "any information relating to an identified or identifiable natural person". Each of those four phrases does work, and most confusion comes from skipping one of them.

"Relating to" is the part Ireland settled for the whole EU. In Nowak v Data Protection Commissioner (C-434/16, 20 December 2017), a trainee accountant who had failed a Chartered Accountants Ireland exam four times asked for his script. The institute refused on the basis that an exam answer is not personal data. The Court of Justice disagreed: information relates to a person if "by reason of its content, purpose or effect" it is linked to them, and the answers, the handwriting and the examiner's comments all qualified. One of the three is enough. The same reasoning covers interview notes, performance reviews and the comment your colleague wrote in the margin of a client's letter.

"Identifiable" got the same treatment in Breyer (C-582/14, 2016), where the Court held a dynamic IP address is personal data for a website operator because there is a legal route to matching it to a subscriber. The test in Recital 26 is "all the means reasonably likely to be used", weighing the cost, the time and the technology available. It does not require that anyone has actually bothered.

What is classed as personal data, and what is not

Two rows deserve a second look. The file number is the one firms get wrong most often: swapping a name for a reference is pseudonymisation, and the European Data Protection Board's Guidelines 01/2025 (adopted 16 January 2025) are explicit that the result is still personal data, because the key exists. And within personal data sits the smaller set that Article 9 calls special categories: data "revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership", plus genetic, biometric and health data and data about a person's sex life or orientation. A personal-injury file is health data on almost every page. An employment file usually has a union row in it. A family-law file has most of the list.

Pasting a client's details into a cloud AI tool is processing and disclosure: processing means "using personal data in any way", and disclosure counts (DPC). Then it depends on the login: a consumer account may keep and train on it, a business plan makes the provider your processor, and a machine in your own building sends nothing anywhere.

The Law Society has already written the rule

The Law Society of Ireland's guidelines on generative AI (November 2025) are blunter than most firms expect. "By default, free and paid consumer versions of GenAI systems are not suitable for securely handling personal data or client confidential data," because input "may be stored and re-used by the provider for training". Solicitors must "clearly differentiate between free, paid, and enterprise-grade versions", and must not enter client data into a GenAI system without safeguards, which the guidelines list as zero-retention contracts, data protection agreements, technical limits on sharing, or "locally-run or secured environment systems". That last phrase is the one this post is about.

The regulator is looking in the same direction. At the Law Society's data protection conference on 20 April 2026, the DPC's director of legal affairs said AI featured in 1 in 4 of its engagements last year, against 1 in 35 in 2021. The DPC's own guidance on large language models (18 July 2024) asks the question directly: "you should first understand what personal data it uses, how it uses it, where the personal data goes in situations where a third-party is involved in the processing, whether it is retained by the provider".

How much personal data is actually going in

More than the policy says. LayerX's Enterprise AI and SaaS Data Security Report (October 2025), built on browser telemetry rather than a survey, found that 77% of employees paste data into generative AI tools and that 82% of those pastes go through unmanaged personal accounts. Cyberhaven's 2026 AI Adoption and Risk Report puts sensitive content in 39.7% of all AI interactions. For a 6-person firm that is not a hypothetical; it is Thursday.

The middle row is a legitimate answer for many firms, and I have written about what the paperwork involves in What is a data processor under GDPR? But notice what it does not change: the data still leaves the building, still crosses a border, and still sits with a provider whose sub-processor list you have authorised in general terms. The bottom row changes the question rather than the answer. There is no third party to assess, because there is no third party.

Local AI is a dedicated machine installed at your premises, running open-weight models, with private chat, document search and custom assistants on it. The trainee's summary job runs exactly as before — paste the report, ask for a page — except the model reading it is in the back office, signed into with the firm's own Microsoft or Google account, and the report never leaves the building it was already in.

We launched the service this month, so I will not dress up a year of client results I do not have. What I can say first-hand is what the definition looks like from our side of the desk. Our own enquiry form asks for five things: business name, contact name, email, phone, and what you need. Four of the five are personal data on any reading, and the fifth usually is too, because people describe their own situation. Every business collects more personal data than it thinks, and the fix is not collecting less; it is being deliberate about where it goes.

What it looks like in a solicitor's practice

• Private chat for the summary, the first draft, the plain-English letter to a client — with the medical report, the contract or the affidavit uploaded to the machine and nowhere else.
• Document spaces for precedents, practice notes and the firm's own procedures, searchable and summarised with citations back to the page.
• Custom assistants for the jobs that repeat: the section 68 letter, the client-care checklist, the monthly undertakings review.
• Your existing access control — single sign-on with Microsoft 365 or Google Workspace, so who can see which file is the decision you have already made.

What it does to the definition, precisely

Nothing. The report is still personal data, most of it special category, and you are still the controller with the Law Society's ten-step practice note to follow: know what you hold, map where it goes, keep it no longer than necessary. What changes is the map. The AI step no longer appears on it as an arrow leaving the office, so there is no processor to appoint for it, no transfer to justify, and the retention that applies to the AI's copies is the one you already run for the file. To be exact about our role: AgentHub acts as a processor only for any support access you grant us, under a data processing agreement scoped to that and nothing wider.

And where the cloud is the better tool, we say so. If the job is triaging the inbox or drafting routine replies, our cloud Email Manager is quicker to set up, and it comes with a processor agreement because that is what it is; our privacy policy sets out how we handle data on that side. Local AI earns its place on the files that should never have gone near a consumer chatbot: the medical reports, the family-law affidavits, the employment disputes.

What is personal data?

Personal data is any information about a living person who is identified or could be identified from it, directly or indirectly. A name, an email address, a phone number, a client reference, a photo, a medical note or an opinion about someone all count. If a person can reasonably be worked out from the information, it is personal data.

What constitutes personal data under GDPR?

Article 4(1) GDPR has four parts: any information, relating to, an identified or identifiable, natural person. Information counts if it is linked to a person by its content, its purpose or its effect on them. Facts, opinions, images and recordings all qualify, and only living people are covered.

Is an email address personal data?

Usually, yes. An address like name.surname@firm.ie identifies a person and is personal data. A generic address such as info@firm.ie is not, because it identifies an organisation rather than an individual. The European Commission uses exactly this pair as its worked example.

What is not classed as personal data under GDPR?

Information about companies rather than people, a company registration number, a generic info@ mailbox, information about someone who has died, and data that has been irreversibly anonymised. Pseudonymised data, where a name is swapped for a reference but a key exists, is still personal data.

Is a CV personal data?

Yes. A CV names the person and describes their education, employment history and often their date of birth or nationality, so it is personal data throughout. Interview notes and scoring sheets are personal data too, because they record an opinion about an identified person, on the same reasoning the Court of Justice applied to exam scripts.

Is pseudonymised data still personal data?

Yes. Recital 26 GDPR says pseudonymised data that could be attributed to a person using additional information is information on an identifiable person, and the European Data Protection Board's Guidelines 01/2025 confirm it. Swapping a client's name for a file number reduces risk but does not take the data outside GDPR.

Does pasting personal data into ChatGPT count as processing?

Yes. Processing means using personal data in any way, including disclosing it to a third party, and pasting a client's details into a cloud AI tool discloses them to the tool's provider. On consumer tiers the provider may retain and train on that input. Running the model on your own premises keeps the same task inside your systems.

What to do this week

Take one live file and run the four-part test on it, page by page, with the yes/no table beside you. Most people stop counting somewhere in the first section. Then ask the team, without a disciplinary tone, which AI tools they use and on which login; the answer is the baseline, not the offence. If the honest answer is "personal accounts, for the long documents", that is the job to move first.

Back in Kilkenny, the trainee still gets her one-page summary at 4.16pm. The report never left the office to make it, the chatbot on her phone has one less thing in it, and the client meeting at nine goes exactly as it would have. The only difference is one nobody in the room can see, which is rather the point.

If you would like a second opinion on what your files actually contain, book a Local AI consultation — I read every enquiry myself — or open the chat on this page and ask it what it does with what you type. It is a cloud agent, and it will tell you.