Summary
- Automated decision rights (Art. 37-2): where a fully automated decision, including one made with AI, significantly affects a person's rights or obligations, the person can refuse it or ask for an explanation, and can ask for review. PIPC gave job interviews and selecting welfare beneficiaries as examples (2023 press release).
- Timing: the 2023 amendment took effect mostly on 2023-09-15; PIPC said some provisions had later start dates. Secondary sources (and the implementing decree, Presidential Decree No. 34309) put Art. 37-2 at 2024-03-15.
- Higher fines: maximum penalty raised to 3% of total revenue, excluding revenue unrelated to the violation.
- Generative AI guidelines (2025): PIPC splits the generative AI lifecycle into four stages (purpose setting, strategy, training and development, application and management), suggests lawful bases such as legitimate interests by data type and source, and asks for AI privacy governance led by the chief privacy officer.
- 2026 AI special provisions: passed on 2026-08-20. They allow lawfully collected personal data to be used for AI development beyond existing lawful bases where AI development would otherwise be difficult or substantially limited and the use is needed in the public interest (conditions summarised from the PIPC release; bill text not read), with risk assessments for sensitive or unique identifiers, privacy policy disclosure and PIPC oversight. Not yet in force: takes effect six months after promulgation (promulgation date not stated in the source).
Who it applies to
- All personal information controllers in Korea, public and private.
- Foreign companies processing Koreans' data are covered; larger ones must appoint a domestic representative (PIPA domestic agent rules; article not re-checked).
- Credit evaluation decisions are governed by a parallel provision in the Credit Information Act (secondary).
Key dates
- National Assembly passes the PIPA amendment
- Amendment promulgated (Act No. 19234; promulgation date secondary)
- Most amended provisions and the Enforcement Decree take effect
- Automated decision rights (Art. 37-2) and implementing decree take effect (secondary sources)
- PIPC unveils Guidelines on Personal Data Processing for Generative AI
- National Assembly passes PIPA amendment with AI development special provisions; takes effect six months after promulgation
Full date record
| Date | Event |
|---|---|
| 2023-02-27 | Amendment passed by the National Assembly |
| 2023-03-14 | Promulgated (secondary) |
| 2023-09-15 | Main provisions and Enforcement Decree effective |
| 2024-03-15 | Art. 37-2 automated decision rights effective (secondary) |
| 2024-09 | PIPC guide on rights regarding automated decisions adopted (secondary) |
| 2025-08-06 | Generative AI guidelines unveiled |
| 2026-08-20 | AI development special provisions passed; in force six months after promulgation |
Penalties and enforcement
- Fines up to 3% of total revenue minus unrelated revenue.
- PIPC actively supervises AI: it has sanctioned AI-related firms and runs a prior adequacy review for new AI services (PIPC English press list; dates not checked).
What it means for an Indian company
- If you process data of people in Korea (for example a Korean customer base for a SaaS or fintech product), build an Art. 37-2 process: detect fully automated significant decisions, offer refusal or human review, and give concise explanations (SC-AI-027 Right to contest and human review for individuals, SC-AI-024 Explain AI-assisted decisions).
- For generative AI products, follow the PIPC lifecycle approach: purpose and lawful basis per data source (SC-AI-011 Lawful basis and consent for personal data used in AI), safeguards against data poisoning and jailbreaks (SC-AI-018 Robustness and adversarial testing (red teaming), SC-AI-029 AI-specific security controls (prompt injection, model abuse)), and CPO-led governance (SC-AI-002 AI roles, accountability and oversight committee).
- Watch the 2026 AI special provisions: once in force they may offer a route to reuse Korean customer data for model training, but only with PIPC review and risk assessment.
- Pair this with the Korea AI Basic Act duties for high-impact and generative AI.
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when Korea PIPA: automated decision rights and AI rules is done.
Glossary
- PIPA: Personal Information Protection Act, Korea's general privacy law.
- PIPC: Personal Information Protection Commission, the regulator.
- Fully automated decision: a decision made by a system, including AI, without meaningful human involvement.
- Enforcement Decree: the presidential decree that fills in details of an Act.
- Prior adequacy review: a PIPC process to check a new service's privacy safeguards before launch.
- UII: uniquely identifiable information, such as resident registration numbers.
Key takeaways
- Not AI-specific, but Art. 37-2 gives rights to refuse or get an explanation of significant fully automated decisions.
- Art. 37-2 effective 2024-03-15 per secondary sources; the official Korean statute text was not reachable for this card.
- PIPC's 2025 generative AI guidelines are the practical playbook for training data and safeguards.
- New AI development special provisions passed 2026-08-20 but are not yet in force.
Official sources
- PIPC: Announcing the Passage of Amendment to PIPA (2023-03-07), accessed 2026-10-19
- PIPC: Amended PIPA and its Enforcement Decree Become Effective (2023-09-15), accessed 2026-10-19
- PIPC: Personal Data Processing Criteria for Generative AI (2025-08-14), accessed 2026-10-19
- PIPC: PIPA Amendment Bill for AI Development Passed (2026-08-27), accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.