South Korea - AI Impact Assessment

Overview

The Personal Information Protection Commission (PIPC) adopted an amendment to the "Notice on Personal Information Impact Assessment (개인정보 영향평가에 관한 고시)" which took effect on 5 September 2025. The amendment creates two AI-specific subfields — "AI system learning and development" and "AI system operation and management" — and prescribes concrete evaluation items for public institutions using AI. The PIPC press announcement summarising the decision is available at PIPC press release (Korean) — 3 Sep 2025, and additional background and guidance materials (including the revised Impact Assessment Implementation Guide) are published on the Personal Information Portal at Privacy Portal — Impact Assessment materials.

Definitions

The amendment reuses and expands existing PIA terminology. Key definitions include: "AI system learning and development" (activities to collect, label, preprocess, store and use personal data for model training and testing); "AI system operation and management" (deployment, monitoring, update, user interaction and incident-handling for operational models); "training data retention policy" (documented retention and deletion rules for datasets used in AI development); "acceptable use policy (AUP)" (enumerated prohibited/allowed uses and foreseeable misuse for generative AI services); and "information subject safeguards" (mechanisms for reporting errors, requesting deletion, or contesting automated decisions). The notice continues to rely on thresholds and terminologies defined in the Personal Information Protection Act and prior PIPC guidance.

Governance and Institutional Framework

The amendment places new responsibilities on the governance structures of public institutions. Agencies must: designate accountable officers for AI data governance (often the existing Personal Information Protection Officer or a named AI data protection lead); document the split of responsibilities between model developers, third-party vendors and service operators; and ensure PIA-certified personnel or accredited assessment teams conduct the AI sections of impact assessments. The PIPC indicated it will update designation criteria for authorised evaluation bodies and expedite timelines for short-term corrective measures; see the PIPC announcement for planned procedural changes at PIPC - prior PIA authority update (Oct 2024/2025 discussion). The amendment also ties PIA performance to transparency obligations (summary publication) and to corrective timelines when remediation items are categorized as short-term.

Key Focus Areas

The AI-specific evaluation criteria concentrate on several areas: (1) Legal basis and purpose limitation — confirming that AI training and inference processing have valid legal grounds under Korean law; (2) Data minimisation and sensitivity — ensuring that sensitive personal information and data on children under 14 are not present in training sets unless strictly necessary and authorised; (3) Training-data lifecycle management — requiring explicit retention, access-control and secure deletion rules for datasets used for model training and evaluation; (4) Model testing and safety — requiring pre-deployment safety testing for leakage, privacy attacks, bias and harmful outputs, together with test documentation and performance metrics; (5) Operation & management responsibilities — explicit contractual and operational liability delineation between developers, vendors and agency operators; (6) User-facing safeguards — acceptable use policies (AUPs), explicit user notices for AI-driven services, and reporting/appeals channels for problematic outputs; (7) Incident management — plan for detection, notification and remediation of privacy incidents arising from AI outputs; and (8) Monitoring and drift detection — post-deployment monitoring to detect data or concept drift and to re-run safety evaluations when model inputs or outputs materially change. These items reflect the PIPC's objective to integrate privacy-by-design throughout the AI lifecycle.

Implementation Framework

Public institutions that meet statutory thresholds (e.g., processing of sensitive or unique-identifier personal data for 50,000+ individuals, linkage involving 500,000+, or 1,000,000+ total personal data entries) must: incorporate the AI subfields into their standard PIA checklist; prepare a PIA report with AI-specific sections (learning/development and operation/management); submit required summaries and full assessments to the PIPC where applicable; appoint qualified evaluators (in accordance with the PIPC's rules for certified impact-assessment practitioners); and implement remediation measures following the prioritisation indicated in the PIA. The PIPC announced that an updated "Impact Assessment Implementation Guide" and case examples will be published to assist agencies in operationalising the new items — see the Privacy Portal listing for the guide at Privacy Portal — guide files.

Monitoring and Evaluation

The PIPC expects agencies to conduct ongoing monitoring for AI-driven systems and to report significant PIA findings or incidents. Monitoring includes scheduled re-assessments when training data or model architectures change materially, continuous logging and audit trails of model inputs/outputs for forensic purposes, and metrics for fairness, accuracy and privacy leakage. The PIPC also indicated that summary publication performance will be considered in future public-sector privacy-level assessments and audits. Where remediation items are identified, agencies must meet tightened timelines for short-term measures and submit implementation evidence to the PIPC as specified in the notice and the related guidance.

Penalties, Liability, and Appeals

The amendment does not create a new punitive regime but clarifies obligations that tie into existing enforcement tools under the Personal Information Protection Act and subordinate rules. Failure to perform a required impact assessment or to submit results can trigger administrative fines and corrective orders (the PIPC has referenced administrative penalties up to KRW 30,000,000 in past enforcement notices for failure to perform or submit required impact assessments under statutory authority). Agencies may also be subject to further administrative sanctions, mandatory remediation orders and public disclosure of non-compliance. The notice also emphasises the need to record remedial steps and maintain documentation for potential appeals or dispute resolution.

Relationship to Other Instruments

The AI-specific PIA criteria are explicitly linked to the Personal Information Protection Act, the PIPC's "Impact Assessment Implementation Guide" and other PIPC guidance documents (for example, guidance on processing publicly available data for AI). The amendment complements the PIPC's earlier guidance on pseudonymisation, automated decision-making and safety measures, and is intended to be used together with technical security standards (e.g., ISMS-P) and sector-specific rules. Cross-references to other PIPC materials and the Personal Information Portal ensure that PIAs remain harmonised with wider privacy obligations and technical controls.

International Alignment

The PIPC framed the amendment to reflect international best practices: it mirrors the concept of DPIA/FRIA for risky AI systems that appears in the EU AI Act and other jurisdictions' emerging AI governance approaches. The criteria on testing, minimisation, transparency and remedial channels aim to facilitate interoperability with international standards and cross-border cooperation. The PIPC's public materials emphasise participation in international forums (e.g., GPA) and coordination with other DPAs to align surveillance, enforcement and guidance practices; see the PIPC English portal for international engagement details at PIPC English site.

Implementation Timeline

Sources and References