What happened
On August 20, 2026, South Korea's National Assembly passed, in plenary session, an amendment to the Personal Information Protection Act (PIPA) creating a special legal basis allowing lawfully collected personal information to be used for AI development/training — even without consent — when AI development is not feasible using only pseudonymized or anonymized data and public-interest/social necessity is recognized, subject to enhanced safety measures and case-by-case deliberation/resolution by the Personal Information Protection Commission (PIPC). This follows the bill's approval by the National Assembly's Political Affairs Committee earlier (mid-May/mid-August 2026) and is now an enacted statutory amendment awaiting promulgation.
Why it matters
This is a binding statutory change (not just guidance) that materially expands the lawful basis for using personal data in AI training in a major economy, diverging from stricter EU-style consent regimes and creating a new compliance pathway that AI developers operating in or training on Korean data must navigate, including new PIPC deliberation/approval requirements and enhanced safety-measure obligations.
Action needed
AI developers/deployers using or considering Korean personal data for model training should track the PIPC's implementing guidance/deliberation criteria and prepare enhanced safety-measure documentation and PIPC engagement processes ahead of the provision entering into force.