South Korea PIPC Guidelines on AI and Personal Data

The PIPC is South Korea’s independent data-protection regulator. PIPA is the binding law governing personal-information processing, while PIPC guidelines explain its application and recommend safeguards. In July 2024, the PIPC said publicly available personal information can be processed for AI development on the legitimate-interests basis in Article 15, provided the controller’s interests clearly outweigh data-subject rights. The Commission describes a three-part assessment: legitimate purpose, necessity of the processing, and balancing of interests. Public availability alone is not blanket permission. Sensitive personal information remains subject to stricter statutory rules. In August 2025, the PIPC published Guidelines on Personal Data Processing for Generative AI. They organize safeguards across four stages: setting purpose; establishing development strategies; AI training and development; and application and management. They distinguish LLM-as-a-service, off-the-shelf models and self-developed models, because responsibilities and lawful bases vary by processing context. The guide addresses personal-data sources, legitimate bases, privacy safeguards, data-subject rights, training risks such as data poisoning and jailbreaks, and agentic systems. A separate 2026 revision to privacy-policy guidance adds an AI-specific annex encouraging clarity about intended use, input and output data, retention, training use, opt-out and complaint routes. Law No. 21910, the AI-specific PIPA amendment, was promulgated on September 8, 2026. It creates a special route for certain lawfully collected personal information where AI development is materially difficult using only anonymized or pseudonymized data, or where processing is necessary in the public interest, subject to safeguards and PIPC review. The amendment’s AI-specific provisions take effect six months after promulgation, on March 9, 2027, so they are not operative as of September 28, 2026. Until commencement, developers must rely on current PIPA and existing guidance, not the future special route. A separate PIPA amendment, Act No. 21445, took effect September 11, 2026, but it is distinct from Law No. 21910.