South Korea — AI Regulations

03 APR 2026 · Other

2024 Personal Information Processing Policy Evaluation Plan

On 4 March 2026, the Personal Information Protection Commission (PIPC) issued recommendations following discussions with generative AI companies on improving personal information handling policies to increase transparency in Artificial Intelligence (AI) data processing. The discussions addressed the personal information processing policy evaluation system, which examines whether companies clearly disclose the categories of personal data they handle, the legal basis for such processing, retent...

National Strategypipc.go.kr ↗

03 APR 2026 · Law / Act

South Korea updates AI Basic Act implementation decrees for public sector AI deployment

The Korean government issued updated implementation decrees for the AI Basic Act, specifying requirements for AI systems deployed in public administration including bias audits, transparency reports, and mandatory human oversight mechanisms for automated government decision-making.

✓ ✓ OfficialNational Strategy ·Transparency ·Accountabilitylaw.go.kr ↗

31 MAR 2026 · Other

Revised guidelines on processing of pseudonymised information

On 31 March 2026, the Personal Information Protection Commission (PIPC) adopted revised guidelines on the processing of pseudonymised information. The guidelines apply to all organisations processing pseudonymised personal data, including Artificial Intelligence (AI) providers. The revision introduces a standardised, risk-based framework under which internal data use is classified as low risk, while provision to third parties is classified as medium or high risk depending on the degree of env...

✓ ✓ OfficialNational Strategypipc.go.kr ↗

20 MAR 2026 · Law / Act

Bill amending Network Act including incident response obligations and enforcement measures (Bill No. 2214896)

On 20 March 2026, the Bill amending the Network Act, including incident response obligations and enforcement measures, was adopted by the National Assembly. The Bill includes provisions on incident response and enforcement. It applies to information and communications service providers, including major providers and colocation facility operators. The Bill introduces obligations to designate a Chief Information Security Officer, establish an Information Security Committee, and undergo annual g...

✓ ✓ OfficialNational Strategyopinion.lawmaking.go.kr ↗

18 MAR 2026 · Other

Guidance on security for 5G specialised networks

On 18 March 2026, the Internet and Security Agency adopted the guidance on security for 5G specialised networks. The guidance seeks to support the secure deployment and operation of specialised 5G networks used by businesses and institutions. The guidelines apply to network builders, operators, and equipment developers. It outlines security risks and corresponding mitigation measures across the network lifecycle, including practical tools such as security checklists.

✓ ✓ OfficialNational Strategykisa.or.kr ↗

03 MAR 2026 · Other

Media and Communication Commission's casebook on violations under Location Information Act

On 3 March 2026, the Korea Communications Commission and the Korea Internet & Security Agency published a casebook compiling violations identified during inspections of location information service providers under the Act on the Protection and Use of Location Information. The publication categorises these violations into four areas. This includes failing to complete the necessary registration or reporting procedures when changes occur, such as a change of company name or address, suspension o...

✓ ✓ OfficialNational Strategykmcc.go.kr ↗

27 FEB 2026 · Law / Act

Bill amending Information and Communications Network Act to establish an expedited response mechanism for illegal online content (No. 2217175)

On 27 February 2026, the Bill amending the Information and Communications Network Act was introduced to the National Assembly. The Bill applies to information and communications service providers and bulletin board operators hosting user-generated content. The Bill would insert a new paragraph in Article 44-7 to establish an expedited response mechanism for certain categories of manifestly illegal information that seriously infringe legal interests, including narcotics, gambling, illegal film...

Content Moderationlikms.assembly.go.kr ↗

27 FEB 2026 · Other

Assessment of Google's request to transfer high-precision national maps overseas

On 27 February 2026, the Inter-Agency Consultative Body on Overseas Transfer of Survey Results approved Google’s application to export 1:5,000 scale map data under the Spatial Information Management Act, subject to security conditions. The approval applies to digital mapping services and permits export only of limited, non-sensitive navigation data following government review and domestic processing on Korean servers operated by a local partner. Google is required to implement image security ...

✓ ✓ OfficialNational Strategykorea.kr ↗

27 FEB 2026 · Law / Act

Bill amending Information and Communications Network Act to introduce security assessments for Internet of Things devices (No. 2217144)

On 27 February 2026, the Bill amending the Information and Communications Network Act to introduce security assessments for Internet of Things (IoT) devices was introduced to the National Assembly. The Bill applies to manufacturers and suppliers of network-connected devices that collect, process, and transmit data. Under the proposed amendment, the Minister of Science and ICT may conduct security investigations of such devices where deemed necessary for the stability of information and commun...

National Strategylikms.assembly.go.kr ↗

26 FEB 2026 · Executive Order

Measures to address fake news and misuse of artificial intelligence pertaining to elections

On 26 February 2026, the government of South Korea announced measures following an inter-ministerial meeting to strengthen the government's response to fake news and the misuse of artificial intelligence (AI), particularly ahead of the June 2026 local elections. The measures apply to online information activities, including the creation and dissemination of AI-generated content and false information on digital platforms. The government announced a coordinated response involving several minist...

Content Moderationkmcc.go.kr ↗

26 FEB 2026 · Law / Act

Content moderation regulation in Amendment to Information and Communications Network Act to address overseas-based manipulation of online public opinion (Bill No. 2217090)

On 26 February 2026, a Bill amending the Information and Communications Network Act to address overseas-based manipulation of online public opinion was introduced to the National Assembly. The Bill applies to information and communications service providers that meet criteria to be specified by Presidential Decree, including thresholds based on average daily users, revenue, and business type. It requires covered providers to adopt technical and managerial measures to prevent abnormal use of t...

Content Moderationlikms.assembly.go.kr ↗

19 FEB 2026 · Executive Order

Digital Forensic Support and Evidence Storage and Management Regulation

On 19 February 2026, the Personal Information Protection Commission closes the consultation on the draft digital forensic support and evidence storage and management regulation. The draft regulation sets out definitions, principles, and procedures for digital forensic support under the Personal Information Protection Act. It covers digital evidence collection, analysis, storage, management, and destruction. The regulation also specifies requirements for maintaining integrity and continuity, p...

National Strategypipc.go.kr ↗

19 FEB 2026 · Law / Act

Expedited content takedown procedures for illegal information in amendment to Act on the Establishment and Operation of the Broadcasting and Media Communications Commission (Law No. 21379/Bill No. 14862)

On 19 February 2026, the Partial Amendment to the Act on the Establishment and Operation of the Broadcasting and Media Communications Commission (Law No. 21379) entered into force upon promulgation. The Law applies to online platform services, streaming services, messaging services, and search services providing content to domestic users in South Korea and subject to oversight by the Broadcasting and Media Communications Review Committee. The Law expands the written resolution procedure of th...

✓ ✓ OfficialContent Moderationlikms.assembly.go.kr ↗

29 JAN 2026 · Other

Guideline on standards and examples for high-impact AI under Article 33 of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation (AI Basic Act)

On 29 January 2026, the Ministry of Science and ICT adopted the revised high-impact AI decision guidelines, building on the version released on 22 January 2026 following the entry into force of the Artificial Intelligence Basic Act. The guidelines specify the legal and technical criteria for determining whether an artificial intelligence system constitutes high-impact artificial intelligence under Article 33 of the Act. They establish a structured, two-stage determination methodology that fir...

✓ ✓ OfficialNational Strategynia.or.kr ↗

23 JAN 2026 · Executive Order

Media and Communication Commission and Ministry of Gender Equality and Family business agreement to realise a safe digital society

On 23 January 2026, the Korea Media and Communications Committee and the Ministry of Gender Equality and Family signed a business agreement to combat digital sex crimes and strengthen youth protection within digital services by establishing a standing cooperation framework. The agreement targets information and communications service providers, as well as other digital intermediaries, who are involved in the distribution of illegal recordings, AI-generated deepfake sexual abuse material, harm...

✓ ✓ OfficialContent Moderationkmcc.go.kr ↗

22 JAN 2026 · Executive Order

Artificial Intelligence authority governance in Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and Creation of a Trust Base (Presidential Decree No. 36053)

On 22 January 2026, the Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and Creation of a Trust Base (Presidential Decree No. 36053) entered into force. The Enforcement Decree repeals the Regulations on the Establishment and Operation of the National Artificial Intelligence Strategy Committee pursuant to Supplementary Provisions Article 2. The Enforcement Decree establishes transitional governance arrangements pursuant to Supplementary Provisions Article ...

✓ ✓ OfficialNational Strategylaw.go.kr ↗

22 JAN 2026 · Other

Guideline on Obligations of High-Impact Artificial Intelligence Providers (Article 34 of the Framework Act on the Advancement of Artificial Intelligence and Creation of a Trust Foundation)

On 22 January 2026, the Ministry of Science and ICT released the high-impact artificial intelligence (AI) operator obligations guidelines to support the implementation of Article 34 of the Artificial Intelligence Basic Act. The guidelines elaborate on the statutory responsibilities of operators that provide or use high-impact artificial intelligence products or services. They specify obligations relating to the establishment and operation of risk management measures, explanations of artificia...

✓ ✓ OfficialNational Strategynia.or.kr ↗

22 JAN 2026 · Law / Act

Design requirements in Bill on Development of Artificial Intelligence and Establishment of Trust-Based Foundations (Bill no. DD20131)

On 22 January 2026, the Bill on Development of Artificial Intelligence and Establishment of Trust-Based Foundations (Bill no. DD20131) enters into force. The Bill guides the ethical and responsible development and use of artificial intelligence (AI) technologies and incorporates 19 Bills for establishing rules for AI. The Bill defines the term "high-impact artificial intelligence" as an artificial intelligence system that may affect or cause danger to human life, physical safety, and fundamen...

✓ ✓ OfficialNational Strategylaw.go.kr ↗

21 JAN 2026 · Executive Order

Design requirements in Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation

On 21 January 2026, the President signed the Enforcement Decree of the Framework Act on the Development of Artificial Intelligence and Creation of a Trust Base (Presidential Decree No. 36053). The Enforcement Decree, as promulgated, does not include elements announced during the drafting stage on 15 January 2025 concerning the establishment of a primary subordinate legislative framework to operationalise national governance measures, industrial development measures, risk prevention mechanisms...

National Strategylaw.go.kr ↗

20 JAN 2026 · Other

Guidance on telecommunications-related Laws for user protection relating to AI service providers

On 20 January 2026, the Broadcasting and Media Communications Commission (KMCC) published the legal guidance on telecommunications-related Laws for user protection relating to AI service providers, following a review of how existing telecommunications statutes apply to artificial intelligence services provided via information networks. The guidance analyses user-protection provisions under the Telecommunications Business Act and the Information and Communications Network Act, noting that AI s...

✓ ✓ OfficialConsumer Protectionkmcc.go.kr ↗

20 JAN 2026 · Law / Act

South Korea AI Basic Act - Effective January 2026

South Korea's AI Basic Act established a framework for "high-impact AI" akin to the EU's high-risk AI category, creating a national AI governance framework with sector-specific risk management requirements. The act balances innovation with safety and accountability.

✓ ✓ OfficialNational AI Law ·High-Impact AI ·Risk Frameworklaw.asia ↗

14 JAN 2026 · Other

Media and Communications Commission investigation into X over alleged failure to implement youth protection measures for Grok service

On 14 January 2026, the Media and Communications Commission issued an interim ruling in its investigation of X (formerly Twitter), requiring X establish safety measures to protect youth from harmful content on its Grok artificial intelligence (AI) service. The Commission also notified X to develop a protection plan to block harmful information and report the results. The action follows concerns regarding the spread of non-consensual sexual images and exploitative material through social media...

Content Moderationkmcc.go.kr ↗

13 JAN 2026 · Court Case

Case No. 2025가단214167

Pro Se Litigant appeared before the S.D. Seoul. Fabricated: Case Law

Court: S.D. SeoulParty: Pro Se Litigant

✓ ✓ OfficialJudicial & Law Enforcement ·Generative AI ·Liability & Accountability↗ Link available ↗

06 JAN 2026 · Court Case

Case No. 2025가단10169

Pro Se Litigant used ChatGPT in proceedings before the D. Daegu. Outcome: Warning.

Court: D. DaeguParty: Pro Se LitigantTool: ChatGPT

✓ ✓ OfficialJudicial & Law Enforcement ·Generative AI ·Liability & Accountability↗ Link available ↗

24 DEC 2025 · Other

Personal Information Protection Commission investigation into Shinhan Card over alleged unlawful sharing of merchant personal data

On 24 December 2025, the Personal Information Protection Commission (PIPC) announced an investigation into Shinhan Card following a public interest whistleblower report. The report alleged that Shinhan Card unlawfully shared merchant personal data, including merchant names, owner names, and mobile numbers from newly installed terminal information, with card recruiters between March 2022 and May 2025. The investigation aims to assess the cause, scope, and types of data leaked, and to determine...

National Strategypipc.go.kr ↗

23 DEC 2025 · Executive Order

Personal data incident prevention and investigation capacity expansion in revised Enforcement Decree and Enforcement Rules of the Personal Information Protection Commission

On 23 December 2025, the Personal Information Protection Commission (PIPC) announced that the Cabinet approved revisions to the Enforcement Decree and Enforcement Rules governing the organisational structure of the PIPC. The revisions establish a Prevention and Coordination Officer and a Preliminary Inspection Division responsible for conducting prior inspections of personal data processing and identifying personal data risks before incidents occur. The revisions expand investigation and disp...

✓ ✓ OfficialNational Strategypipc.go.kr ↗

22 DEC 2025 · Executive Order

Ministry of Science and Information and Communication Technology closes consultation on Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation including AI authority governance

On 22 December 2025, the Ministry of Science and Information and Communication Technology closes the public consultation on the Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation, which had been open since 12 November 2025 to gather opinions on governance provisions included in the draft Enforcement Decree. The consulted draft contained governance arrangements specifying the designation and operation of an artificial intelligence s

✓ ✓ OfficialGenerative AIlaw.go.kr ↗

19 DEC 2025 · Executive Order

Partial amendment to the Enforcement Rule of the Organisation of the Personal Information Protection Commission

On 19 December 2025, the Personal Information Protection Commission (PIPC) closes the public consultation on the Partial Amendment to the Enforcement Rule of the Organisation of the PIPC, which had been open since 16 December 2025. The consultation concerns a draft amendment intended to reflect the revision of the Organisation of the PIPC. The draft provides for the establishment of a Preventive Coordination Officer and a new division within the Investigation and Coordination Bureau, the incr...

National Strategypipc.go.kr ↗

09 DEC 2025 · Other

Personal Information Protection Commission investigation into local ordinances over personal information infringement factors

On 12 September 2025, the Personal Information Protection Commission (PIPC) announced that it is cooperating with Jeollanam-do and Sejong Special Self-Governing City to review a total of 1'793 ordinances (985 in Jeollanam-do and 808 in Sejong) in order to identify and address personal information infringement factors not subject to the assessment scope under the Personal Information Protection Act. Of these, 263 ordinances (115 in Jeollanam-do and 148 in Sejong) involved the processing of per...

National Strategypipc.go.kr ↗

03 DEC 2025 · Executive Order

PIPC Amendment to the Enforcement Decree of the Personal Information Protection Act for MyData Promotion

On 12 March 2025, the Personal Information Protection Commission (PIPC) announced the full implementation of South Korea's MyData system, following its introduction through an amendment to the Personal Information Protection Act in March 2023. The MyData system grants individuals the right to request the transfer of their personal data from holders to themselves or third-party service providers. The system initially applies to the medical, communications, and energy sectors, with a phased exp...

✓ ✓ OfficialNational Strategypipc.go.kr ↗

03 DEC 2025 · Other

Personal Information Protection Commission investigation into Kakao Corp.'s artificial intelligence service Kanana

On 12 March 2025, the Personal Information Protection Commission (PIPC) issued an assessment of Kakao Corp.'s artificial intelligence service, "Kanana," following an investigation into its implementation. The assessment reviewed the service’s compliance with data protection regulations, focusing on safety measures, data processing protocols, and internal management systems. Kakao Corp. seeks to prevent personal data breaches through its proprietary AI model and collaboration with OpenAI, aimi...

✓ ✓ OfficialNational Strategypipc.go.kr ↗

02 DEC 2025 · Other

Personal Information Protection Commission investigation into Sectanaine Ltd. over alleged data breach from credential stuffing attack

On 12 February 2025, the Personal Information Protection Commission issued a ruling against Sectanine Ltd. with a penalty of KRW 14.77 billion and a fine of KRW 7.2 million for violations of personal data protection laws. The ruling applies to two data breaches in 2022 and 2023, affecting over 17,000 individuals. Sectanine is a computer system design company that operates the 'Happy Point' membership service, which was the platform affected by the data breaches. The personal data of users who...

✓ ✓ OfficialNational Strategypipc.go.kr ↗

27 NOV 2025 · Other

Personal Information Protection Committee investigation into DeepSeek's data processing practices compliance with Personal Information Protection Act

On 27 November 2025, the Personal Information Protection Commission (PIPC) issued an investigation finding during the final review of the 2025 Proactive Administration Best Case Competition. The finding concerned the personal information processing practices of the Chinese generative AI service DeepSeek. The PIPC noted that, immediately after DeepSeek’s launch in January 2025 and amid wider global attention to personal information risks, it established direct contact with the company’s headqu...

✓ ✓ OfficialNational Strategypipc.go.kr ↗

27 NOV 2025 · Policy / Guidance

Government released Regulatory Rationalisation Roadmap for the AI Sector

On 27 November 2025, the Government released the Regulatory Rationalisation Roadmap for the AI Sector. The document outlines a cross-government plan involving 25 ministries and 67 regulatory-improvement tasks covering technology development, service use, infrastructure, and trust-and-safety measures. It identifies a wide range of regulatory barriers, including issues related to AI training data, the application of copyright and industrial-property rights, the use of synthetic data, pseudonymisat

✓ ✓ OfficialGenerative AIpipc.go.kr ↗

27 NOV 2025 · Working Paper

Personal Information Protection Commission issued investigation finding on DeepSeek over personal information processing practices, including voluntary suspension and corrective implementation

✓ ✓ OfficialData Privacy & Protectionpipc.go.kr ↗

13 NOV 2025 · Other

Cross-border data transfer regulation in United States-Republic of Korea Joint Fact Sheet

On 13 November 2025, the United States and the Republic of Korea (ROK) issued a Joint Fact Sheet following a meeting between their respective presidents, including a range of reciprocal trade commitments, such as facilitating the cross-border transfer of data including location, reinsurance, and personal data. Further, the two parties aim to ensure that companies do not face unnecessary barriers or discrimination regarding laws and policies for digital services, such as network usage fees and...

National Strategywhitehouse.gov ↗

12 NOV 2025 · Executive Order

Ministry of Science and Information and Communication Technology opened consultation on Enforcement Decree of Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation including AI authority governance

On 12 November 2025, the Ministry of Science and Information and Communication Technology opened the public consultation on the Enforcement Decree of the Framework Act on Development of Artificial Intelligence and Establishment of Trust Foundation until 22 December 2025 to collect opinions on governance provisions in the draft Enforcement Decree. The draft specifies designation and operation of institutions supporting artificial intelligence policy and safety, including the artificial intelligen

✓ ✓ OfficialGenerative AIlaw.go.kr ↗

07 NOV 2025 · Other

Personal Information Protection Commission's integrated guide on personal data processing

On 11 July 2025, the Personal Information Protection Commission (PIPC) released the integrated guide on personal data processing. The guide consolidates and replaces previous guidance documents, including the “Plain-Language Consent Guide”, the “Outsourcing Guide”, the “Personal Data Protection Measures Guide”, and the “Automated Processing Protection Guidelines”. It systematises amendments introduced by the 2023 full revision of the Personal Information Protection Act (PIPA), incorporating p...

✓ ✓ OfficialNational Strategypipc.go.kr ↗

06 NOV 2025 · Other

Personal Information Protection Commission investigation into Yes24's compliance with Personal Information Protection Act following personal data breach

On 11 June 2025, the Personal Information Protection Commission (PIPC) of the Republic of Korea announced an investigation into a personal data breach at Yes24 Co. The data breach followed a ransomware attack detected on 9 June 2025, prompting the company to file a data breach notification on the morning of 11 June. The investigation aims to determine the circumstances and scale of the data breach at Yes24 and assess the company's compliance with security measures stipulated under the Persona...

National Strategypipc.go.kr ↗

06 NOV 2025 · Other

Personal Information Protection Commission investigation into Salesforce over potential personal data protection vulnerabilities

On 11 June 2025, the Personal Information Protection Commission (PIPC) announced a fact-finding procedure regarding potential personal data protection vulnerabilities associated with Salesforce. The PIPC commenced verification of related system security and personal data protection measures following recent reports of attempted personal data acquisition targeting Korean companies using Salesforce solutions, including incidents involving voice phishing and malware installation allegedly impers...

National Strategypipc.go.kr ↗