SOUTH KOREA LAW AND PRACTICE Contributed by: Tehyok Daniel Yi, Gun Kim, Kyu Hyun Kim, Sun Hee Kim, Yong Whan Choi, Yong Min Lee, Jung Woo Lee and Hyeon Jeong, Yulchon LLC
Extraterritorial Scope of the PIPA In April 2024, the PIPC issued the Guideline on For - eign Companies’ Compliance, clarifying that service providers actively and significantly targeting Korean users demonstrated by factors such as a Korean-lan - guage website or a sizeable Korean user base (estab - lishing a nexus to the Korean market) are subject to the PIPA and must comply with its consent and other regulatory requirements. Under the PIPA, offshore data controllers lacking a business presence in Korea must also appoint a local representative for data compliance and regula - tory oversight purposes if they meet any of several thresholds of scale in revenue or local users, such as by reaching KRW1 trillion in total revenue or one mil - lion Korean data subjects.
EU became the first jurisdiction to receive the PIPC’s adequacy decision. PIPC guideline on the use of publicly available data to develop AI In July 2024, the PIPC announced the release of a Guideline on Handling Publicly Available Personal Information for AI Development and Services. This guideline explains the legal basis (in particular, legiti - mate interest) for collecting and utilising publicly avail - able personal information for the development of AI technologies and services and provides businesses with guidance on implementing appropriate safe - guards throughout the stages of AI development and service deployment. PIPC guideline on the processing of personal information for generative AI In August 2025, the PIPC announced the release of a Guideline on the Processing of Personal Information for the Development and Utilisation of Generative AI. The guideline classifies the stages of developing and utilising generative AI into four phases – (i) goal set - ting, (ii) strategy formulation, (iii) AI training and devel - opment, and (iv) system implementation and manage - ment – and presents considerations that businesses developing or utilising generative AI should take into account at each stage to ensure the protection of per - sonal information.
575 CHAMBERS.COM
Powered by FlippingBook