Legislative status: Passed the National Assembly on 20 August 2026. Awaiting promulgation. The amendment is enacted law. The six-month implementation period begins on the date of promulgation by the President. The effective date is therefore not yet fixed, but is expected in early-to-mid 2027. Organisations should begin compliance assessment now.
Intelligence record IR-000122 · Discovered 22 August 2026 · Source: PIPC official press release (SRC-0073) · Materiality: High · This article is the research output from that intelligence finding.
What changed
The four conditions for use
The amendment establishes four cumulative conditions that must all be satisfied before personal data can be used for AI development under this route:
Condition 1
Pseudonymous or anonymous data is insufficient
The AI development purpose cannot reasonably be achieved using pseudonymised or anonymised data alone. This is a necessity test: organisations must be able to demonstrate why non-personal data is technically inadequate for the intended training objective.
Condition 2
Public or social necessity recognised
The intended AI application must serve a recognised public or social necessity. This condition is likely to be assessed against PIPC guidance, which has not yet been published. Organisations developing consumer AI products will need to frame their use case in terms of recognised public benefit.
Condition 3
Strengthened safeguards apply
Strengthened data protection safeguards must be in place. The amendment does not specify these safeguards exhaustively — PIPC implementing guidance is expected to define the minimum standard. At minimum, technical and organisational controls preventing re-identification and misuse will be required.
Condition 4
PIPC review obtained
Prior review and approval from the Personal Information Protection Commission is required. This is a pre-authorisation step, not a post-hoc notification. The process for obtaining PIPC review — application form, timeline, required documentation — has not yet been specified; PIPC implementing regulations are pending.
Who is affected
What is still pending
Several critical implementation details have not yet been published as of this article’s publication date:
- Promulgation date — the six-month countdown begins on promulgation by the President. The effective date is not yet fixed.
- PIPC implementing regulations — the review and approval process, including application requirements, documentation standards, and timelines, has not been published.
- Definition of “public or social necessity” — PIPC guidance on what qualifies, and how this will be assessed in practice, is awaited.
- Safeguard specifications — what technical and organisational measures constitute the “strengthened safeguards” required by the amendment.
- Cross-border scope — whether and how the amendment applies to AI development by foreign entities processing South Korean personal data outside South Korea.
Context: South Korea’s AI data governance landscape
What organisations must do now
- Identify all AI training projects that use personal data of South Korean data subjects and assess the current legal basis for that use.
- Track promulgation: the six-month implementation clock begins at promulgation. Confirm the promulgation date through the PIPC website (SRC-0073) or official gazette.
- Monitor PIPC implementing guidance: the PIPC review process, safeguard specifications, and “public or social necessity” criteria have not yet been published. These are the operational parameters that determine whether and how the new route is accessible.
- If you operate a regulatory sandbox approval for AI training data use, confirm whether it remains valid after the amendment’s entry into force or whether transition to the new statutory route is required.
- Do not assume cross-border use of South Korean personal data is governed identically to Korean-domiciled use. Confirm the geographic scope of the amendment and PIPC jurisdiction with qualified local counsel.