An amendment (대안) to the Personal Information Protection Act was passed by the National Assembly plenary session and transmitted to the government on 28 August 2026, moving it to the pre-promulgation stage. The amendment adds new Articles 28-12, 28-13, and 28-14, which would let a personal information controller use personal data it has already lawfully collected — without separate consent — for the purpose of developing AI technology, but only if it satisfies a defined set of conditions and obtains prior review from the Personal Information Protection Commission (PIPC). This affects any personal information controller, including foreign AI developers subject to PIPA, that wants to reuse existing Korean personal data for model training or related AI development where anonymization or pseudonymization is not practicable.

Key elements of the amendment

  • All of the following must be met before previously collected personal data can be used for AI development (Art. 28-12(1)): anonymization or pseudonymization is genuinely difficult for the AI development purpose; adequate safety safeguards for the data are in place; and the use serves the public interest or promotes social benefit with a significantly low risk of unfairly infringing the data subject's or a third party's interests.
  • PIPC deliberation and resolution is required before use is permitted. A simplified review procedure may apply where the AI technology or service is substantially identical or similar to one the PIPC has already reviewed (Art. 28-12(4)).
  • A prior risk assessment is required — before PIPC deliberation — where the processing involves sensitive information, unique identifiers, or otherwise meets criteria to be set by presidential decree, considering the impact and degree of risk to data subjects. The main content of that assessment must be disclosed (Art. 28-12(3), (6)).
  • Post-approval oversight: the PIPC will periodically check compliance with its own deliberation/resolution conditions. If a controller obtained the exception through false or fraudulent means, or fails to continue meeting the required conditions, its processing of the personal data concerned must be restricted (Art. 28-13, 28-14).

No specific effective date, monetary penalty, or presidential-decree threshold has been fixed yet in the bill text as passed; those details are left to subordinate legislation.

What this means for you

  • If your AI development relies on personal data collected in Korea under an existing lawful basis, this amendment creates a possible new pathway to reuse that data — but only through PIPC deliberation and resolution, not automatically.
  • Start preparing documentation now for the three substantive conditions (anonymization/pseudonymization difficulty, safety safeguards, public/social benefit with low risk), since these will need to be demonstrated to the PIPC.
  • If your processing involves sensitive information or unique identifiers, budget time and resources for a prior risk assessment and for disclosure of its main findings — this is a precondition to deliberation, not an afterthought.
  • Track promulgation and the implementing presidential decree, which will set the concrete criteria for the risk-assessment trigger and likely the effective date; the substantive conditions above are not yet operative until the law is promulgated and takes effect.
  • Note the compliance-scope risk: obtaining the exception through false or fraudulent means, or later failing to meet the conditions, results in a restriction on processing the data in question — plan for periodic PIPC monitoring of any approval you obtain.

Source: 2220246_2220246_의사국 의안과_의안원문.pdf