South Korea

Article 32 binds an AI business operator whose AI system was trained using cumulative compute at or above the threshold the Presidential Decree sets, and requires it to identify, assess and mitigate risk across the system's full life cycle and to build a risk-management system that monitors and responds to AI-related safety accidents. The operator must submit the results of implementing those measures to the Ministry of Science and ICT.

The Ministry sets the specific implementation method, and the manner of submitting those results, by public notice, matters the Act itself does not state. The Decree's threshold is met only where cumulative training compute reaches 10^26 floating-point operations or more, the system applies the most advanced AI technology currently in use, and its risk could broadly and seriously affect people's life, physical safety and fundamental rights.

Article 32 took effect on January 22, 2026, one year after the Act's promulgation. The submission is a periodic report of having that internal system in place rather than a notice triggered by a particular accident, and neither the Article nor the Decree states a period running from the moment an operator becomes aware of one.

Article 34 binds an AI business operator providing high-impact AI, or a product or service that uses it, and requires it to establish and operate a risk-management plan, to establish and carry out a plan explaining the AI's final output and the main criteria and training-data overview behind it so far as technically feasible, to establish and operate a user-protection plan, to provide human management and supervision of the AI, and to prepare and keep documents confirming those measures.

The Ministry of Science and ICT sets the specific content of those measures by public notice and may recommend that operators comply, and an operator that has already taken equivalent measures under another statute is treated as having complied.

The Enforcement Decree requires the operator to post the main content of the risk-management, explanation and user-protection plans, and the name and contact details of the person supervising the high-impact AI, at its place of business or on its website, and to keep the supporting documentation, including in electronic form, for five years.

High-impact AI is defined by what the AI is used for rather than by what the operator is, covering energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education.

Article 33 separately requires an operator to review in advance whether its AI is high-impact, and lets it ask the Ministry to confirm that answer. Article 34 took effect on January 22, 2026, with the rest of the Act.

An AI business operator providing a product or service using high-impact or generative AI must give users prior notice that it operates on that AI. An operator providing generative AI, or a product or service using it, must indicate that output was AI-generated, either through a human-perceptible label or machine-readable metadata or watermark.

Where an operator uses AI to produce a virtual sound, image, or video difficult to distinguish from reality, only a user-perceptible label satisfies the deepfake-specific duty, with a narrow exception for artistic or creative works. The Act reaches conduct outside Korea affecting Korean users under its own extraterritoriality clause, and a foreign operator meeting revenue or user thresholds must appoint a domestic representative.

Article 34(1) requires a controller to notify the affected data subjects without delay on becoming aware that personal information has been breached. A breach here covers the loss, theft, divulgence, forgery, alteration or damage of personal information. Act number 21445 added forgery, alteration and damage to the cases that call for notice. Act number 21445 was promulgated on 10 March 2026 and took effect on 11 September 2026.

Enforcement Decree Article 39(1) sets that notice at within 72 hours. A controller may notify later, once the cause is removed, where urgent measures to stop the spread of the breach are needed or a natural disaster or other unavoidable cause makes the 72 hours hard to meet. Article 34(2) separately requires a controller to notify, without delay, every data subject who may have been affected when it learns of a possible breach of a kind the Enforcement Decree sets.

Enforcement Decree Article 39-2(1) sets two such cases, unauthorized access to a personal-information system or a handler's device that suggests a breach where the affected data subjects are hard to identify, and the unlawful trading of some personal information that suggests other data subjects' data may also have been breached. Enforcement Decree Article 39-3(1) sets that notice at within 72 hours of the time Article 39-2(1) fixes.

Article 34(4) requires a controller that learns of a breach to report it without delay to the Personal Information Protection Commission or a specialized body the Presidential Decree names. Enforcement Decree Article 40(3) names the Korea Internet and Security Agency as that body.

Enforcement Decree Article 40(1) sets the report at within 72 hours, with a later report permitted where an unavoidable cause intervenes, and no report needed where recovery or deletion of the data makes harm to data subjects very unlikely. The report is due where 1,000 or more data subjects are affected, sensitive information or unique identification information is involved, or the breach came through unauthorized access from outside.

PIPA is Korea's single omnibus personal-data statute, reaching public institutions and private businesses alike. Art. 15 sets several lawful bases for collecting and using personal information, most commonly consent or the controller's justifiable interest where it is manifestly superior to the data subject's rights, and confines processing to the stated purpose of collection.

There is no separate controller and processor split as sharp as General Data Protection Regulation (GDPR)'s; PIPA instead regulates the broadly defined personal information controller.

A personal information controller may process pseudonymized information without the consent of the data subjects for statistics, scientific research, archiving in the public interest and similar purposes, and when it gives such information to a third party it may not include information that could be used to identify a specific individual.

Pseudonymized information held by different controllers is combined for those purposes only by a specialized institution designated by the Protection Commission or the head of the relevant central administrative agency, and the combined information leaves that institution only with the approval of its head.

A controller processing pseudonymized information must store the additional information needed to restore the original state separately, take the safety measures the Enforcement Decree sets, and keep records of the processing. No one may process pseudonymized information for the purpose of identifying a specific individual, and where information that can identify an individual is generated the controller must stop processing it and retrieve and destroy it without delay.

Processing information to identify an individual in breach of that ban draws a penalty surcharge of up to 3 percent of total sales, or up to 2 billion won where there are no sales or they cannot be calculated, and is punishable by imprisonment of up to five years or a fine of up to 50 million won.

A personal information controller must take the technical, managerial and physical measures needed to keep personal information from being leaked, lost, stolen, forged, altered or damaged, including an internal management plan and the keeping of access records. The Enforcement Decree turns this into eight measures, one of which is to store, inspect, confirm and supervise the records of access to the personal information processing system, keep them safe, and prevent their forgery or alteration.

The Protection Commission's notice on safety measures defines an access record as the electronic record of the work a person did on the system, with the person's identifier, the date and time, the access location, the data subject information handled and the task performed.

The notice requires the controller to keep access records for at least one year, or at least two years where the system processes the personal information of 50,000 or more data subjects, processes unique identification or sensitive information, or the controller is a registered or notified basic telecommunications business operator.

The controller must also set in its internal management plan, and carry out, the cycle, method and follow-up procedure for checking access records and download activity.

Act number 21910, promulgated on 8 September 2026, adds a section to the Personal Information Protection Act that lets a controller use personal information it lawfully collected for artificial-intelligence development, performance improvement included, beyond the purpose it was collected for, once the Personal Information Protection Commission has deliberated and resolved to allow it.

The controller must show that anonymous or pseudonymous processing would make the development difficult, that it has put in place the safeguards the Enforcement Decree sets, and that the development serves the public interest or protects the interests of data subjects or third parties, with a markedly low risk of unjustly harming those interests. The Commission may attach conditions that it finds necessary to secure the rights of data subjects and the safe processing of the information.

Where the criteria set by Presidential Decree are met, having regard to whether sensitive or unique identification information is processed and to the effect and degree of risk to data subjects, the Commission must have the controller carry out and submit a risk-factor assessment before it deliberates. A controller that uses personal information under this section must state the purpose and type of the use in its privacy policy.

Under Article 28-13 the Commission must supervise periodically whether what it approved is being carried out and may require the controller to submit data, which the controller must provide unless there are special circumstances.

Under Article 28-14 the Commission must restrict all of the processing where approval was obtained by false or other improper means, where the conditions of Article 28-12 or the conditions it attached are not met, where processing does not begin within six months of approval without special reason, or where the purpose has become clearly impossible to achieve.

A controller whose processing the Commission has restricted must take the necessary measures without delay and report the result to the Commission. Under Article 28-15 the Commission may, in its deliberation, decide that the controller's use under Article 28-12 is exempt from Articles 18 to 20, 20-2, 23, 24, 24-2, 25 and 25-2, and from Article 28-8 where the personal information is entrusted for processing abroad. The amendment takes effect on 9 March 2027.

Art. 28-8 prohibits cross-border transfer of personal information unless a lawful basis applies, separate consent from the data subject first among them (Art. 17(3), the rule's pre-2023 home, was deleted by Act No. 19234), and bars a transfer contract that would violate the Act.

The 2023 amendment's Arts. 28-8 to 28-11 add alternative grounds: a treaty or international agreement, PIPC certification of the recipient's safeguards, or PIPC recognition that the destination country affords adequate protection, and arm the PIPC to order a transfer suspended for a serious or repeated violation. There is no data localization mandate.

PIPA Arts. 4 and 35 through 37 grant a data subject the right to confirm whether their data is processed, to access it, to demand correction and deletion, and to suspend processing, exercisable against the personal information controller. The same 2023 amendment added Art. 35-2, a data portability right whose commencement the amendment left to a date set by Presidential Decree. The Enforcement Decree sets that date at March 13, 2025.

PIPA Art. 37-2, inserted by the 2023 amendment, gives a data subject the right to object to a decision made by a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, and the right to request an explanation of the decision, except where the decision rests on the data subject's consent, a statutory obligation, or the performance of a contract with the data subject under Art. 15(1)(1), (2), or (4).

Where a data subject objects or requests an explanation, the controller must not apply the automated decision unless there is a compelling reason not to, or must take measures such as reprocessing the decision with human involvement, and Art. 37-2(4) separately requires the controller to disclose the criteria and procedures it uses for automated decisions so a data subject can readily confirm them.

Enforcement Decree Arts. 44-2 through 44-4, added by Presidential Decree No. 34309 and in force from the same date as Art. 37-2 itself, set the request procedure, the controller's response measures, and the standards the disclosure duty must cover.

The Personal Information Protection Commission (PIPC), Korea's independent data protection authority, enforces PIPA with investigative, corrective order, and administrative fine power, including a fine of up to 3% of a controller's total sales revenue for major violations under Art. 64-2.

Individuals separately have a private civil remedy: Art. 39 lets a court award damages up to five times actual loss where the controller acted with intention or negligence, and Art. 39-2 lets a data subject recover statutory damages up to KRW 3,000,000 for loss, theft, or divulgence without proving actual loss, with the controller bearing the burden of proving it was not negligent.

Art. 51 separately authorizes an injunction only group action by qualified consumer or civic organizations to stop an ongoing infringement, not a damages class action. A further amendment that the PIPC announced for promulgation on 10 March 2026 adds a special penalty surcharge of up to 10% of annual turnover for repeated or significant data breaches, alongside the general 3% cap in Article 64-2.

The same amendment strengthens the responsibility of chief executives for managing and supervising the processing of personal information. The PIPC announced that the amended Act takes effect on September 11, 2026.

Art. 23 bars processing sensitive information without separate consent or statutory authorization, listing ideology, belief, health, sex life, and trade union or political affiliation directly and delegating further categories to the Enforcement Decree.

Decree Art. 18 adds DNA information, criminal history records, information revealing racial or ethnic origin, and biometric information, defined technology neutrally as data from specific technical processing of physical, physiological, or behavioral characteristics used to uniquely identify a person. That definition covers a faceprint and a voiceprint alike without naming either, and does not exclude an identifier derived from a photo, video, or audio recording.

Article 48(1) prohibits intruding into an information and communications network without legitimate access authority or beyond the scope of permitted authority. The Supreme Court held in Yanolja Co. v. GC Company (2021Do1533, 12 May 2022) that scraping publicly available data without defeating an authentication or access-control measure did not violate this provision as charged.

Paragraph (4), added January 23, 2024, separately prohibits installing, transmitting, or distributing a program or technical device whose purpose is to bypass a network's normal protection or authentication procedures, reaching a scraper's own circumvention tools directly even though paragraph (1)'s basic prohibition predates it and remains the article's core text.

Article 2, item 28 of the Copyright Act defines a technological protection measure as a technical measure that the right holder, or a person with the right holder's consent, applies in connection with the exercise of the rights protected by the Act to effectively prevent or deter access to the protected works (item 28(a)), or to effectively prevent or deter infringement of those rights (item 28(b)).

Article 104-2, paragraph 1 provides that no one may, without proper authority and intentionally or negligently, neutralize a technological protection measure under item 28(a) by removing, altering or bypassing it. Among the exceptions in paragraph 1 is cryptography research by a person who lawfully obtained a copy, limited to a person who made a considerable effort to obtain the right holder's permission for the use but did not obtain it.

Other exceptions cover protecting minors from harmful online works, identifying and disabling the undisclosed collection of personal identifying information, law enforcement and security, acquisition decisions by schools and non-profit libraries, reverse engineering for interoperability, and security testing, and an exception notified by the Minister of Culture, Sports and Tourism takes effect for three years.

Paragraph 2 separately bars anyone, without proper authority, from manufacturing, importing, distributing, transmitting, selling, renting, offering to the public, advertising for sale or rental, holding for distribution, or providing as a service a device, product or part that is promoted for neutralizing a technological protection measure, has only a limited commercial purpose or use other than neutralizing it, or is mainly designed, made or adapted to enable or facilitate neutralizing it.

Paragraph 3 lifts the paragraph 2 bar, for a measure under item 28(a), in the cases of paragraph 1, items 1, 2, 4, 6 and 7, and, for a measure under item 28(b), in the cases of paragraph 1, items 4 and 6.

Article 104-8 lets the right holder claim cessation or prevention of the infringement, security for damages, or damages or statutory damages in their place, against a person who violates Articles 104-2 to 104-4, and, against a person who acted under Article 104-2, paragraph 1 without intention or negligence, only cessation or prevention.

Article 136, paragraph 3, item 3-3 provides imprisonment of up to three years or a fine of up to 30 million won, or both, for a person who violates Article 104-2, paragraph 1 or 2 as a business or for profit. Article 104-2 was newly inserted on June 30, 2011. The supplementary provisions of the Act of that date, Act number 10807, provide that it takes effect on the day the free trade agreement between the Republic of Korea and the European Union and its Member States enters into force. The official version list records Act number 10807 as in force from July 1, 2011.

The Copyright Act gives a sui generis database-producer right, running five years from a database's completion or substantial renewal, to a person who has made a substantial investment (human or material) in producing, verifying, or presenting a database, independent of whether the database's own contents are copyrightable.

Systematic, repeated, or purposeful reproduction of individual materials or non-substantial parts can itself count as reproducing a substantial part where it conflicts with the database's ordinary use or unfairly harms the producer's interests. This official law.go.kr page is located and cited, but serves only a script shell rather than the article text, so the account above rests on secondary reporting of the statute's structure rather than its own published text.

The database-producer right did not exist in the Copyright Act's original 1957 text; it was added by Act No. 6881, promulgated 27 May 2003, which entered into force 1 July 2003, the date recorded here as this chapter's commencement. Because law.go.kr itself returned only a script shell, the amendment date is confirmed instead against a Korean case-law database's structured amendment history for the Act, pending primary confirmation from law.go.kr.

Article 15(1)(6) of the Personal Information Protection Act lets a personal information controller collect and use personal information without consent "where it is necessary to attain the legitimate interests of a personal information controller, which such interest is manifestly superior to the rights of the data subject", and only to the extent the processing is substantially related to those interests and does not go beyond a reasonable scope.

The Personal Information Protection Commission's July 18, 2024 guideline on publicly available data sets out how the Commission reads this ground for AI training and service development; it binds nobody by itself and is listed with this law as guidance.

Item pa is the general catch-all: using, contrary to fair commercial practice, the outcome of another person's substantial investment or effort for one's own business without authorization.

A separate item, ka, added no earlier than December 2021 and not previously catalogued in this topic's research, is a purpose-built data-misappropriation clause: it reaches acquiring data by theft, fraud, unauthorized access, or other wrongful means and using or disclosing data so acquired; using or disclosing data obtained under a contractual access limit beyond that limit, for wrongful profit or to harm the data holder; acquiring or using data known to have been obtained either way; and providing, manufacturing, or distributing a technology or device whose main purpose is to circumvent a technical measure protecting data.

Article 8(1) of the Act lets the head of a central administrative agency designate information and communications infrastructure under its jurisdiction as critical information and communications infrastructure. Article 5(1) requires the head of the organization that manages critical information and communications infrastructure to formulate and implement physical and technological protection measures, including incident prevention, backup and recovery.

Article 5(4) requires that head to designate a chief information security officer. Article 9(1) requires that head to analyze and evaluate the infrastructure's vulnerabilities on a regular basis as prescribed by Presidential Decree. Article 10 lets the relevant central administrative agency issue protection guidelines and order the management organization to comply with them.

Article 11(1) lets the relevant central administrative agency order a management organization to take further protective measures after reviewing its submitted measures. Article 30(1) sets an administrative fine of up to 50 million won for failing to comply with an order under Article 10(1) or with a recovery and protection order under Article 14. The Act entered into force on 1 July 2001. The amendments of 23 January 2024 enter into force one year after their promulgation.

Article 13(1) of the Act requires the head of a management organization that recognizes a cyber security incident has disturbed, paralyzed or destroyed critical information and communications infrastructure to notify a relevant administrative agency, an investigation agency or the Korea Internet and Security Agency. Article 14(1) requires that head to take swift measures to recover and protect the infrastructure after a cyber security incident.

Article 8(1) lets the head of a central administrative agency designate information and communications infrastructure under its jurisdiction as critical information and communications infrastructure. Article 30(1) sets an administrative fine of up to 50 million won for failing to comply with a recovery and protection order under Article 14(2) or (3). The Act entered into force on 1 July 2001.

A provider of information and communications services, a person who for profit provides information or acts as an intermediary in providing information using a telecommunications business operator's services, must immediately report a computer security incident to the Minister of Science and ICT or the Korea Internet and Security Agency (KISA) upon discovering it; a report already made for the same incident under another statute satisfies this duty.

The same class of person must then analyze the cause of the incident, respond based on that analysis, and take measures to keep the resulting damage at bay, and must preserve or submit the data the Minister or KISA demands for that analysis when ordered to. Failing to report the incident, or failing to submit the demanded data or submitting false data, is an administrative fine of up to KRW 30,000,000.

Requires anyone who sells, rents, distributes or otherwise provides media designated as harmful to youth (Korean: 청소년유해매체물) to verify the recipient's age and identity, using in-person confirmation, a certified digital certificate, or mobile phone carrier authentication, and prohibits providing such media to anyone under 19. The verification duty dates to the 2001 amendment (Act No. 6479, effective 25 August 2001) and sits in Article 16 of the wholly amended Act. Commercial violations carry criminal penalties under Article 58.

Lets a minor under 18 or the minor's legal guardian request that an online game provider restrict the minor's game access to specific hours or a set daily duration, and requires the game provider to comply with the requested restriction. Since the parallel mandatory overnight shutdown system was repealed effective January 1, 2022, this parental-choice system is the sole statutory game-time control for minors.

Article 4(1)(9) lists computer program works among the examples of works the Act protects. Article 101-2 provides that the Act does not apply to the programming language, protocol or algorithm used to prepare a program. Articles 16, 18, 20 and 22 give the author the right to reproduce a work, the right to transmit it in public, the right to distribute its original or copy, and the right to produce and use a derivative work based on it.

Article 101-4(1) allows a person who uses a program with legitimate authority to decompile its program codes without the permission of the rights holder, limited to the part necessary for compatibility, where the person cannot easily obtain the information needed for compatibility and obtaining it is inevitable.

Article 101-5(1) allows a person who possesses and uses a copy of a program with legitimate authority to reproduce the copy to the extent necessary to provide against its destruction, damage or deterioration. Article 123(1) allows a holder of copyright to demand that a person infringing the right suspend the act. Article 125(1) presumes the profit an intentional or negligent infringer gained to be the damages the rights holder sustained.

Article 136(1)(1) punishes infringement of author's economic rights by reproduction, performance, public transmission, exhibition, distribution, rental or production of derivative works with imprisonment with labor for up to five years or a fine not exceeding 50 million won, or both.

Article 7(5) excludes current news reporting which delivers simple facts from copyright protection outright, so a bare news item is never a protected work under Korean law regardless of who reported it first. Article 26 permits reproducing, distributing, publicly performing, or publicly transmitting a work seen or heard in the course of reporting current events by broadcast, newspaper, or other means, to the extent justified by the reporting purpose.

Article 27 lets a media organisation other than the originating outlet reproduce, distribute, or broadcast a news article or editorial inserted in a newspaper or online newspaper under the Act on the Promotion of Newspapers, or carried by a news agency under the Act on the Promotion of News Communications, unless the originating outlet has indicated that such use is prohibited; the permission reaches full articles and editorials rather than only short extracts, and it has not been amended since 2009.

Article 28 separately allows quoting an already-made-public work for news reporting, criticism, education, research, and similar purposes, within a reasonable extent and in compliance with fair practice.

Article 35-5(1) entitles a person to use a work, outside the specific exceptions in Articles 23 through 35-4 and 101-3 through 101-5, where the use does not unreasonably undermine the author's legitimate interest and does not conflict with the normal exploitation of the work.

Article 35-5(2) directs that the purposes and characteristics of the use, the types and purposes of the work, the amount and substantiality of the portion used, and the effect on the existing or potential market for the work be considered.