Updated 2 November 2026: the law was promulgated on 8 September 2026 as Law No. 21910 and applies from 9 March 2027. The statute has three requirements, not four: public benefit and low risk form one. The Italian fine on OpenAI cited here as an example was annulled in March 2026. The list of provisions the Commission may disapply has been completed. Claims about "sovereign AI", bipartisan support and an unverified prior-review scheme have been withdrawn.

Correction (19 October 2026): This article originally described the amendment as awaiting a plenary vote, but the National Assembly passed it on 20 August 2026, so we have updated the text, including the transparency and objection points, to reflect the enacted provisions.

On 20 August 2026 South Korea's National Assembly passed an amendment to the Personal Information Protection Act (PIPA). It allows personal data lawfully collected for other purposes to be used for AI development without the individual's consent, but only after the Personal Information Protection Commission (PIPC) has deliberated and resolved on the specific project. The law was promulgated on 8 September 2026 and applies from 9 March 2027. No approval can yet have been given, and the implementing decree is still to come.

What does the amendment do?

It adds a new section, Articles 28-12 to 28-15, to Chapter III of PIPA. The National Assembly's record of the bill and a law-firm note on the text describe the same core, and the promulgation bill attached to the record (the text put to the Cabinet) confirms the wording. A controller may use lawfully collected personal data beyond its original purpose for developing AI, including improving performance, if three requirements are met and the PIPC resolves that they are.

  • Data. Given the nature of the information, such as video, audio, images, code or text, AI development would be difficult if the data were anonymised or pseudonymised.
  • Safeguards. The controller has put in place safeguards meeting standards to be set by Presidential Decree, including a secure processing environment or additional measures for settings such as a cloud environment.
  • Purpose and risk. The purpose is to promote the public interest, protect the interests of individuals or third parties, or promote social benefit, and the risk of unfairly harming those interests is manifestly low.

The rest of the section sets out the procedure.

  • Conditions and simplified review. The PIPC may attach conditions. It may also simplify review for projects substantially the same as one already reviewed (Article 28-12(2) and (4)).
  • Risk-factor assessment. Where criteria set by decree are met, for example because sensitive or unique identifying data is involved, the controller must submit an assessment before deliberation (Article 28-12(3)).
  • Transparency. The controller must state the purpose and type of use in its privacy policy. The PIPC must publish who applied, the main matters reviewed and a summary of the assessment (Article 28-12(5) and (6)).
  • Supervision. The PIPC checks compliance periodically and must restrict processing in five cases: approval obtained by false means, a requirement no longer met, a condition not met, no start within six months without good reason, or a purpose that has clearly become impossible (Articles 28-13 and 28-14).
  • Disapplied provisions. Under Article 28-15 the PIPC decides case by case which of a listed set of protections does not apply. The list, also set out in a later note by the same firm, covers Articles 18 to 20, 20-2, 23, 24, 24-2, 25, 25-2 and, for overseas outsourcing only, 28-8.

How did the bill become law?

The bill record (No. 2220246) gives the dates. The National Policy Committee adopted the consolidated bill on 14 May 2026, the Legislation and Judiciary Committee approved it with amendments on 29 July, and the plenary passed it on 20 August. It went to the government on 28 August and was promulgated on 8 September as Law No. 21910. The PIPC's release says the Act takes effect six months after promulgation, and the law-firm note gives 9 March 2027.

Why did Korea do this?

The official reasons are practical.

  • Data for AI. The bill's rationale cites national competitiveness and the need for data in areas of high public need, such as safety nets, disaster prevention and crime prevention.
  • Limits of existing tools. The PIPC says that reuse beyond the original purpose has required a lawful basis or separate consent, and that pseudonymised or anonymised data can pose practical problems for AI development.
  • The sandbox. The PIPC says regulatory sandboxes have allowed uses such as AI-based voice-phishing prevention and self-driving robots, but only as temporary approvals, and that a basis was needed in the general data protection statute.

The wider policy setting includes Korea's AI Basic Act, in force since 22 January 2026.

How does it fit with Korea's existing rules?

The amendment adds to rules already in place. Since 2020, PIPA has allowed pseudonymised data to be used without consent for statistics, scientific research and public-interest archiving. A 2023 revision added rights on automated decisions, which we cover in our guide. In July 2024 the PIPC issued a guideline on publicly available personal data for AI. A Korean law-firm commentary says it is not legally binding and rests mainly on legitimate interests.

The PIPC also enforces. It fined Meta in 2024 over sensitive data used for targeted advertising, and in 2025 it issued a corrective recommendation to DeepSeek, after the company had itself suspended new downloads in Korea.

What will the requirements mean in practice?

This depends on the decree and on the PIPC's first decisions. What follows is analysis of the text, not of practice.

  • Difficulty with less identifying data. The applicant must show why anonymised or pseudonymised data will not do. Statutory language pointing to video, audio and text suggests the concern is unstructured data, where removing identifiers can reduce usefulness. The PIPC will need technical capacity to test such claims.
  • Safeguards. The decree will set the standard. One open question is whether safeguards must reach the trained model, for instance to stop it repeating personal data.
  • Purpose. This is the most open element. The list includes "social benefit". A broad reading would admit much commercial development, and a narrow one would exclude it. The BKL note advises companies to link a project to public or social value rather than to mere efficiency.
  • Risk. "Manifestly low" is a high threshold, and it is one half of the same requirement as purpose. A strong public benefit does not by itself meet it.

What are the arguments for and against prior approval?

Under the GDPR, a controller relying on legitimate interests makes its own assessment and bears the risk if a regulator or court disagrees. Korea places the regulator at the start. In our reading, this has clear advantages: a defined legal basis, one authority applying one standard, and an independent check before data is used.

The risks are also real. Reviewing complex projects takes staff and time. A regulator may come under pressure where AI competitiveness is a national priority. Individual control gives way to an administrative judgement. And once data has shaped a model, removing its influence is technically difficult, so approval may be hard to reverse for the person concerned.

Civil society has made a sharper argument. The People's Solidarity for Participatory Democracy calls the law unconstitutional because it allows identifiable original data to be used without consent, and has asked for Article 28-12(1) and related provisions to be repealed. No court has ruled on this.

Is it constitutional?

That is unresolved. Korean constitutional law recognises a right to informational self-determination, which may be restricted proportionately. The Constitutional Court's February 2026 decision on immigration face data dismissed a complaint as inadmissible without reaching the merits, so it gives no direct answer. The requirements can be read as an attempt to build proportionality into the statute. No challenge to the new provisions was found as of 2 November 2026.

How do other systems compare?

  • European Union. The GDPR has no AI-specific exemption. Controllers can rely on legitimate interests under a three-step test, and EDPB Opinion 28/2024 explains how it applies to AI models. The Commission's Digital Omnibus proposal on data of November 2025 says that AI training can in principle rest on legitimate interests, but according to a law-firm note of September 2026 it had not been adopted. The EU AI Act does not in general supply a legal basis for processing personal data; its regulatory sandboxes are a narrow exception (Article 59).
  • Italy. The data protection authority fined OpenAI EUR 15 million in 2024, citing among other things the lack of a legal basis for training. A Rome court annulled the fine in March 2026 because the authority had lost competence, without ruling on the legal basis. The question remains open.

Compared with these, Korea's route is more permissive than a consent rule and more controlled than self-assessment. Our global AI law index gives a wider view.

What does it mean for Türkiye?

Turkish law has no equivalent route. Under Law No. 6698 (KVKK), a controller must find a basis in Article 5, or in Article 6 for special categories.

  • Legitimate interest. Article 5(2)(f) allows processing necessary for legitimate interests, provided it does not harm fundamental rights and freedoms. Its limits for AI training have not been tested in a decision we could find.
  • Purpose. Article 4 requires specific, explicit and legitimate purposes and proportionate processing, so reusing customer data for training raises an immediate question.
  • Article 28. It excludes processing anonymised through official statistics for research, planning and statistics. This is narrow and does not cover most commercial development.
  • Pseudonymisation. Unlike PIPA and the GDPR, the KVKK has no specific rule treating pseudonymised data more flexibly.
  • Special categories. Since the 2024 amendment, Article 6(3) has a closed list of grounds, with no general ground for research or AI.

We cover these points in training data: the KVKK and GDPR questions to settle first and in our guide to KVKK and AI governance. A similar route in Türkiye would need legislation.

What should companies note?

  • Timing. The route is not available before 9 March 2027 and depends on the decree and PIPC notices.
  • Purpose test. Commercial benefit alone is unlikely to be enough, on the text as it stands.
  • Evidence. Applicants will need a record of why less identifying data will not work and of the risks at training, memorisation and output stages.
  • Publicity. The applicant's identity and a summary of the assessment will be published.
  • Divergence. A Korean approval gives no legal basis under the GDPR or the KVKK. Global companies will need to track permissions by jurisdiction.

The Decree, the PIPC notices and the first decisions

The Presidential Decree and PIPC notices will set the safeguards, the assessment criteria and the procedure. The first decisions will show how "social benefit" is read and which provisions the PIPC disapplies. A constitutional challenge is also possible.

Frequently asked questions

Does Korea's amendment let any company train AI on personal data without consent?

No. Under PIPA Article 28-12 a project needs a resolution of the Personal Information Protection Commission and must meet three requirements: difficulty with anonymised or pseudonymised data, safeguards, and a qualifying purpose with manifestly low risk.

When does the PIPA amendment take effect?

Law No. 21910 was promulgated on 8 September 2026 and applies from 9 March 2027, six months after promulgation. Its operation depends on a Presidential Decree and PIPC notices, which were not final on 2 November 2026.

Does the PIPA amendment apply to sensitive data?

It can. Under Article 28-15 the PIPC may decide that the restrictions on sensitive data, unique identifiers and visual data do not apply to an approved project. Under Article 28-12(3), a risk-factor assessment may be required first.

Can individuals object under the PIPA amendment?

This is open. The Article 28-15 list covers notice duties in Articles 20 and 20-2 but does not name Article 37, the right to ask for processing to stop. How that right works once data has shaped a model is not settled.

How does the Korean route differ from legitimate interests under the GDPR?

Under the GDPR the controller assesses legitimate interests itself and bears the risk of error. Under PIPA Article 28-12 the Personal Information Protection Commission reviews the specific project in advance.

My view: honest about consent, but only as strong as the regulator

In my view, Korea's amendment answers a question openly that others leave unsettled. Consent cannot realistically be obtained from millions of people for every training project. Korea says plainly that some data may be used without consent and puts a public authority, bound by statutory conditions, in charge of deciding when. I find that more honest than pretending consent still governs everything.

The model is only as strong as the regulator. It works if the regulator is independent, technically capable, transparent and willing to say no. If approvals become a formality, a fundamental right becomes an administrative step. I think the requirement to show that less identifying data will not do is well chosen, and the "social benefit" test is too elastic. I would want each decision and its conditions published, and a real right for individuals to object and to know.

For Türkiye, I would not copy the Korean text. I think a prior-consultation or sandbox mechanism at the KVKK Authority, published criteria for legitimate-interest training and a pseudonymisation framework would be better first steps. They would give legal certainty without asking people to give up control of their data on trust alone.

Sources: National Assembly bill record No. 2220246 (via the National Legislation Participation Centre); PIPC press release of 20 August 2026 (unofficial English translation); the promulgation bill attached to that record; BKL Legal Updates of August and September 2026; Cheongchul commentary on the 2024 guideline; People's Solidarity for Participatory Democracy statement; Yulchon note on the 2024 guideline; EDPB Opinion 28/2024; Heuking note of 24 September 2026; Law No. 6698. All read on 2 November 2026. Article-level detail was checked against the promulgation bill; the consolidated text on law.go.kr could not be read. General information, not legal advice. The assessments are the author's own.