Personal Information Protection Act, Art. 15(1)(vi), as applied by the PIPC's publicly-available-data AI guideline

Personal Information Protection Act (Act No. 18972, as amended) Art. 15(1)(vi); PIPC Guideline for Personal Data Processing for the Development and Utilization of Generative AI (issued 2024-07-18)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 18 July 2024.

A personal data rule binding public and private bodies.

As of 29 August 2026.

What it requires

Specify a legitimate, defined purpose for the AI model before relying on this ground to process publicly available personal data.
Limit the personal data you collect and use to what is adequate and necessary for that stated purpose.
Document a balancing assessment showing your interest clearly overrides the affected individuals' rights, and adopt the named technical and procedural safeguards, including a disclosure, impact assessment, and an erasure or objection mechanism.

Who checks it

Audit expectation

none

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 15(1)(vi) lets a personal information handler process personal information without consent where necessary to achieve the handler's legitimate interest and that interest clearly overrides the data subject's rights, provided the interest is substantially related to the handler's legitimate interest and does not exceed a reasonable scope.

The Personal Information Protection Commission's July 18, 2024 guideline, non-binding but currently the operative practical standard, clarifies that publicly available data can be used for AI training and service development under this ground, provided the processor meets three requirements: a specified, legitimate purpose for the AI model; necessity, meaning collection is limited to adequate and relevant data for that purpose; and a documented assessment that the processor's interest clearly overrides data subjects' rights, backed by named technical safeguards (examining training-data sources, de-identification, secure storage) and procedural ones (privacy-policy disclosure, impact assessment, an erasure or objection mechanism).

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

official English-language press release, Personal Information Protection Commission (pipc.go.kr)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app