What changed —
and why it matters.

South Korea’s National Assembly passed an amendment to the Personal Information Protection Act on 20 August 2026 creating a dedicated statutory route to use lawfully collected personal data for AI development. The amendment applies when pseudonymous or anonymous data is insufficient, public or social necessity is recognised, strengthened safeguards apply, and PIPC review is obtained.

The amendment still requires Cabinet consideration and promulgation; a six-month commencement period follows. Exact effective date is pending. Source: PIPC press release (IR-000122, SRC-0073).

• 01
  First dedicated AI training data route in South Korea. Previously, developers relied on time-limited regulatory sandbox exceptions. A permanent statutory pathway changes the compliance calculation for AI data pipelines operating in or exporting to the Korean market.
• 02
  PIPC approval is required, not self-declaration. The amendment requires PIPC review and resolution before use — not a simple notification regime. This creates a structured gating process that will slow time-to-training but gives legal certainty.
• 03
  Watch the subordinate legislation. The amendment sets the framework; the operational requirements (approval criteria, safeguards, risk assessment thresholds) will be in implementation rules and PIPC guidance issued after promulgation. Those rules are what compliance teams need to act on.