Why it makes sense to combine AI Literacy and GDPR awareness training

Speaking on a panel discussion at the IAPP AI Governance Global Europe 2025 conference, Irish data protection commissioner, Dale Sunderland, suggested that data protection professionals may find that they can leverage existing knowledge and frameworks under the EU General Data Protection Regulation (GDPR) to meet the AI literacy requirements under the Artificial Intelligence Act (AI Act).

Commissioner Sunderland noted that the AI Act mandates organisations ensure staff who use AI have a sufficient understanding of its functioning and how to prevent potential harms. As such, Sunderland pointed out that this obligation shares similarities with the GDPR Article 39 requirements for Data Protection Officers (DPOs) to raise awareness and train staff on best practices. Sunderland argued that the GDPR's focus on establishing a baseline understanding at an organisational level as a safeguard can be applied to AI knowledge and literacy. While acknowledging the differences in context and the increased complexity of AI technology compared to the technologies covered under GDPR, he emphasised that the core foundational principles are essentially the same.

Given the parallels between the GDPR and AI Act, Sunderland said that it would be illogical for organisations and regulators to treat them as separate issues.