South Korea

Article 32 binds an AI business operator whose AI system was trained using cumulative compute at or above the threshold the Presidential Decree sets, and requires it to identify, assess and mitigate risk across the system's full life cycle and to build a risk-management system that monitors and responds to AI-related safety accidents. The operator must submit the results of implementing those measures to the Ministry of Science and ICT.

The Ministry sets the specific implementation method, and the manner of submitting those results, by public notice, matters the Act itself does not state. The Decree's threshold is met only where cumulative training compute reaches 10^26 floating-point operations or more, the system applies the most advanced AI technology currently in use, and its risk could broadly and seriously affect people's life, physical safety and fundamental rights.

Article 32 took effect on January 22, 2026, one year after the Act's promulgation. The submission is a periodic report of having that internal system in place rather than a notice triggered by a particular accident, and neither the Article nor the Decree states a period running from the moment an operator becomes aware of one.

Article 34 binds an AI business operator providing high-impact AI, or a product or service that uses it, and requires it to establish and operate a risk-management plan, to establish and carry out a plan explaining the AI's final output and the main criteria and training-data overview behind it so far as technically feasible, to establish and operate a user-protection plan, to provide human management and supervision of the AI, and to prepare and keep documents confirming those measures.

The Ministry of Science and ICT sets the specific content of those measures by public notice and may recommend that operators comply, and an operator that has already taken equivalent measures under another statute is treated as having complied.

The Enforcement Decree requires the operator to post the main content of the risk-management, explanation and user-protection plans, and the name and contact details of the person supervising the high-impact AI, at its place of business or on its website, and to keep the supporting documentation, including in electronic form, for five years.

High-impact AI is defined by what the AI is used for rather than by what the operator is, covering energy supply, drinking water production, healthcare provision, medical and digital medical devices, nuclear material and facility safety, biometric identification for criminal investigation or arrest, hiring and loan decisions, transportation systems, public-service eligibility and fee decisions, and student assessment in early childhood, elementary and secondary education.

Article 33 separately requires an operator to review in advance whether its AI is high-impact, and lets it ask the Ministry to confirm that answer. Article 34 took effect on January 22, 2026, with the rest of the Act.

An AI business operator providing a product or service using high-impact or generative AI must give users prior notice that it operates on that AI. An operator providing generative AI, or a product or service using it, must indicate that output was AI-generated, either through a human-perceptible label or machine-readable metadata or watermark.

Where an operator uses AI to produce a virtual sound, image, or video difficult to distinguish from reality, only a user-perceptible label satisfies the deepfake-specific duty, with a narrow exception for artistic or creative works. The Act reaches conduct outside Korea affecting Korean users under its own extraterritoriality clause, and a foreign operator meeting revenue or user thresholds must appoint a domestic representative.

Art. 34(1) requires a controller to notify affected data subjects without delay on becoming aware personal information has been divulged, and the Enforcement Decree sets this at within 72 hours.

Art. 34(3) separately requires reporting to the PIPC, or the Korea Internet and Security Agency, without delay for a breach above a Presidential Decree set scale, which the Decree sets at 1,000 or more affected subjects, any sensitive information or unique identification information involved, or a breach caused by illegal external access, also within 72 hours.

PIPC guidance interprets PIPA Art. 15(1)(6)'s legitimate interest ground as the lawful basis authorizing an AI developer to collect and use publicly available personal data from the open web for AI training and service development, provided the controller's interest clearly overrides data subjects' rights. It treats such data as remaining within PIPA's scope, not exempt, given the privacy risk from addresses, unique identifiers, and financial data mixed into public web content.

The guideline's own text addresses AI developers and service providers generally, with no stated limit to private-sector controllers.

PIPA is Korea's single omnibus personal-data statute, reaching public institutions and private businesses alike. Art. 15 sets several lawful bases for collecting and using personal information, most commonly consent or the controller's justifiable interest where it is manifestly superior to the data subject's rights, and confines processing to the stated purpose of collection.

There is no separate controller and processor split as sharp as General Data Protection Regulation (GDPR)'s; PIPA instead regulates the broadly defined personal information controller.

Art. 28-8 prohibits cross-border transfer of personal information unless a lawful basis applies, separate consent from the data subject first among them (Art. 17(3), the rule's pre-2023 home, was deleted by Act No. 19234), and bars a transfer contract that would violate the Act.

The 2023 amendment's Arts. 28-8 to 28-11 add alternative grounds: a treaty or international agreement, PIPC certification of the recipient's safeguards, or PIPC recognition that the destination country affords adequate protection, and arm the PIPC to order a transfer suspended for a serious or repeated violation. There is no data localization mandate.

PIPA Arts. 4 and 35 through 37 grant a data subject the right to confirm whether their data is processed, to access it, to demand correction and deletion, and to suspend processing, exercisable against the personal information controller. Art. 37-2, added by the 2023 amendment, adds the right to demand an explanation of, or refuse, a fully automated decision that significantly affects the subject's rights or obligations, subject to a controller's justifiable reason defense.

The same amendment added Art. 35-2, a data portability right, reported by secondary sources to have taken effect separately on 13 March 2025; that date is not confirmed against primary text.

The Personal Information Protection Commission (PIPC), Korea's independent data protection authority, enforces PIPA with investigative, corrective order, and administrative fine power, including a fine of up to 3% of a controller's total sales revenue for major violations under Art. 64-2.

Individuals separately have a private civil remedy: Art. 39 lets a court award damages up to five times actual loss where the controller acted with intention or negligence, and Art. 39-2 lets a data subject recover statutory damages up to KRW 3,000,000 for loss, theft, or divulgence without proving actual loss, with the controller bearing the burden of proving it was not negligent.

Art. 51 separately authorizes an injunction only group action by qualified consumer or civic organizations to stop an ongoing infringement, not a damages class action.

A further amendment reported as promulgated 10 March 2026 is reported to raise the Art. 64-2 fine cap toward 10% of total revenue for repeated or large scale violations and to add personal liability for a controller's chief executive, effective 11 September 2026, but no official source for that amendment is located, so it is not recorded as a dated stage.

Art. 23 bars processing sensitive information without separate consent or statutory authorization, listing ideology, belief, health, sex life, and trade union or political affiliation directly and delegating further categories to the Enforcement Decree.

Decree Art. 18 adds DNA information, criminal history records, information revealing racial or ethnic origin, and biometric information, defined technology neutrally as data from specific technical processing of physical, physiological, or behavioral characteristics used to uniquely identify a person. That definition covers a faceprint and a voiceprint alike without naming either, and does not exclude an identifier derived from a photo, video, or audio recording.

Article 48(1) prohibits intruding into an information and communications network without legitimate access authority or beyond the scope of permitted authority. The Supreme Court held in Yanolja Co. v. GC Company (2021Do1533, 12 May 2022) that scraping publicly available data without defeating an authentication or access-control measure did not violate this provision as charged.

Paragraph (4), added January 23, 2024, separately prohibits installing, transmitting, or distributing a program or technical device whose purpose is to bypass a network's normal protection or authentication procedures, reaching a scraper's own circumvention tools directly even though paragraph (1)'s basic prohibition predates it and remains the article's core text.

The Copyright Act gives a sui generis database-producer right, running five years from a database's completion or substantial renewal, to a person who has made a substantial investment (human or material) in producing, verifying, or presenting a database, independent of whether the database's own contents are copyrightable.

Systematic, repeated, or purposeful reproduction of individual materials or non-substantial parts can itself count as reproducing a substantial part where it conflicts with the database's ordinary use or unfairly harms the producer's interests. The Seoul High Court applied this right in Saramin Co. v. JobKorea Co. (2016Na2019365, 6 Apr.

2017, secondary-sourced), holding that systematic scraping of a competing job-listing database via VPN IP-masking, user-agent spoofing, and ignoring robots.txt infringed the database-producer right and separately was unfair competition. This official law.go.kr page is located and cited, but serves only a script shell rather than the article text, so the account above rests on secondary sourcing rather than on an independent read of the article.

The database-producer right did not exist in the Copyright Act's original 1957 text; it was added by Act No. 6881, promulgated 27 May 2003, which entered into force 1 July 2003, the date recorded here as this chapter's commencement. Because law.go.kr itself returned only a script shell, the amendment date is confirmed instead against a Korean case-law database's structured amendment history for the Act, secondary-sourced pending primary confirmation from law.go.kr.

Article 15(1)(vi) lets a personal information handler process personal information without consent where necessary to achieve the handler's legitimate interest and that interest clearly overrides the data subject's rights, provided the interest is substantially related to the handler's legitimate interest and does not exceed a reasonable scope.

The Personal Information Protection Commission's July 18, 2024 guideline, non-binding but currently the operative practical standard, clarifies that publicly available data can be used for AI training and service development under this ground, provided the processor meets three requirements: a specified, legitimate purpose for the AI model; necessity, meaning collection is limited to adequate and relevant data for that purpose; and a documented assessment that the processor's interest clearly overrides data subjects' rights, backed by named technical safeguards (examining training-data sources, de-identification, secure storage) and procedural ones (privacy-policy disclosure, impact assessment, an erasure or objection mechanism).

Item pa is the general catch-all: using, contrary to fair commercial practice, the outcome of another person's substantial investment or effort for one's own business without authorization. It has done most of the real work in reported scraping cases: the Seoul High Court found systematic evasive scraping of a competing job-listing database an unfair-competition violation in Saramin Co. v. JobKorea Co. (2016Na2019365, 6 Apr.

2017, secondary-sourced), and in Yanolja Co. v. GC Company's parallel civil proceeding (Seoul High Court, 2021Na2034740, 25 Aug. 2022, secondary-sourced) the same scraping conduct that cleared criminally under the Information and Communications Network Act nonetheless lost under this clause, with an award of roughly KRW 1 billion.

A separate item, ka, added no earlier than December 2021 and not previously catalogued in this topic's research, is a purpose-built data-misappropriation clause: it reaches acquiring data by theft, fraud, unauthorized access, or other wrongful means and using or disclosing data so acquired; using or disclosing data obtained under a contractual access limit beyond that limit, for wrongful profit or to harm the data holder; acquiring or using data known to have been obtained either way; and providing, manufacturing, or distributing a technology or device whose main purpose is to circumvent a technical measure protecting data.

Item ka's structure closely parallels China's 2025 Anti-Unfair Competition Law Article 13 and is more directly on point for a scraping fact pattern than item pa's general catch-all.

A provider of information and communications services, a person who for profit provides information or acts as an intermediary in providing information using a telecommunications business operator's services, must immediately report a computer security incident to the Minister of Science and ICT or the Korea Internet and Security Agency (KISA) upon discovering it; a report already made for the same incident under another statute satisfies this duty.

The same class of person must then analyze the cause of the incident, respond based on that analysis, and take measures to keep the resulting damage at bay, and must preserve or submit the data the Minister or KISA demands for that analysis when ordered to. Failing to report the incident, or failing to submit the demanded data or submitting false data, is an administrative fine of up to KRW 30,000,000.

Requires anyone who sells, rents, distributes or otherwise provides media designated as harmful to youth (Korean: 청소년유해매체물) to verify the recipient's age and identity, using in-person confirmation, a certified digital certificate, or mobile phone carrier authentication, and prohibits providing such media to anyone under 19. The verification duty dates to the 2001 amendment (Act No. 6479, effective 25 August 2001) and sits in Article 16 of the wholly amended Act. Commercial violations carry criminal penalties under Article 58.

Lets a minor under 18 or the minor's legal guardian request that an online game provider restrict the minor's game access to specific hours or a set daily duration, and requires the game provider to comply with the requested restriction. Since the parallel mandatory overnight shutdown system was repealed effective January 1, 2022, this parental-choice system is the sole statutory game-time control for minors.

Article 7(5) excludes current news reporting which delivers simple facts from copyright protection outright, so a bare news item is never a protected work under Korean law regardless of who reported it first. Article 26 permits reproducing, distributing, publicly performing, or publicly transmitting a work seen or heard in the course of reporting current events by broadcast, newspaper, or other means, to the extent justified by the reporting purpose.

Article 27 lets a media organisation other than the originating outlet reproduce, distribute, or broadcast a news article or editorial inserted in a newspaper or online newspaper under the Act on the Promotion of Newspapers, or carried by a news agency under the Act on the Promotion of News Communications, unless the originating outlet has indicated that such use is prohibited; the permission reaches full articles and editorials rather than only short extracts, and it has not been amended since 2009.

Article 28 separately allows quoting an already-made-public work for news reporting, criticism, education, research, and similar purposes, within a reasonable extent and in compliance with fair practice.

None of the four provisions has a stated commencement day in the consolidated text read: each entered into force under its own amending Act's general rule of six months (Art. 26's 2024 amendment) or, for the earlier amendments touching Arts. 7, 27, and 28, the same six-months-after-promulgation formula, without the Act's addenda stating the calendar day itself.