I. BACKGROUND
The development of artificial intelligence (AI) technologies has emerged as a key priority for enhancing national competitiveness and improving quality of life. Demand for the use of data containing personal information has continued to grow in areas involving significant public interest, including strengthening social safety nets and preventing disasters and crime. The development and performance improvement of AI technologies require access to large-scale datasets, and, particularly in the case of unstructured data such as video, audio, images, and text, the original form and context of the data often directly affect model performance.
Under the current law, however, personal information lawfully collected under consent or contractual necessity may be used for a purpose other than the original purpose of collection only with separate consent from the data subject or another legal basis. Concerns have continued to be raised regarding the technical and practical limitations of using anonymized or pseudonymized data, as anonymization or pseudonymization in the course of AI technology development can substantially reduce data utility or, in many cases, render model development impracticable.
Against this backdrop, an amendment to the Personal Information Protection Act (Bill No. 20246) (the “PIPA Amendment”), which introduces special provisions for the use of personal information for AI technology development (the “Special Provisions”), was passed by the plenary session of the National Assembly on August 20, 2026. The PIPA Amendment is a consolidated and coordinated committee substitute combining bills proposed by Member of the National Assembly Min Byung-deok on January 31, 2025 and Member of the National Assembly Ko Dong-jin on March 13, 2025, and was passed at the plenary session following review by the National Assembly’s Legislation and Judiciary Committee.
The PIPA Amendment is expected to take effect six months after promulgation, following consideration and approval by the State Council. The Personal Information Protection Commission (the “PIPC”) has announced that, prior to the effective date, it intends to solicit input broadly from experts and industry stakeholders and to establish an operational framework for the Special Provisions and subordinate legislation consistent with the legislative intent.
II. KEY AMENDMENTS
1. Introduction of Special Provisions for Personal Information Processing for AI Technology Development
The PIPA Amendment adds a new Section 5, “Special Provisions for Processing Personal Information for AI Technology Development,” comprising Articles 28-12 through 28-15, to Chapter III of the PIPA. Accordingly, a personal information controller that (i) satisfies all prescribed requirements and (ii) obtains the PIPC’s deliberation and resolution may use lawfully collected personal information for AI technology development beyond the original purpose of collection (proposed Article 28-12(1)).
For these purposes, “AI technology development” includes performance improvement (proposed Article 28-12(1), parenthetical). Accordingly, the Special Provisions may apply not only to the development of new AI models, but also to the enhancement of existing AI services, model improvement, and performance validation.
2. Requirements for Application of the Special Provisions (Proposed Article 28-12(1))
To rely on the Special Provisions, all three of the following requirements must be satisfied.
① (Data Characteristics) Considering the characteristics of the information being processed (including video, audio, images, codes, and text) and its relevance to AI technology development, it must be difficult to develop the relevant AI technology if the information is processed in anonymized or pseudonymized form.
② (Safeguards) Safeguards meeting the standards prescribed by Presidential Decree must be implemented, including processing personal information in an environment equipped with technical, managerial, and physical measures for secure processing, or implementing additional safeguards appropriate to the particular circumstances, such as a cloud environment.
③ (Public Interest/Social Benefit and Low Risk) The purpose of the AI technology development must include either ⓐ promoting the public interest or ⓑ protecting the interests of data subjects or third parties or promoting social benefit, and in either case, there must be a manifestly low risk of unjustifiably infringing the interests of data subjects or third parties.
3. PIPC Deliberation and Resolution, Imposition of Conditions, and Simplified Procedures (Proposed Article 28-12(2))
To rely on the Special Provisions, a personal information controller must obtain the PIPC’s deliberation and resolution as to whether the foregoing requirements are satisfied. The PIPC may impose conditions to the extent necessary to protect data subjects’ rights and ensure the secure processing of personal information (proposed Article 28-12(2)).
Where the substance, method, or form of an AI technology or service is substantially identical or similar to that of an AI technology or service that has previously undergone PIPC deliberation and resolution, the deliberation and resolution process may be simplified in accordance with procedures to be prescribed and publicly notified by the PIPC pursuant to Presidential Decree (proposed Article 28-12(4)). Depending on the forthcoming Presidential Decree and PIPC notices, the procedural burden for similar services or repeated model improvements may be reduced to some extent.
4. Clarification of PIPC Deliberation and Resolution on the Exclusion from Application of Certain Provisions (Proposed Article 28-15)
Proposed Article 28-15 of the PIPA Amendment provides that certain key regulatory provisions of the current PIPA will not apply where the PIPC has so determined through its deliberation and resolution. The National Assembly’s Legislation and Judiciary Committee added language to clarify that PIPC approval under Article 28-12 does not automatically exempt all relevant PIPA provisions; rather, the PIPC must determine which specific provisions should be excluded from application. Accordingly, when deliberating and resolving on whether the Special Provisions under Article 28-12 apply, the PIPC will also determine, taking into account the characteristics and risks of each case, which protective provisions listed in Article 28-15 will not apply, including restrictions on use and provision beyond the original purpose (Articles 18 and 19), notification of the source of collection and related matters (Articles 20 and 20-2), restrictions on the processing of sensitive information, unique identification information, visual data, and related information (Articles 23 through 25 and Article 25-2), and restrictions relating to the overseas delegation of personal information processing (Article 28-8).
5. Risk Factor Assessment, Inclusion in Privacy Policy and Public Disclosure (Proposed Article 28-12(3), (5) and (6))
Where the processing falls within criteria prescribed by Presidential Decree—which shall be established taking into account (i) whether sensitive information or unique identification information is processed, (ii) the impact on the rights or interests of data subjects, and (iii) the degree of risk and other relevant factors—the personal information controller must conduct a “Risk Factor Assessment” and submit the results before the PIPC’s deliberation and resolution (proposed Article 28-12(3)). The Risk Factor Assessment is a process for analyzing risks arising from the processing of personal information and identifying areas for improvement, and is likely to operate not as a mere documentary requirement but as a process for assessing in advance matters such as the possibility of privacy infringement, discrimination or bias, excessive identification risks, and potential infringement of third-party rights.
Where a personal information controller intends to use personal information pursuant to a deliberation and resolution, it must include the purpose and type of such use in its privacy policy under Article 30 (proposed Article 28-12(5)).
In addition, once the PIPC has completed its deliberation and resolution, it must publicly disclose on its website or through other means ⓐ the identity of the person or entity requesting the deliberation and resolution and the principal matters reviewed, and ⓑ a summary of the Risk Factor Assessment results (proposed Article 28-12(6)). Accordingly, companies seeking to rely on the Special Provisions should consider not only the implementation of internal safeguards but also amendments to their privacy policies, explanatory materials that may become publicly available, and the need to withhold trade secrets or security-sensitive information from public disclosure.
6. Post-Approval Management and Supervision and Restrictions on Personal Information Processing (Proposed Articles 28-13 and 28-14)
The PIPA Amendment establishes post-approval management and supervision mechanisms in addition to its ex ante deliberation framework. The PIPC must periodically manage and supervise compliance with matters subject to its deliberation and resolution and may require personal information controllers to submit materials to the extent necessary (proposed Article 28-13). Further, if any of the following circumstances arises, the PIPC must, following deliberation and resolution, restrict the processing of personal information in its entirety (proposed Article 28-14(1)):
① The PIPC’s deliberation and resolution was obtained through false or other improper means.
② Any of the requirements under the subparagraphs of proposed Article 28-12(1) is not satisfied.
③ Any condition imposed by the PIPC is not satisfied.
④ The processing of personal information for AI technology development is not commenced within six months from the date of the PIPC’s deliberation and resolution without a justifiable reason.
⑤ Due to a material change in circumstances, it is determined that the purpose of the processing of personal information, including AI technology development, is clearly incapable of being achieved.
Where the PIPC restricts the processing of personal information, the personal information controller must take the necessary measures without delay and notify the PIPC of the results (proposed Article 28-14(2)). Accordingly, even after approval under the Special Provisions, continued compliance with approval conditions, management of data processing records, ongoing operation of risk mitigation measures, internal reviews, and maintenance of supporting documentation are expected to become increasingly important.
III. PRACTICAL IMPLICATIONS – EXPECTED BENEFITS AND NEXT STEPS
1. (Expected Benefit) Expanded Pathway for the Use of Personal Information for AI Development
Once the PIPA Amendment takes effect, personal information controllers will have a separate legal pathway for using lawfully collected personal information for AI development and performance improvement, subject to certain requirements. In particular, unstructured data such as video, audio, images, and natural-language data have been subject to significant practical constraints because their utility may be substantially reduced through anonymization or pseudonymization. The Special Provisions are significant in that they expand the potential use of such data while providing a degree of legal predictability through the PIPC’s deliberation and resolution process. However, as the scope of the Special Provisions is limited to “use beyond the original purpose” for “AI technology development,” separate analysis will be required for matters such as new collection of personal information, provision to third parties, and applicability to regulated sectors such as financial services.
2. Preparing to Demonstrate Public Interest/Social Benefit and Low Risk
A key requirement under the Special Provisions is that the purpose of the AI development must include public interest, protection of the interests of data subjects or third parties, or promotion of social benefit, while presenting a manifestly low risk of unjustifiably infringing the interests of data subjects or third parties. Companies should therefore not limit their explanation of the purpose of AI development to technical enhancement or business efficiency, but should specifically identify the public or social value of the technology—such as user protection, improved service safety, reduced social costs, improved accessibility, or enhanced security. Companies should also comprehensively assess the types of data, scale of processing, data sensitivity, retention periods, access rights, whether cross-border transfers are involved, and the impact of the model on data subjects, and be prepared to demonstrate that the likelihood of infringement of rights or interests is low.
3. Establishing Internal AI and Privacy Procedures for Ex Ante Review
Personal information controllers seeking to rely on the Special Provisions should establish internal procedures premised on the PIPC’s deliberation and resolution. Specifically, it would be advisable to prepare systematically in advance the purpose of the AI development and the necessity of the proposed data use, the reasons why development would be difficult using only anonymized or pseudonymized data, applicable safeguards, risk mitigation measures, matters to be reflected in the privacy policy, and materials suitable for public disclosure. In particular, where sensitive information or unique identification information is involved, or where the impact on data subjects is significant, a Risk Factor Assessment may be required. Companies should therefore consider in advance how this process can be integrated with existing internal procedures such as privacy impact assessments, AI impact assessments, and security reviews.
4. Post-Approval Compliance Risks
The PIPA Amendment provides for periodic management and supervision, requests for submission of materials, and restrictions on personal information processing even after PIPC deliberation and resolution has been obtained. Accordingly, it is important not only to obtain approval but also to establish a framework capable of ensuring continued compliance with the conditions of approval. Companies should manage data usage at each stage of AI training, validation, and operation to prevent data from being used beyond the approved purpose or scope, and should maintain access controls, logs, data retention and deletion measures, security measures for cloud processing environments, and records of internal reviews. In addition, because failure to commence processing within six months from the date of the PIPC’s deliberation and resolution without justifiable reason may constitute grounds for restricting processing, companies should also consider whether the timing of their application aligns with the actual development schedule.
5. Need to Monitor Forthcoming Implementing Regulations and PIPC Notices
The PIPA Amendment delegates a substantial portion of the key detailed standards to Presidential Decree or PIPC notices. In particular, the specific standards for safeguards, the scope and methodology of Risk Factor Assessments, detailed procedures for deliberation and resolution, requirements for simplified procedures, and detailed standards for post-approval management, supervision, and processing restrictions are expected to be further specified in subordinate legislation. Companies developing AI technologies or enhancing AI services should therefore continue to monitor the development of forthcoming implementing regulations and notices and assess in advance whether their AI development projects may fall within the scope of the Special Provisions.
* * *
Bae, Kim & Lee LLC is closely monitoring developments in subordinate legislation relating to the PIPA Amendment and the PIPC’s deliberation and resolution practices, and will continue to assist clients in establishing privacy compliance frameworks tailored to their AI development and data-use structures and in identifying optimal response strategies. Please do not hesitate to contact us if you have any questions regarding the foregoing.
[Korean Version]
Author: Jiyeon Park Partner, Taeuk Kang Partner, Juho Yoon Partner, Jiyoung Sohn Senior Foreign Attorney (New York), Kanghye Lee Partner
