North Korea

North Korea has no statute, regulation, or reported decision imposing an AI-transparency or output-labeling duty on any person. The Intellectual Property Law (adopted September 20, 2025, effective November 1, 2025), the Copyright Law (2001, amended 2006), the Law on the Protection of Computer Software (2003), and the Criminal Code (as amended up to December 24, 2023) contain no reference to artificial intelligence, automated decision-making, or synthetic-content disclosure.

The Intellectual Property Law provides that matters it does not cover are governed by the relevant laws and regulations (Art. 7).

North Korea has no verifiable personal-data-protection law. Article 79 of the Socialist Constitution of the DPRK, in the consolidated text that incorporates amendments up to August 29, 2019, provides a general right: "Citizens are guaranteed inviolability of the person and the home, and privacy of correspondence. No citizen can be placed under control or arrest nor can a citizen’s home be searched without a legal warrant."

It is a general right only: it names no "personal data" concept, no lawful-basis regime, no data-subject rights, no supervisory authority, and no biometric-specific provision.

North Korea has no statute located that sets a security requirement a software product or connected device must meet before or after it reaches a market, creates a duty to report an exploited vulnerability or a security incident to an authority or to users, imposes a cyber-resilience regime on a class of entity by sector or size, or states a general reasonable-security duty on a business that holds data.

The Criminal Code, Articles 201 through 203, punishes a person who intrudes into a computer network in the fields of state administration, national defence, or advanced science and technology, who destroys important information stored on a computer or similar device, and who inputs or spreads false information through a computer network causing confusion in information processing; each is an offence committed against a system by an intruder rather than a duty placed on an operator or a manufacturer, so all three belong to this jurisdiction's computer-misuse finding rather than to this one.

The Law on the Protection of Computer Software prohibits destroying or removing a technical protection device on registered software without the copyright holder's permission and directs the software industry's own supervisory organs to control destruction of or illegal access to software through a computer network, duties that protect a copyright holder's interest and the state's own control over software rather than placing a security-design, update, or vulnerability-handling obligation on a developer or platform.

The Law on Foreign Investment names endangering national security only as one of the grounds on which the state may prohibit or restrict a foreign investment project, a market-access screen applied to an investment proposal rather than a security duty running to a product, a service, or a business generally.

North Korea's own government information portal, naenara.com.kp, does not present a certificate valid for its own hostname, so no page from it could be read, and its captures held by the Internet Archive's Wayback Machine, reaching back to 2010, show no legislative or gazette content.

The WIPO Lex legislation database, the source of the North Korean statutes catalogued for this jurisdiction under other law topics, serves its jurisdiction browse and full-text search pages as a client-rendered application rather than as a page readable even at its own browser-rendering tier, so nothing beyond the specific instruments already catalogued there is confirmed present or absent on this topic.

The International Labour Organization's NATLEX database presents a CAPTCHA challenge on its own homepage, and the Food and Agriculture Organization's FAOLEX search interface presents a bot challenge on its own browse page, though FAOLEX's already-catalogued environmental-law documents for this jurisdiction remain directly readable.

Whether North Korea maintains a domestically-circulated or unpublished cybersecurity, information-security, or critical-infrastructure regulation outside what these channels carry is not established.

No breach-notification statute exists to name as this jurisdiction's privacy-topic counterpart: this jurisdiction's privacy-topic record finds no personal-data-protection law of any kind, so there is no notice-to-authority-or-to-person duty on this seam either. No enforcement body, penalty structure, or enforcement record was located for a security-posture duty, because no such duty was located to enforce.

North Korea has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code.

The Copyright Law of the Democratic People's Republic of Korea (2001, amended 2006), the Law on the Protection of Computer Software (2003), and the Intellectual Property Law (adopted September 20, 2025, effective November 1, 2025) govern intellectual property, including copyrighted works and computer software; none imposes an age-verification duty, a minor-access restriction, or a content-labeling duty tied to a user's age.

Article 31 of the Socialist Constitution of the DPRK (consolidated text up to August 29, 2019) sets a minimum working age of sixteen, Article 72 entitles minors who have no means of support to material assistance, and Article 77 gives mothers and children special protection through maternity and childcare measures; none of these provisions addresses internet access, media content, or a service's duty toward a minor user.

No offense in the Criminal Code (as amended up to December 24, 2023) turns on a minor's access to content or to an online service. The Reactionary Ideology and Culture Rejection Act (adopted December 4, 2020, amended August 19, 2022) requires parents to strengthen home education and control so that their children do not watch or distribute prohibited publications, and fines a citizen whose irresponsible education of their children lets such an offense occur.

It sets no age threshold, and it places no age-dependent duty on a service, platform or developer. No statute or reported decision imposes an age-verification, minor-access restriction, or design-code duty on a platform, app store, or developer.