South KoreaPersonal Information Protection Act, special rules for personal information processing in AI development
Act No. 21910 (2026), Personal Information Protection Act, Arts. 28-12 to 28-15
A comprehensive regime rule binding public and private bodies.
- Enforcement body
- Personal Information Protection Commission (PIPC), Republic of Korea
As of .
What it requires
- To use personal information you lawfully collected in Korea for AI development or performance improvement beyond the purpose you collected it for, obtain the Personal Information Protection Commission's deliberation and resolution first, showing that anonymous or pseudonymous processing would make the development difficult, that you have the safeguards the Enforcement Decree sets, and that the development serves the public interest or protects data subjects' or third parties' interests with a markedly low risk of unjustly harming them (Article 28-12(1) and (2)).
- Where the Commission requires it because of sensitive or unique identification information or the effect on data subjects, carry out a risk-factor assessment and submit the result before the Commission deliberates (Article 28-12(3)).
- State the purpose and type of this use in your privacy policy (Article 28-12(5)).
- Meet the conditions the Commission attaches, and provide the data it requests to supervise the use (Articles 28-12(2) and 28-13(2)).
- If the Commission restricts your processing, take the necessary measures without delay and report the result to the Commission (Article 28-14(2)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Act number 21910, promulgated on , adds a section to the Personal Information Protection Act that lets a controller use personal information it lawfully collected for artificial-intelligence development, performance improvement included, beyond the purpose it was collected for, once the Personal Information Protection Commission has deliberated and resolved to allow it.
The controller must show that anonymous or pseudonymous processing would make the development difficult, that it has put in place the safeguards the Enforcement Decree sets, and that the development serves the public interest or protects the interests of data subjects or third parties, with a markedly low risk of unjustly harming those interests. The Commission may attach conditions that it finds necessary to secure the rights of data subjects and the safe processing of the information.
Where the criteria set by Presidential Decree are met, having regard to whether sensitive or unique identification information is processed and to the effect and degree of risk to data subjects, the Commission must have the controller carry out and submit a risk-factor assessment before it deliberates. A controller that uses personal information under this section must state the purpose and type of the use in its privacy policy.
Under Article 28-13 the Commission must supervise periodically whether what it approved is being carried out and may require the controller to submit data, which the controller must provide unless there are special circumstances.
Under Article 28-14 the Commission must restrict all of the processing where approval was obtained by false or other improper means, where the conditions of Article 28-12 or the conditions it attached are not met, where processing does not begin within six months of approval without special reason, or where the purpose has become clearly impossible to achieve.
A controller whose processing the Commission has restricted must take the necessary measures without delay and report the result to the Commission. Under Article 28-15 the Commission may, in its deliberation, decide that the controller's use under Article 28-12 is exempt from Articles 18 to 20, 20-2, 23, 24, 24-2, 25 and 25-2, and from Article 28-8 where the personal information is entrusted for processing abroad. The amendment takes effect on .
When LexLint raises it
When your app profile says your app trains models.