South Korea - Personal Data Protection (19234/2023)

Overview

The March 14, 2023 amendment to the Personal Information Protection Act (PIPA) modernises South Korea's core privacy law to address large-scale data processing and AI-driven automated decision-making. The amendment (Act No. 19234) and its implementing measures (notably the Enforcement Decree and PIPC guidance) create new data-subject rights—including the right to refuse fully automated decisions, and to request explanations or human review—and expand data portability and transparency requirements. The law also ramps up organisational responsibilities (CPO qualification, internal management plans, mandatory security measures) while delegating technical detail and operational rules to the Enforcement Decree and regulatory guidance. Official texts are available from the Korean Law Information Center and the government's privacy portal (see PERSONAL INFORMATION PROTECTION ACT (KLRI)) and implementing decrees at the national law portal (Enforcement Decree (law.go.kr)).

Definitions

PIPA defines key terms relevant to automated decision-making and AI: "personal information" (identifiable natural person data), "sensitive information" (민감정보), "processing" (collection, use, provision, etc.), and for the first time the framework recognises "automated decision" or "fully automated process" meaning a decision that affects a data subject's rights or obligations made by a system operating without substantive human intervention. The Enforcement Decree and PIPC guidance provide interpretive detail about what constitutes 'significant impact,' the scope of automated decision-making, and the boundary between automated and human-in-the-loop systems.

Governance and Institutional Framework

The PIPC remains the principal regulator responsible for supervision, guidance, and enforcement; it has been given expanded powers to assess privacy-management levels of public institutions and large private controllers, and to publish sectoral guidance. Controllers meeting size or processing thresholds must designate a Chief Privacy Officer (CPO) who satisfies qualification criteria; transitional provisions allow a grace period for certain entities to meet the enhanced CPO qualification rules. The government’s privacy portal hosts PIPC guidance documents including the July 2024 "Guideline for Processing Publicly Available Personal Information for AI Development" (see PIPC AI/Public Data Guidance (privacy.go.kr)), and the Enforcement Decree (Presidential Decree No. 34309) sets procedural and threshold rules for implementation.

Key Focus Areas

Automated decision-making: data subjects may request explanations or human review and may refuse fully automated decisions that significantly affect rights/obligations. Controllers must inform subjects when automated decisions will occur and publish decision criteria and processing procedures in accessible formats. Data portability: subjects can request transmission of their data to themselves or third parties; the Decree defines the methods, formats, permissible exceptions and refusal grounds. De-identification & pseudonymization: the amendment strengthens provisions enabling lawful use of de-identified or pseudonymized data for research and AI training while emphasizing technical safeguards and risk assessment. Cross-border transfers & transparency: controllers must disclose the legal basis for overseas transfers and the destination countries. Accountability & security: enhanced internal management plans, privacy impact assessments, access controls, and logging are required for entities processing significant volumes of personal or sensitive information.

Implementation Framework

Implementation is staged and partly delegated: many amendment provisions were effective on 15 September 2023, while the provisions on automated decision-making, data portability and certain technical/delegated matters became effective on 15 March 2024 with enactment of the Enforcement Decree (see KLRI e-book record). The Enforcement Decree establishes numeric thresholds (e.g., daily averages of subject counts), methods for notification, procedures for refusal/review requests related to automated decisions, and transitional measures for CPO qualification. The PIPC has issued practical guidance and templates to support compliance and to interpret delegated rules.

Monitoring and Evaluation

The PIPC is authorised to conduct privacy-level assessments for public institutions and large controllers, to require corrective measures, and to publish guidance and assessment outcomes. The law and Decree mandate recordkeeping and periodic internal reviews; PIPC guidance recommends privacy impact assessments (PIAs) and risk-model frameworks for AI projects and suggests periodic re-evaluation of deployed models to monitor accuracy, bias, and security risks such as model inversion or data leakage.

Penalties, Liability, and Appeals

The amended PIPA strengthens administrative enforcement and emphasizes corrective powers, administrative fines, and remedial orders for violations; it also clarifies liability for misuse of personal data in automated decision contexts. The regime focuses on proportionate administrative penalties and remediation, though criminal sanctions may remain for specific offences. Affected entities retain rights of appeal against administrative orders to administrative courts; the PIPC’s procedural rules and the Enforcement Decree set detailed timelines and remedy mechanisms.

Relationship to Other Instruments

PIPA interacts with sectoral laws (e.g., Act on Promotion of Information and Communications Network Utilization, Medical Services Act, Financial sector AI guidance) and international rules. The PIPC’s AI-specific guidance and industry-specific regulators’ rules (e.g., Financial Services Commission guidance) operationalise sectoral expectations. The amendment anticipates future related legislation such as South Korea’s AI Basic Act and complements standards for data protection and model safety.

International Alignment

South Korea’s amendments borrow concepts similar to other modern privacy regimes—data portability and protections against fully automated decisions comparable to the EU's GDPR—while tailoring rules to local administrative structures and innovation policy. PIPC guidance explicitly references international good practices and seeks interoperability for cross-border data flows, while establishing South Korea-specific thresholds and administrative procedures to govern foreign entities targeting Korean data subjects (see PIPC materials on foreign controllers).

Implementation Timeline

Sources and References