South KoreaPersonal Information Protection Act, rights regarding automated decisions
Act No. 10465 (as amended by Act No. 19234, 2023) Art. 37-2; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, Mar. 12, 2024), Arts. 44-2 to 44-4
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 15 March 2024.
A data subject rights rule binding public and private bodies.
As of 24 September 2026.
What it requires
- An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
PIPA Art. 37-2, inserted by the 2023 amendment, gives a data subject the right to object to a decision made by a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, and the right to request an explanation of the decision, except where the decision rests on the data subject's consent, a statutory obligation, or the performance of a contract with the data subject under Art. 15(1)(1), (2), or (4).
Where a data subject objects or requests an explanation, the controller must not apply the automated decision unless there is a compelling reason not to, or must take measures such as reprocessing the decision with human involvement, and Art. 37-2(4) separately requires the controller to disclose the criteria and procedures it uses for automated decisions so a data subject can readily confirm them.
Enforcement Decree Arts. 44-2 through 44-4, added by Presidential Decree No. 34309 and in force from the same date as Art. 37-2 itself, set the request procedure, the controller's response measures, and the standards the disclosure duty must cover.
When LexLint raises it
high_risk_decisions
Read the law
official English translation, KLRI
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.