Is a PPSN personal data? What to take out before you use AI

A PPS number looks like the dullest thing on a payslip: seven digits and a letter, printed in the corner. It is also the one identifier in an Irish file with its own criminal offence attached, which most people only find out when someone asks for it who shouldn’t.

That matters the moment a document goes into an AI tool. The number joins the name and the address, and the questions on whether a detail is special category data come later. First comes a simpler one: who is allowed to have this number at all.

Redact a PPS number in seconds →

Is a PPS number personal data? Yes, and Article 87 lets Ireland add rules

Article 4(1) of the GDPR defines personal data by reference to identifiers, and the second example it gives is “an identification number”. A PPSN is allocated to one person for life. There is no reading of that definition under which it escapes.

The GDPR then steps back. Article 87 lets each member state set its own conditions for a national identification number, provided it is used only under appropriate safeguards. Ireland had those conditions long before 2018, in the social welfare code, and they still sit on top of the Regulation.

If an office manager remembers one row, I want it to be the third. It comes from social welfare law rather than data protection law, so GDPR training tends to skip it. The last row has its own page, on pseudonymised data and the firm that can reverse it.

PPS number format: seven digits, a check letter and sometimes a second letter

Citizens Information puts it in one line: a PPS number is always seven numbers followed by one or two letters. The first letter is not random. It is a check character calculated from the digits, so a mistyped number usually fails the sum and gives itself away.

Some numbers stop after the check letter; others carry a second one. A W in that second place is a relic: before 2000, some married women were given their husband’s number with a W added, and the Department says none have been issued since 1999. Those numbers are being phased out.

Where it is printed matters more than how it is built. It sits on the front of the Public Services Card and on Revenue letters. In an office it lives in payroll exports, HR files and, in GP practices, referral letters. I assume any letter from a public body has one.

Who can ask for your PPS number in Ireland

The Department is blunt about it: only bodies specified in legislation, and their agents, can use the number. Those are the specified bodies, listed in Schedule 5 of the 2005 Act. They include Revenue, the HSE, listed voluntary hospitals, councils, ETBs, the Courts Service and the RTB, still listed under its old name.

Private businesses mostly hold PPS numbers through a door the Act leaves open: a transaction with a specified body where the number is relevant. Payroll is the classic case, since Revenue uses it.

That door is narrow. An employer may ask on your first day, not at interview, and a job application form or recruitment agency asking up front has no better claim.

Is it safe to give out your PPS number?

To anyone on that list, for the reason they give, yes. Elsewhere the risk depends on what travels with it. Seven digits and a letter say little alone; beside your name, date of birth and address, they are what public bodies use to match your records to you.

Unlike a password, it can’t be reset. Ireland’s note to the OECD on tax numbers says a PPS number, once issued, is never changed. A number that leaks stays out there for life, so a photo of your card needs the care you would give a passport copy.

When a request doesn’t sit right, ring Client Identity Services in Carrick-on-Shannon, which Citizens Information names for exactly that question. The Department’s Register of Users also shows why many public bodies ask. I’d rather make that call than guess.

Section 262(9): when using someone’s PPSN is an offence

The subsection names who may use a PPS number or seek its disclosure: the holder, a parent or guardian of a child holder, someone appointed to act for the holder, a specified body, a person in a relevant transaction with one, and anyone bound by sections 260, 261 or 261A. Anyone else commits an offence.

Sections 262 and 263 carry no penalty of their own, so section 257’s general one applies: up to €13,000 or three years on indictment. On summary conviction it is six months, or a fine the Act still prints as €1,500, now a class C fine of up to €2,500 under the Fines Act 2010.

That is how I read the sections together, and in a real dispute I would want a solicitor to confirm it before relying on it.

The carve-outs are worth reading closely, because none of them is general. The health one says a person using the number “in accordance with this Act” commits no offence. A GP practice now records every patient’s PPSN, and what that means for clinical letters is the job of a separate guide.

The Public Services Card and the DPC’s findings

Section 263 sets out what the card shows. On its face: name, PPSN, photograph, signature, issue number and expiry date. In the chip, readable electronically, the same items plus date of birth, place of birth, sex, nationality and former surnames, your own and your mother’s.

Even a photo of the front puts a face, a signature and the PPSN in one image, and I can’t think of a private business that needs all three.

The same section copies the rule for the number. Under section 263(4), anyone other than the holder, a specified body or a person in a relevant transaction who seeks to have the card produced commits an offence. A business that wants photo ID has other documents to ask for, listed further down.

If a body other than the Department says the card is the only way, ask which law says so. I’d never send a photo of the card outside that list, least of all a chatbot, where an uploaded image can outlive the conversation.

Can you paste a PPS number into an AI chatbot?

No Irish court has decided whether typing a number into a prompt is “use” within section 262(9). But the provider is not a specified body, has no transaction with the person, and appears in none of the carve-outs. Whatever entitlement you had to the number stayed with you when you pressed enter.

Holding data for a client brings in a second statute. Section 144 of the Data Protection Act 2018 makes it an offence for a processor to disclose data, knowingly or recklessly, without the controller’s prior authority: up to €50,000 or five years on indictment. A payroll bureau pasting a client’s staff list worries me most.

That mistyped number is the trap. A format check skips it, yet it sits beside a name, and one corrected letter gives back the original. When in doubt, the whole field goes. Whether a paste like this must be reported is in our guide on client data in a chatbot as a breach.

None of those policies makes a pasted PPSN lawful in Ireland. They only tell you how long it stays. For a client who wants AI used on their files, the authority belongs in writing, and an AI clause in the letter of engagement is where I’d put it.

Finding and removing a PPSN in payslips, PDFs and spreadsheets

The number rarely sits alone in a neat field. It hides under a black box in a PDF’s text layer, in a Word comment, in a hidden column or in a scanned form’s file name. Each format needs its own method, and the identifiers that travel with it are more than most expect.

Replace it with a label rather than deleting it. A question about a payslip still reads properly when the model sees that a PPSN was there, and the label tells your colleague later what was removed.

The second line answers the payroll question just as well. To my mind, nothing in a prompt gets better because the model can see the seven digits, which makes the PPSN the cheapest identifier in the file to remove.

Is a file with the PPSN removed still personal data?

Usually, yes. The DPC’s guidance on anonymisation says that where the original data is not deleted, the result is in most cases pseudonymised and still personal data. You kept the payslip. So the version with labels is a safer copy of personal data, not something outside the law.

None of that makes me skip the step. Pseudonymisation is a safeguard the GDPR names, and it cuts what a recipient can do with the text. The vocabulary trips people up, and deidentified versus anonymised sorts the three words out.

After the number, the Eircode is the detail I’d watch. Over 35% of Irish addresses are shared with at least one other property, so every address got its own code, and one left in a letter points to a single letterbox.

An employer and a start date can do the rest. If your office pastes documents often, a written rule on what goes in belongs in an AI policy for staff.

Before the number leaves your desk

The PPSN is the easiest call in the file: an Irish statute older than the GDPR already fences it in, and no AI tool needs it to answer a question. If one identifier always comes out, it’s this one. This page is a general reading of the 2005 Act, not advice on a particular request.

Insurers now ask about AI on proposal forms, and the AI questions on those forms are easier to answer when this step is routine.

The cover itself is another matter, and what a cyber policy in Ireland pays for is worth reading before an incident.

The AI Act adds duties of its own for firms using these tools, set out in the EU AI Act guide for Irish businesses. They sit beside the 2005 Act rather than replacing it.

Nonimo does the label step on your own machine. It swaps the PPS number, and the name and Eircode beside it, for labels before you send, marks every change so you can undo it, and puts your details back when you copy the answer. Your text never reaches us, as our security page explains.

If payroll notes and tenancy files cross your desk every week, Nonimo for Ireland is built for exactly that paste.

Sources

• GDPR, Articles 4(1) and 87. An identification number as an identifier; member states may set conditions for a national identification number. eur-lex.europa.eu
• Social Welfare Consolidation Act 2005, section 262 (revised). Allocation, the offence in subsection (9) and its carve-outs; Schedule 5 and the section 257 penalty, with its Fines Act 2010 note, read in the same revised Act. revisedacts.lawreform.ie
• Social Welfare Consolidation Act 2005, section 263 (revised). What the Public Services Card shows and holds, and the offence in subsection (4). revisedacts.lawreform.ie
• Health Information Act 2026, section 12. Duty to record the PPSN; no refusal of care; subsection (6). Commenced 17 August 2026 by S.I. No. 360 of 2026. irishstatutebook.ie
• Data Protection Act 2018, section 144. Disclosure by a processor without authority, and its penalties. irishstatutebook.ie
• Department of Social Protection, Who can use my PPS Number. Only specified bodies and their agents; the Register of Users and why bodies ask. gov.ie
• Department of Social Protection, Phasing out of W numbers. Not issued since 1999. gov.ie
• Directive (EU) 2021/514 (DAC7). Platforms collect a seller’s tax number; sellers under 30 sales and €2,000 excluded; applies from 1 January 2023. eur-lex.europa.eu
• OECD, Ireland: information on tax identification numbers. The PPS number identifies individual taxpayers and is never changed once issued. oecd.org
• Eircode, What is Eircode. A unique code for each address; over 35% of addresses shared with another property. eircode.ie
• Citizens Information, Personal Public Service (PPS) number. Seven numbers and one or two letters; where it is printed; employers not to ask when recruiting; Client Identity Services. citizensinformation.ie
• Residential Tenancies Board, how to register a tenancy. Tenant’s PPSN optional but highly recommended. rtb.ie
• Data Protection Commission, statement on the Public Services Card, 16 August 2019. The findings on legal basis and retention; the 10 December 2021 resolution is on the same site. dataprotection.ie
• Data Protection Commission, inquiry concerning the Department of Social Protection, decision of 9 June 2025. SAFE 2 biometrics, €550,000 in fines, the nine-month order. dataprotection.ie

Checked on 7 November 2026.