South Korea

Industrial Digital Transformation and Artificial Intelligence Utilization Promotion Act

Revised guidelines on processing of pseudonymised information

On 31 March 2026, the Personal Information Protection Commission (PIPC) adopted revised guidelines on the processing of pseudonymised information. The guidelines apply to all organisations processing pseudonymised personal data, including Artificial Intelligence (AI) providers. The revision introduces a standardised, risk-based framework under which internal data use is classified as low risk, while provision to third parties is classified as medium or high risk depending on the degree of env...

Bill amending Network Act including incident response obligations and enforcement measures (Bill No. 2214896)

On 20 March 2026, the Bill amending the Network Act, including incident response obligations and enforcement measures, was adopted by the National Assembly. The Bill includes provisions on incident response and enforcement. It applies to information and communications service providers, including major providers and colocation facility operators. The Bill introduces obligations to designate a Chief Information Security Officer, establish an Information Security Committee, and undergo annual g...

2024 Personal Information Processing Policy Evaluation Plan

On 4 March 2026, the Personal Information Protection Commission (PIPC) issued recommendations following discussions with generative AI companies on improving personal information handling policies to increase transparency in Artificial Intelligence (AI) data processing. The discussions addressed the personal information processing policy evaluation system, which examines whether companies clearly disclose the categories of personal data they handle, the legal basis for such processing, retent...

Media and Communication Commission's casebook on violations under Location Information Act

On 3 March 2026, the Korea Communications Commission and the Korea Internet & Security Agency published a casebook compiling violations identified during inspections of location information service providers under the Act on the Protection and Use of Location Information. The publication categorises these violations into four areas. This includes failing to complete the necessary registration or reporting procedures when changes occur, such as a change of company name or address, suspension o...

Act on Promotion of Artificial Intelligence and Data-Based Public Administration

Bill amending Information and Communications Network Act to establish an expedited response mechanism for illegal online content (No. 2217175)

On 27 February 2026, the Bill amending the Information and Communications Network Act was introduced to the National Assembly. The Bill applies to information and communications service providers and bulletin board operators hosting user-generated content. The Bill would insert a new paragraph in Article 44-7 to establish an expedited response mechanism for certain categories of manifestly illegal information that seriously infringe legal interests, including narcotics, gambling, illegal film...

Bill amending Information and Communications Network Act to introduce security assessments for Internet of Things devices (No. 2217144)

On 27 February 2026, the Bill amending the Information and Communications Network Act to introduce security assessments for Internet of Things (IoT) devices was introduced to the National Assembly. The Bill applies to manufacturers and suppliers of network-connected devices that collect, process, and transmit data. Under the proposed amendment, the Minister of Science and ICT may conduct security investigations of such devices where deemed necessary for the stability of information and commun...

Measures to address fake news and misuse of artificial intelligence pertaining to elections

On 26 February 2026, the government of South Korea announced measures following an inter-ministerial meeting to strengthen the government's response to fake news and the misuse of artificial intelligence (AI), particularly ahead of the June 2026 local elections. The measures apply to online information activities, including the creation and dissemination of AI-generated content and false information on digital platforms. The government announced a coordinated response involving several minist...

Content moderation regulation in Amendment to Information and Communications Network Act to address overseas-based manipulation of online public opinion (Bill No. 2217090)

On 26 February 2026, a Bill amending the Information and Communications Network Act to address overseas-based manipulation of online public opinion was introduced to the National Assembly. The Bill applies to information and communications service providers that meet criteria to be specified by Presidential Decree, including thresholds based on average daily users, revenue, and business type. It requires covered providers to adopt technical and managerial measures to prevent abnormal use of t...

Digital Forensic Support and Evidence Storage and Management Regulation

On 19 February 2026, the Personal Information Protection Commission closes the consultation on the draft digital forensic support and evidence storage and management regulation. The draft regulation sets out definitions, principles, and procedures for digital forensic support under the Personal Information Protection Act. It covers digital evidence collection, analysis, storage, management, and destruction. The regulation also specifies requirements for maintaining integrity and continuity, p...

Expedited content takedown procedures for illegal information in amendment to Act on the Establishment and Operation of the Broadcasting and Media Communications Commission (Law No. 21379/Bill No. 14862)

On 19 February 2026, the Partial Amendment to the Act on the Establishment and Operation of the Broadcasting and Media Communications Commission (Law No. 21379) entered into force upon promulgation. The Law applies to online platform services, streaming services, messaging services, and search services providing content to domestic users in South Korea and subject to oversight by the Broadcasting and Media Communications Review Committee. The Law expands the written resolution procedure of th...

Media and Communication Commission and Ministry of Gender Equality and Family business agreement to realise a safe digital society

On 23 January 2026, the Korea Media and Communications Committee and the Ministry of Gender Equality and Family signed a business agreement to combat digital sex crimes and strengthen youth protection within digital services by establishing a standing cooperation framework. The agreement targets information and communications service providers, as well as other digital intermediaries, who are involved in the distribution of illegal recordings, AI-generated deepfake sexual abuse material, harm...

Framework Act on the Development of Artificial Intelligence and Establishment of Trust

Enforcement Decree of the Framework Act on Artificial Intelligence

Artificial Intelligence authority governance in Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and Creation of a Trust Base (Presidential Decree No. 36053)

On 22 January 2026, the Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and Creation of a Trust Base (Presidential Decree No. 36053) entered into force. The Enforcement Decree repeals the Regulations on the Establishment and Operation of the National Artificial Intelligence Strategy Committee pursuant to Supplementary Provisions Article 2. The Enforcement Decree establishes transitional governance arrangements pursuant to Supplementary Provisions Article ...

Design requirements in Bill on Development of Artificial Intelligence and Establishment of Trust-Based Foundations (Bill no. DD20131)

On 22 January 2026, the Bill on Development of Artificial Intelligence and Establishment of Trust-Based Foundations (Bill no. DD20131) enters into force. The Bill guides the ethical and responsible development and use of artificial intelligence (AI) technologies and incorporates 19 Bills for establishing rules for AI. The Bill defines the term "high-impact artificial intelligence" as an artificial intelligence system that may affect or cause danger to human life, physical safety, and fundamen...

Design requirements in Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation

On 21 January 2026, the President signed the Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and Creation of a Trust Base (Presidential Decree No. 36053). The Enforcement Decree, as promulgated, does not include elements announced during the drafting stage on 15 January 2025 concerning the establishment of a primary subordinate legislative framework to operationalise national governance measures, industrial development measures, risk prevention mechanisms...

Guidance on telecommunications-related Laws for user protection relating to AI service providers

On 20 January 2026, the Broadcasting and Media Communications Commission (KMCC) published the legal guidance on telecommunications-related Laws for user protection relating to AI service providers, following a review of how existing telecommunications statutes apply to artificial intelligence services provided via information networks. The guidance analyses user-protection provisions under the Telecommunications Business Act and the Information and Communications Network Act, noting that AI s...

Media and Communications Commission investigation into X over alleged failure to implement youth protection measures for Grok service

On 14 January 2026, the Media and Communications Commission issued an interim ruling in its investigation of X (formerly Twitter), requiring X establish safety measures to protect youth from harmful content on its Grok artificial intelligence (AI) service. The Commission also notified X to develop a protection plan to block harmful information and report the results. The action follows concerns regarding the spread of non-consensual sexual images and exploitative material through social media...

Personal Information Protection Commission investigation into Shinhan Card over alleged unlawful sharing of merchant personal data

On 24 December 2025, the Personal Information Protection Commission (PIPC) announced an investigation into Shinhan Card following a public interest whistleblower report. The report alleged that Shinhan Card unlawfully shared merchant personal data, including merchant names, owner names, and mobile numbers from newly installed terminal information, with card recruiters between March 2022 and May 2025. The investigation aims to assess the cause, scope, and types of data leaked, and to determine...

Personal data incident prevention and investigation capacity expansion in revised Enforcement Decree and Enforcement Rules of the Personal Information Protection Commission

On 23 December 2025, the Personal Information Protection Commission (PIPC) announced that the Cabinet approved revisions to the Enforcement Decree and Enforcement Rules governing the organisational structure of the PIPC. The revisions establish a Prevention and Coordination Officer and a Preliminary Inspection Division responsible for conducting prior inspections of personal data processing and identifying personal data risks before incidents occur. The revisions expand investigation and disp...

Ministry of Science and Information and Communication Technology closes consultation on Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation including AI authority governance

On 22 December 2025, the Ministry of Science and Information and Communication Technology closes the public consultation on the Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation, which had been open since 12 November 2025 to gather opinions on governance provisions included in the draft Enforcement Decree. The consulted draft contained governance arrangements specifying the designation and operation of an artificial intelligence s

Partial amendment to the Enforcement Rule of the Organisation of the Personal Information Protection Commission

On 19 December 2025, the Personal Information Protection Commission (PIPC) closes the public consultation on the Partial Amendment to the Enforcement Rule of the Organisation of the PIPC, which had been open since 16 December 2025. The consultation concerns a draft amendment intended to reflect the revision of the Organisation of the PIPC. The draft provides for the establishment of a Preventive Coordination Officer and a new division within the Investigation and Coordination Bureau, the incr...

Ministry of Science and Information and Communication Technology opened consultation on Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation including AI authority governance

On 12 November 2025, the Ministry of Science and Information and Communication Technology opened the public consultation on the Enforcement Decree of the Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation until 22 December 2025 to collect opinions on governance provisions in the draft Enforcement Decree. The draft specifies designation and operation of institutions supporting artificial intelligence policy and safety, including the artificial intelligen

Personal Information Protection Commission investigation into local ordinances over personal information infringement factors

On 12 September 2025, the Personal Information Protection Commission (PIPC) announced that it is cooperating with Jeollanam-do and Sejong Special Self-Governing City to review a total of 1'793 ordinances (985 in Jeollanam-do and 808 in Sejong) in order to identify and address personal information infringement factors not subject to the assessment scope under the Personal Information Protection Act. Of these, 263 ordinances (115 in Jeollanam-do and 148 in Sejong) involved the processing of per...

Measures to strengthen effectiveness of security management systems certification

On 6 December 2025, the Personal Information Protection Commission (PIPC) and the Ministry of Science and Information and Communication Technology (MSICT) announced measures to strengthen the effectiveness of the Information Security Management System (ISMS) certification and the Information Security and Personal Information Protection Management System (ISMS-P) certification, citing repeated hacking and large-scale personal-data leakage incidents involving certified enterprises. The announce...

PIPC Amendment to the Enforcement Decree of the Personal Information Protection Act for MyData Promotion

On 12 March 2025, the Personal Information Protection Commission (PIPC) announced the full implementation of South Korea's MyData system, following its introduction through an amendment to the Personal Information Protection Act in March 2023. The MyData system grants individuals the right to request the transfer of their personal data from holders to themselves or third-party service providers. The system initially applies to the medical, communications, and energy sectors, with a phased exp...

Personal Information Protection Commission investigation into Kakao Corp.'s artificial intelligence service Kanana

On 12 March 2025, the Personal Information Protection Commission (PIPC) issued an assessment of Kakao Corp.'s artificial intelligence service, "Kanana," following an investigation into its implementation. The assessment reviewed the service’s compliance with data protection regulations, focusing on safety measures, data processing protocols, and internal management systems. Kakao Corp. seeks to prevent personal data breaches through its proprietary AI model and collaboration with OpenAI, aimi...

Personal Information Protection Commission investigation into Sectanaine Ltd. over alleged data breach from credential stuffing attack

On 12 February 2025, the Personal Information Protection Commission issued a ruling against Sectanine Ltd. with a penalty of KRW 14.77 billion and a fine of KRW 7.2 million for violations of personal data protection laws. The ruling applies to two data breaches in 2022 and 2023, affecting over 17,000 individuals. Sectanine is a computer system design company that operates the 'Happy Point' membership service, which was the platform affected by the data breaches. The personal data of users who...

Personal Information Protection Committee investigation into DeepSeek's data processing practices compliance with Personal Information Protection Act

On 27 November 2025, the Personal Information Protection Commission (PIPC) issued an investigation finding during the final review of the 2025 Proactive Administration Best Case Competition. The finding concerned the personal information processing practices of the Chinese generative AI service DeepSeek. The PIPC noted that, immediately after DeepSeek’s launch in January 2025 and amid wider global attention to personal information risks, it established direct contact with the company’s headqu...

Government released Regulatory Rationalisation Roadmap for the AI Sector

On 27 November 2025, the Government released the Regulatory Rationalisation Roadmap for the AI Sector. The document outlines a cross-government plan involving 25 ministries and 67 regulatory-improvement tasks covering technology development, service use, infrastructure, and trust-and-safety measures. It identifies a wide range of regulatory barriers, including issues related to AI training data, the application of copyright and industrial-property rights, the use of synthetic data, pseudonymisat

Personal Information Protection Commission issued investigation finding on DeepSeek over personal information processing practices, including voluntary suspension and corrective implementation

On 27 November 2025, the Personal Information Protection Commission (PIPC) issued an investigation finding during the final review of the 2025 Proactive Administration Best Case Competition. The finding concerned the personal information processing practices of the Chinese generative AI service DeepSeek. The PIPC noted that, immediately after DeepSeek’s launch in January 2025 and amid wider global attention to personal information risks, it established direct contact with the company’s headquart

Cross-border data transfer regulation in United States-Republic of Korea Joint Fact Sheet

On 13 November 2025, the United States and the Republic of Korea (ROK) issued a Joint Fact Sheet following a meeting between their respective presidents, including a range of reciprocal trade commitments, such as facilitating the cross-border transfer of data including location, reinsurance, and personal data. Further, the two parties aim to ensure that companies do not face unnecessary barriers or discrimination regarding laws and policies for digital services, such as network usage fees and...

Personal Information Protection Commission's integrated guide on personal data processing

On 11 July 2025, the Personal Information Protection Commission (PIPC) released the integrated guide on personal data processing. The guide consolidates and replaces previous guidance documents, including the “Plain-Language Consent Guide”, the “Outsourcing Guide”, the “Personal Data Protection Measures Guide”, and the “Automated Processing Protection Guidelines”. It systematises amendments introduced by the 2023 full revision of the Personal Information Protection Act (PIPA), incorporating p...