Chapter 3. Personal information and AI

Learning objectives

• Analyze each AI life-cycle stage (collection, preparation, training, inference, logging and destruction) as "processing" under PIPA, connecting each stage to its purpose and legal basis.
• Choose a processing basis for training data by comparing collection and use grounds, additional use, and legitimate interests for publicly available personal information.
• Explain requirements and prohibitions for sensitive information, unique identifying information, pseudonymized information and anonymous information.
• Apply entrustment, third-party provision and cross-border transfer rules to external AI services.
• Design procedures for refusal and explanation requests concerning automated decisions, and the required disclosures.

Introduction

Suppose a customer service team leader proposes, "We have years of support records. Let us train a company-specific support model on them. It is our data, after all." This sentence contains every question PIPA asks: For what purpose were the records collected? Is training within that purpose? Do the records include health information or resident registration numbers? How will the outside training provider handle them? In which country are the servers? Will the finished model make decisions about customers without humans?

"Our data" is the language of ownership; PIPA speaks the language of processing. The central issue throughout this chapter is the purpose, legal basis and protections under which information entrusted by data subjects is processed.

This chapter incorporates changes to the Act and Enforcement Decree effective 11 September 2026. It follows the AI life cycle, first establishing processing principles and grounds, then covering additional use, public personal information, sensitive information, and pseudonymized and anonymous information. Next come entrustment, third-party provision and cross-border transfers when using external AI, automated decisions, data subject rights and breach notification. Finally, these are combined into one assessment procedure.

Key concepts

"Processing" through the AI life cycle

Under PIPA, processing includes collection, generation, linking, interconnection, recording, storage, holding, adaptation, editing, retrieval, output, correction, recovery, use, provision, disclosure, destruction and similar acts (Article 2, subparagraph 2). Every AI stage involves processing.

The Personal Information Protection Commission (PIPC) Guidelines on Personal Information Processing for Generative AI Development and Utilization (August 2025) divide the life cycle into four stages: purpose setting, strategy formulation, training and development, and application and management. They recommend governance centered on the Chief Privacy Officer (CPO). The table above breaks that flow into practical actions.

Processing principles

Article 3 sets eight principles. Those especially relevant to AI include:

• Clarify purposes, and collect only the necessary minimum lawfully and fairly (paragraph 1).
• Process within the scope necessary for the purpose, without using information for other purposes (paragraph 2).
• Ensure that information is accurate, complete and up to date within the necessary scope (paragraph 3).
• Manage securely in proportion to risk, and disclose privacy policies and similar information to guarantee data subject rights (paragraphs 4 and 5).
• Process in ways minimizing privacy intrusion (paragraph 6).
• If the purpose can be achieved anonymously or pseudonymously, use anonymous processing where possible, and pseudonymous processing otherwise (paragraph 7).

Paragraph 7 is the starting point for training data design. "We need originals for model performance" is not itself a basis. First explain why anonymous or pseudonymized information cannot achieve the purpose.

Choosing a processing basis

Article 15(1) provides seven grounds for collecting personal information and using it within that purpose: data subject consent; special statutory provisions or compliance with legal duties; a public institution's official functions; entering into or performing a contract; clear and urgent interests of life, body or property; the controller's legitimate interests (clearly overriding data subject rights, substantially related and within reasonable bounds); and urgent needs such as public health.

Different AI stages may have different grounds.

Consent is not a universal solution. It requires notice of purposes, items, retention periods, the right to refuse and disadvantages (Article 15(2)); refusal must be possible, and changed scope requires renewed consent. Retrospective consent is often impractical for large-scale training data, so other grounds should also be reviewed. Services cannot be denied because a person refuses collection beyond the necessary minimum, such as extra data for training (Article 16(3)).

Additional use and use beyond the original purpose

Additional use (Article 15(3)) permits use without consent within a scope reasonably related to the original collection purpose, considering disadvantages to data subjects and safeguards such as encryption. Enforcement Decree Article 14-2 sets four considerations.

1. Relationship to the original collection purpose
2. Predictability of additional use in light of collection circumstances or processing practices
3. Whether it unfairly infringes data subject interests
4. Whether safeguards such as pseudonymization or encryption are in place

For ongoing additional use, disclose the assessment criteria in the privacy policy, and have the CPO check that use follows them (Enforcement Decree Article 14-2(2)). Models retrained periodically are one such example.

Use beyond the original purpose (Article 18) differs. Use outside the collection purpose is prohibited in principle and needs an exception such as separate consent or a special statutory provision. Additional use is like changing the use of a room in the same house; use beyond the purpose is moving to another house. Even changing rooms must remain within what the family would reasonably expect (predictability).

Public personal information and legitimate interests

Text published on the web is not unrestricted training material. Public information is still personal information if it identifies a person. PIPC's Guidelines on Processing Publicly Available Personal Information for AI Development and Services (July 2024) consider Article 15 legitimate interests as a basis for AI training and give three requirements.

1. Legitimacy of purpose: Is the AI development purpose legitimate?
2. Necessity of processing: Is processing the public personal information necessary, substantially related to that purpose and within reasonable bounds?
3. Specific balancing of interests: Do the controller's legitimate interests clearly override the data subject's rights?

The guidance also covers technical and organizational safeguards and data subject rights, explaining that companies can choose combinations suited to their circumstances. It is interpretation and recommendation, not legislation; identify the memo's assessment as "balancing of interests with reference to the guidance".

Sensitive information, unique identifying information and resident registration numbers

Sensitive information (Article 23) covers ideology and beliefs, joining or withdrawing from a trade union or political party, political opinions, health, sex life and information prescribed by the Enforcement Decree. Article 18 of the Decree adds genetic information, criminal records, race and ethnicity, and information generated through technical means concerning physical, physiological or behavioral characteristics for the purpose of identifying a specific individual. This covers facial feature values extracted for identification, rather than facial photographs themselves.

Processing sensitive information is prohibited in principle. It requires consent separate from consent to other processing, or legal requirements or permission, and safeguards against leakage and similar incidents.

Unique identifying information (Article 24) means identifiers assigned by law to distinguish individuals uniquely; resident registration numbers (Article 24-2) are more narrowly restricted. They may be processed only where specifically required or allowed by Acts or Presidential Decrees and similar legislation, clearly necessary for urgent interests of life, body or property, or in comparable cases notified by PIPC. They must be stored encrypted. Customers often enter such information themselves in conversations and free-text fields, so include pattern-based filtering before training.

Special provisions for pseudonymized information

Pseudonymization deletes part of personal information or replaces some or all of it so that a specific individual cannot be identified without additional information (Article 2, subparagraph 1-2). The resulting pseudonymized information remains personal information (Article 2, subparagraph 1(c)). Pseudonymized information is like a locked box with a separately stored key; anonymous information is a box with no key at all.

AI development may fall within scientific research as "technology development and demonstration", so these special provisions are often considered. Whether they also remove separate sensitive-information requirements needs separate review. If a trained model or its outputs enable identification of a specific person, Article 28-5 suspension and destruction duties operate.

Anonymous information and re-identification risk

The Act does not apply to information that can no longer identify a person even using other information, reasonably considering time, cost and technology (Article 58-2). This is anonymous information. The test is not whether this company can identify someone now, but whether identification is possible considering other reasonably obtainable information, reflecting the same approach as the ease-of-combination test in Article 2, subparagraph 1(b).

AI creates re-identification risks in two places. At dataset level, rare combinations (age, neighborhood, occupation) can reveal an individual. At model level, memorized text can be reproduced verbatim. Techniques such as synthetic data and statistical noise reduce risk, but whether outputs are anonymous depends on a re-identification assessment, not the technique's name.

Entrustment, third-party provision and independent vendor use

First determine the relationship when entering personal information into an external AI service.

Entrustment is like leaving clothes at a laundry; third-party provision is giving clothes to someone else. If the laundry wears your clothes as its own, it is no longer merely looking after them. That is why we check Chapter 1's no-training commitment and DPA. A promise not to use customer data for the vendor's own model training is needed to explain the relationship as entrustment. Many provisions on collection and use, sensitive information, cross-border transfers and other matters apply mutatis mutandis to entrusted processors (Article 26(8)), who must follow the same standards.

Cross-border transfers

Provision (including access), entrusted processing and storage of personal information overseas all count as transfer (Article 28-8(1)). They are prohibited in principle unless one of the following applies.

1. The data subject gives separate consent to the cross-border transfer.
2. A special provision exists in an Act, treaty or international agreement.
3. Entrusted processing or storage is necessary to enter into or perform a contract with the data subject, and the items, country, timing and method, recipient, purpose and retention period, refusal method and other details are disclosed in the privacy policy or notified by email or similar means.
4. The recipient obtains certification notified by PIPC and implements all necessary measures.
5. PIPC recognizes the recipient country or international organization's protection as substantially equivalent to PIPA.

Transfers require safeguards and complaint and dispute resolution measures agreed with the recipient in advance and incorporated into the contract (Enforcement Decree Article 29-10). The same rules apply to onward transfers to third countries (Article 28-11). PIPC may order suspension for violations or potential substantial harm, and controllers may object within seven days (Article 28-9).

As Chapter 1 showed, domestic storage and domestic processing differ. An API running inference abroad may involve overseas entrusted processing regardless of storage location.

Automated decisions

Data subjects may refuse decisions made by processing personal information through fully automated systems (including AI systems) if they significantly affect their rights or obligations (Article 37-2(1)). The right to refuse does not apply where the decision is based on consent, special statutory provisions or legal duties, or entering into or performing a contract. Automated administrative dispositions by administrative agencies under Article 20 of the Framework Act on Public Administration are excluded from this Article's automated decisions.

Even without a right to refuse, data subjects may request explanations and related measures (paragraph 2). Without a justifiable reason, controllers must take necessary measures such as not applying the decision, reprocessing with human intervention, or explaining it (paragraph 3). Decision criteria, procedures and personal information processing methods must be disclosed in an easily accessible way (paragraph 4).

"Fully automated" is crucial. Meaningful review by a person authorized to change outcomes may put a decision outside this Article, but a formal check is not meaningful intervention. The schedule to PIPC's Standards for Measures by Personal Information Controllers Regarding Automated Decisions gives as an example an HR decision-maker rejecting an applicant after only formally checking the system's score (see automation bias in Chapter 4). Explanation requests and disclosure of criteria also apply to automated decisions without significant impact. AI Basic Act Article 3(2) likewise states the principle that affected persons should receive clear, meaningful explanations of the main criteria and principles used to reach final outcomes, to the extent technically and reasonably possible.

Data subject rights, breach notification and impact assessment

AI systems must respond to access (Article 35), correction and deletion (Article 36), and processing suspension requests (Article 37). Controllers covered by the Enforcement Decree must also respond to qualifying personal information transmission (portability) requests (Article 35-2). Data is scattered across original repositories, search indexes, conversation logs, training datasets and backups, so define the search scope for requests in advance. Removing one person's information from an already trained model may be technically difficult. Be able to explain a response combining dataset deletion, retraining intervals and output blocking.

Breach notification (Article 34) was strengthened by the 2026 amendment. On learning of leakage or similar incidents, notify data subjects without delay (within 72 hours under the Decree). Report to PIPC or the Korea Internet & Security Agency within 72 hours if at least 1,000 people are affected, sensitive or unique identifying information is involved, or leakage results from unlawful outside access. New Article 34(2) also requires notification even when there is only the possibility of leakage or similar incidents. For example, if unlawful system access raises suspicion of leakage but identifying whose information is affected is difficult, all potentially affected data subjects must be notified within 72 hours of learning of the access. For justifiable reasons such as unknown contact details, a website notice for at least 30 days can substitute. Provide further notice once facts are confirmed (Enforcement Decree Articles 39-2 and 39-3). The amendment applies to cases learned of on or after 11 September 2026.

Personal information impact assessment (Article 33) is mandatory for public institutions. When creating or changing files containing sensitive or unique identifying information on at least 50,000 people, combined files covering at least 500,000, files covering at least 1 million, and similar files, they must commission a designated institution and submit results to PIPC (Enforcement Decree Article 35). Private companies may use the framework for voluntary checks.

Assessing lawful processing of AI training and inference data

This chapter's practical skill is assessing whether AI training and inference data is lawfully processed. Write a review memo in this order.

1. Data inventory: Record dataset name, items, data subject scope, scale, source, original collection purpose and basis.
2. New purpose: State whether it is training or inference, improving the same service or creating a new one.
3. Filter special information: Check for sensitive information, unique identifiers, resident registration numbers and children's information; determine removal or separate grounds.
4. Minimization: First consider whether anonymous or pseudonymized information can achieve the purpose (Article 3(7)).
5. Choose grounds: Select original-purpose scope, additional use (four considerations), pseudonymized information provisions, legitimate interests (public information) or fresh consent, and explain why.
6. Relationships and location: For external services, record entrustment or provision, cross-border transfer, grounds and disclosure items.
7. Use of outputs: Check whether outputs support fully automated decisions about individuals; if so, design an Article 37-2 response.
8. Rights and destruction: Define access and deletion request scope, retention periods and destruction methods.
9. Label: Put "Draft pending legal review" and the date at the top.

Going deeper

Internal search and RAG: permissions and deletion must propagate

Retrieval-Augmented Generation (RAG) retrieves relevant internal documents and supplies them alongside a question to a model. It is easy to assume no training means no privacy issue, but new repositories (search indexes and embedding vectors) and retrieval routes are created.

First, permissions must propagate. If document permissions disappear during indexing, or indexes remain unchanged after a role change or departure, an employee without access to HR records may obtain them by asking AI. Microsoft's statement that Copilot shows only data the user has at least viewing rights to also means existing permission problems become visible. Second, deletion must propagate. If deleted originals remain in indexes and caches, a deletion request is not fulfilled. Set the interval and verification method for reflecting source changes in indexes.

Personal information inside models

Trained models can reproduce some training data, such as rare phone numbers or sentences, almost verbatim. Think in three layers. Before training, filter identifiers and reduce duplication. During training, consider privacy-preserving methods such as differential privacy, which adds statistical noise. At output, block patterns such as resident registration numbers and phone numbers, and regularly test extraction attempts.

If a model trained on pseudonymized information produces identifiable information, Article 28-5(2) suspension, retrieval and destruction duties may apply. Prepare model-level responses such as rollback or retraining in advance.

What the 2026 amendment means for AI operations

The amendment effective 11 September 2026 brings four changes. First, possible-breach notification means "still investigating" cannot justify delay; add a 72-hour clock to conversation-log incident response. Second, business owners or representatives, as ultimately responsible persons, must take overall management measures such as staffing and budget support (Article 30-3). Third, controllers above a specified scale must obtain board resolutions and report to PIPC when appointing, changing or removing the CPO (Article 31(3); thresholds in the Decree). Fourth, penalty surcharges can reach 10% of total revenue for cases such as repeating a violation of the same subparagraph within three years of a surcharge decision (both violations intentional or grossly negligent), or intentional or grossly negligent violations affecting at least 10 million people (Article 64-2(2)).

At work

Moram Precision: building an internal HR assistant

Moram Precision, a mid-sized manufacturer with 1,800 employees, plans an internal AI assistant answering questions on leave rules, pay statements and benefits. It intends to index HR policies, employee leave usage, pay and sick leave records, and generate answers through a model API in an overseas cloud region.

The privacy officer first separated the data. Policy manuals are not personal information. Leave and pay records are personal information processed for employment contract performance, and answering employees' own questions can fall within the original purpose. Sick leave was the problem: diagnoses are sensitive health information. The officer decided to index only sick leave days, excluding diagnoses, which were unnecessary to answer questions.

Developers proposed putting all records in one index with a prompt saying "Answer only about the user's own records". The officer rejected prompts as access control and required retrieval-stage filtering by employee ID so only that person's records reached the model.

Using an overseas region is overseas entrusted processing. After confirming necessity for employment contract performance, the company disclosed transfer items, country, timing and method, recipient and contact details, purpose and retention, and refusal methods, procedures and effects under Article 28-8(1), subparagraph 3. It checked the entrustment contract for no-training and sub-entrustment consent clauses. Conversation logs would be deleted after 30 days. Access and deletion requests would trigger checks of originals, indexes and logs. The memo separately retained the issue "Labor-law review of whether prior consultation with employee representatives is required".

Seulgion: improving a pronunciation scoring model with learners' voices

Seulgion, an adult language-learning app, wants to improve its pronunciation scoring model using recorded practice speech. Recordings were collected to provide pronunciation feedback, and the terms mention service improvement. Some classes automatically assign learners to the next level using scores.

The officer first assessed whether the recordings were personal information. Voices and spoken names could identify people, so they were. Were they sensitive? Enforcement Decree Article 18, subparagraph 3 covers information technically generated for identifying specific individuals. Pronunciation scoring does not aim to identify speakers, so the officer judged it outside this category unless the model generated speaker-identification features. The condition "Adding speaker authentication later changes this conclusion" was recorded.

The officer compared additional use with the pseudonymized information provisions. Training to improve feedback in the same service was closely related to the original purpose and foreseeable by learners, so additional use was chosen. Spoken-name segments would be cut and account identifiers replaced by pseudonymous keys. Since retraining recurs quarterly, assessment criteria would be disclosed in the privacy policy. The suggestion to seek fresh consent was recorded alongside the risk that low consent rates would skew the data toward certain groups.

Automatic class assignment was judged unlikely to significantly affect rights or obligations. Explanation requests can arise regardless of significance, however, so a route was provided for instructor reassessment when learners objected.

Common mistakes

1. "Pseudonymized information is not personal information." It remains personal information. Anonymous information is outside the Act.
2. "Training is internal use, not processing." Use, preparation and generation are processing and need a basis.
3. "Public information can be used freely for training." If identifiable, it remains personal information and needs grounds such as legitimate interests plus safeguards.
4. "No server storage means no cross-border transfer." Access and entrusted processing also count as transfers.
5. "Contract-based automated decisions carry no duties." Only the refusal right is excluded; explanation response and criteria disclosure duties remain.
6. "One general consent covers sensitive information." Consent must be separate from other processing consent.
7. "An entrustment contract makes vendor training entrustment too." Vendor use for its own purpose exceeds entrustment.
8. "We can delay notification until leakage is confirmed." The 2026 amendment introduced cases requiring notice of possible leakage alone.

Summary at a glance

Check the official docs

• National Law Information Center — Personal Information Protection Act: Articles 2, 3, 15, 17–18, 23–24, 24-2, 26, 28-2 through 28-11, 34, 37-2 and 58-2.
• National Law Information Center — PIPA Enforcement Decree: Articles 14-2, 18, 29-5, 29-10, 39–40 and 44-2 through 44-4.
• Korea Policy Briefing — PIPC establishes standards for processing public data for AI training: Three legitimate-interest requirements and safeguards.
• Korea Policy Briefing — PIPC releases personal information processing standards for generative AI development and use: Four life-cycle stages and CPO-centered governance.
• Personal Information Protection Commission: Original guidance and pseudonymized information guidelines.
• National Law Information Center — AI Basic Act Article 3: Principle of explanation for affected persons.

Self-check

3-1. State in one sentence what PIPA Article 3(7) requires of training data design, and what must first be demonstrated to justify original data.

3-2. List the four considerations in Enforcement Decree Article 14-2(1), and explain the disclosure and checking required by paragraph (2).

3-3. State the three legitimate-interest requirements in PIPC's public personal information guidance, and explain how this document differs from legislation.

3-4. List the four types of information added as sensitive by Enforcement Decree Article 18, and explain when physical, physiological or behavioral information becomes sensitive information.

3-5. Explain the problem when an external AI vendor uses entrusted customer data to improve its own model, distinguishing entrustment from third-party provision.

3-6. State the required elements and deadline for a controller's explanation of an automated decision requested by a data subject.

3-7. (Design) Map a customer support AI's data flow through collection, search indexing, external model calls, conversation logs and destruction. Tabulate each stage's processing basis, retention period and cross-border transfer status.

Hands-on tasks