Original Personal Data Can Be Used for Public Interest AI Development..."Strengthening Industry Competitiveness"

Personal Information Protection Act Amendment Passes National Assembly Plenary Session
Use Requires Enhanced Safeguards and Commission Approval

It will now be possible to use original personal information for the development of artificial intelligence (AI) technologies with public or social purposes.

Song Kyunghee, Chairperson of the Personal Information Protection Commission, is speaking at the full meeting of the Personal Information Protection Commission held on July 29, 2026, at the Government Complex Seoul in Jongno-gu, Seoul. Photo by Jo Yongjun

The Personal Information Protection Commission announced that the amendment to the Personal Information Protection Act, which includes special provisions for the use of personal information in AI technology development, passed the National Assembly’s plenary session on August 20.

There has been a growing demand from the field for swift and extensive access to high-quality training data to strengthen the competitiveness of the AI industry. However, under the current law, even when personal information has been lawfully collected through the data subject’s consent or contract, separate consent or a legal basis is required to use it for other purposes. Additionally, personal information must be used in the form of pseudonymized or anonymized data, which creates challenges in AI development. Regulatory sandboxes applied to certain innovative services, such as AI-powered voice phishing prevention and autonomous robot development, are also temporary, limited to two years by default and up to four years at maximum.

In response, the amendment introduces a special provision: even if only pseudonymized or anonymized information is insufficient for AI development, or if there is recognized public or social necessity, personal information—lawfully collected on a separate legal basis—may be used for AI technology development under strengthened safety measures and after review and resolution by the commission.

Measures have also been put in place to minimize concerns regarding personal information infringement. Specifically, if sensitive or unique identifying information is processed, or if there is a significant impact on the rights or interests of data subjects, a prior risk assessment and improvement plan must be established. Companies and institutions applying this special provision must disclose key details through their personal information processing policies, and the commission must publish information on the operation of AI special provisions on its website.

However, to improve the effectiveness of this special provision, the commission has decided to streamline review procedures for AI technologies or services that are essentially identical or similar to those that have already undergone review and resolution. Following deliberation and approval by the Cabinet, the amendment will take effect six months after promulgation.

Song Kyunghee, Chairperson of the Personal Information Protection Commission, stated, “This special provision is meaningful because it rationally broadens the opportunity to utilize personal information in an era where the advancement of AI is tantamount to national competitiveness, while establishing a corresponding management and oversight system together with businesses.” She further added, “We will continue to strive to build an institutional foundation that both protects citizens’ personal information and promotes innovation in AI technology.”

This content was produced with the assistance of AI translation services.