The lawful basis to seek a Personal Public Service Number (PPSN) is provided for under Article 6(1)(c) and (e) of the General Data Protection Regulation (GDPR) where legislation has been enacted under Regulations under S.I. No. 136 of 2008 entitled Return of Payments (Banks, Building Societies, Credit Unions and Savings Banks) Regulations 2008.

These Regulations require financial institutions to make a return to the Revenue Commissioners on interest paid on savings accounts for Deposit Interest Retention Tax (DIRT) purposes. This regulation provides a legislative basis for collecting a Tax Identifier Number (TIN) or PPSN by specified persons or financial institutions under section 891B of the Taxes Consolidation Act 1997 when opening a new customer account. A financial institution must make every reasonable effort to collect the PPSN prior to opening a new account.

Regulation 7 (8) of the S.I. sets out, in line with the principle of purpose limitation, that any collection of PPSN data by financial institutions must be used solely for the purpose of the Revenue returns, and any further use is likely to be unlawful processing of personal data.