South Korea’s AI data law just got teeth. Western firms are unprepared.

On September 11, 2026, South Korea’s amended Personal Information Protection Act takes effect, introducing fines of up to 10% of global revenue for aggravated AI data privacy violations and statutory board-level accountability for data protection. The law applies extraterritorially to any company processing the personal data of South Korea’s 51 million residents for AI training or deployment.

A separate amendment, cleared by the National Assembly’s Political Affairs Committee on May 14, 2026, and by the Legislation and Judiciary Committee on July 29, 2026, with bipartisan support, awaits a floor vote. If enacted, it would shift authority to approve AI training on non-pseudonymized personal data from companies to the Personal Information Protection Commission on a case-by-case basis, with no statutory review mechanism. That regime is expected to take effect around March 2027 if the amendment passes and is promulgated.

“South Korea is one plenary vote away from rewriting the legal basis for AI data.” Kyoungsic Min, privacy counsel at VeraSafe, made this observation as the amendment cleared two National Assembly committees with bipartisan support. It would let the Personal Information Protection Commission decide, project by project, which AI systems can train on real Korean personal data — not pseudonymized, not anonymized, but the original records collected for other purposes.

The law taking effect on September 11, 2026, is aggressive enough on its own: fines reaching 10% of global revenue, CEOs designated as ultimately responsible, and a three-tier compliance framework that demands documented lawful bases at both training and deployment stages. But the amendment awaiting promulgation is the more consequential shift. It replaces rules with regulatory discretion.

The amendment does not specify how PIPC’s case-by-case decisions will be reviewed, or by whom. For the 51 million people whose data is at stake, and for the companies whose AI pipelines depend on it, that gap is the story.

One regulator, unlimited discretion

The amendment — Articles 28-12 through 28-15 of PIPA — permits lawfully collected personal data to be used for AI development beyond its original purpose, but only if four conditions are met. Anonymization or pseudonymization must be insufficient for the project. Technical and organizational safeguards must be in place. The purpose must advance public interest or social benefit. And the PIPC must approve the use through a formal deliberation process.

This shifts the decision from companies — which must document their own lawful basis under the law taking effect tomorrow — to the regulator itself. Min has argued that this raises a governance question: who supervises the supervisor? The amendment does not establish an independent review mechanism for PIPC’s case-by-case determinations.

The 10% ceiling exceeds anything in European law. GDPR caps fines at 4% of global turnover; the EU AI Act reaches 7% for certain breaches. South Korea’s framework can claim 10% of total revenue when aggravating factors are present.

A repeat intentional or grossly negligent violation within three years triggers the elevated rate. So does a single incident affecting 10 million or more people under those conditions. The same applies if a company breaches data after ignoring a formal PIPC corrective order.

The compliance framework itself sorts AI use into three tiers, each with escalating obligations. The structure matters because it determines what a company must prove before training begins — not after.

The breakdown below maps what each tier requires.

The discretion no one is debating

South Korea’s approach embeds AI governance inside privacy law rather than treating them as separate domains. The EU splits them: GDPR for data, the AI Act for systems. The US leaves them fragmented across sectoral rules and state laws. Seoul’s deliberate choice is to make the Personal Information Protection Commission the single authority over both data protection and AI training conditions.

The AI Framework Act, passed in December 2024 and in force since January 2026, provides a general governance backdrop. But PIPA is the instrument that actually controls what data enters which model, and under what conditions. That makes privacy law the primary lever for shaping AI development — a structural choice no other major jurisdiction has made.

If enacted, the amendment taking effect around March 2027 would give PIPC a tool no European data protection authority currently holds: the power to approve specific AI projects using original personal data, case by case, with limited public criteria and no statutory review mechanism. International law firms including Kim & Chang and Bae, Kim & Lee frame this as a powerful carve-out — approved projects gain exemptions from multiple PIPA restrictions. The cost is regulatory uncertainty. Companies cannot know in advance which projects will qualify.

The enforcement backdrop is already aggressive. Coupang was fined KRW 624.6 billion — roughly $467 million — in the largest privacy penalty in Korean history, affecting 37.55 million people. Prior fines divided across breached records amounted to roughly $0.70 per record, a cost low enough that accepting penalties was economically rational. Leaked personal data volume later surged nearly thirteenfold. The new regime is designed to change that calculus, and the scale of AI deployment already underway in Korea — including a government-funded free chatbot for all 52 million residents — means the stakes are not hypothetical.

For now, the law taking effect on September 11 provides clear rules: document your lawful basis, pseudonymize where possible, and prepare for fines that reach 10% of global revenue if you fail. The pending amendment would replace that clarity with a regulator’s judgment. Whether that judgment will be predictable, consistent, or subject to meaningful oversight is the question the National Assembly has not yet answered.

Beyond the headline

The Bigger Picture

South Korea is turning privacy law into the primary lever for shaping AI, not just for policing data leaks. By embedding AI training rules, pseudonymization gateways, and regulator-controlled exceptions directly into PIPA, Seoul is effectively using one statute to govern both how data is protected and how models are built. That approach contrasts with jurisdictions that treat AI and privacy as separate debates, and it signals a broader shift: future data protection regimes may increasingly define the conditions for AI development, not just the consequences of breaches.

The Reach

When a privacy penalty in Seoul can claim 10% of a company’s worldwide turnover, the compliance conversation moves from the legal department to the boardroom. The CEO is now statutorily accountable, which means Korean data governance will shape enterprise AI strategy even for products whose primary markets are elsewhere. A single enforcement action in Seoul can rewrite risk calculations in New York or London overnight.

What Isn’t Being Said

Most official messaging frames the reforms as protecting ordinary Koreans from data leaks, but far less attention is paid to how much discretion PIPC will wield over AI training uses if the pending amendment takes effect. The regulator would decide, case by case, which projects qualify as sufficiently beneficial and safe to use original personal data beyond its collection purpose. That discretion could quietly shape which AI applications flourish in Korea, privileging certain sectors or public-interest narratives without those allocation choices ever being debated as explicit industrial policy.

The choices that cannot wait for March

With the September 11 enforcement date immediate and the pending amendment introducing regulatory discretion, companies and investors face decisions now that will determine their exposure for years.

• Western AI developer using Korean personal data

  You must immediately assess your AI training and deployment pipelines for Korean personal data. Document lawful bases separately for training and deployment stages, implement input filtering for any third-party API use, and ensure cross-border transfer rules are met before Korean data leaves your infrastructure. The Korea Legislation Research Institute provides an English translation of the amended PIPA; map your data flows against Article 28-2 pseudonymization requirements and the new 10% fine conditions before the deadline.

• Global enterprise board member with South Korean market exposure

  Review your company’s risk exposure in South Korea now. Confirm that a qualified Chief Privacy Officer is in place — for large organizations, appointment and dismissal must be approved by the board and reported to PIPC. Ensure adequate budget and resources for privacy compliance, because fines calculated on global revenue cannot be absorbed within a single department. The PIPC’s 2026 budget of KRW 72.9 billion signals serious enforcement capacity.

• Western privacy counsel for multinational corporations

  Conduct a gap analysis between your current global privacy frameworks and the new PIPA requirements. ISMS-P certification becomes mandatory for large data controllers on July 1, 2027 — broadly comparable to ISO 27001 and ISO 27701 but with locally defined controls overseen by KISA. Pay particular attention to AI data provenance requirements for self-developed models, where reconstructible metadata at data intake is now a legal necessity, not a best practice.

• Investor in AI or South Korean tech companies

  Scrutinize the data governance and AI compliance strategies of your current or prospective investments in South Korea, or those using Korean data. The Forrester projection of $15.8 billion in global AI governance software spending by 2030 reflects the compliance burden now being locked in. Companies that have not mapped their Korean data flows or documented lawful bases for AI training face material financial exposure — and the pending amendment adds regulatory uncertainty that will favor prepared incumbents.

FAQ

Explainer

Personal Information Protection Commission

South Korea’s primary privacy regulator, established as an independent agency under the Personal Information Protection Act. The PIPC enforces data protection laws, issues AI governance guidance, and manages innovation infrastructure including a cloud-based zone for pseudonymized data analysis. Its 2026 budget of KRW 72.9 billion reflects an expanding mandate that now includes case-by-case approval of AI training projects under the pending amendment.

Pseudonymization

A data processing technique that removes or replaces direct identifiers — names, ID numbers, phone numbers — while preserving the analytical value of a dataset. Under South Korea’s Article 28-2, pseudonymized data can be used for scientific research including AI training without individual consent. The technique is central to the new compliance framework because it creates a lawful gateway for AI development that avoids the full consent requirements of original personal data.

Article 28-2

The provision of South Korea’s Personal Information Protection Act that permits processing of pseudonymized information without data subject consent for statistical compilation, scientific research, and archiving in the public interest. PIPC guidance explicitly interprets scientific research to cover AI technology development and model training. The provision requires that no re-identifying information be included when sharing such data with third parties.

ISMS-P

South Korea’s Information Security Management System for Personal Information, a certification framework broadly comparable to ISO 27001 and ISO 27701 but with locally defined controls. Overseen by the Korea Internet and Security Agency, ISMS-P becomes mandatory for large data controllers on July 1, 2027. Multinationals operating under ISO standards will need a gap analysis to identify additional Korean-specific requirements.

Membership Inference Attacks

A statistical technique, first documented by Shokri et al. in 2017 and extended by Carlini et al. in 2022, that probes whether a specific individual’s data was used to train a machine learning model. The technique produces probabilistic estimates with false positives and false negatives, making it insufficient for legal proof of data provenance. This limitation is why South Korea’s framework requires lawfulness metadata to be attached at data intake rather than reconstructed after training.

AI Framework Act

South Korea’s general AI governance statute, passed in December 2024 and in force since January 22, 2026. It provides a broad regulatory backdrop for AI systems alongside PIPA, but does not contain the specific data-training rules now embedded in the amended privacy law. The Act establishes principles for trustworthy AI while leaving the detailed control of training data to the PIPC under PIPA’s pseudonymization and special-provisions framework.