| Pseudonymized information |
Information that has undergone pseudonymization. It remains personal information, with special provisions for statistics, scientific research and archiving in the public interest |
| Pseudonymization |
Deleting or replacing parts of personal information so a specific individual cannot be identified without additional information |
| AI development business operator |
An AI business operator developing and providing AI |
| Personal information controller |
A party processing personal information itself or through others to operate personal information files for business purposes |
| Verification and certification |
Voluntary activities by private organizations and similar bodies to verify or certify AI safety and trustworthiness. High-impact operators must endeavor to obtain them |
| Output labeling |
Duty to identify generative AI outputs as AI-generated (Article 31(2)) |
| Management system certification |
A certification body's assessment that organizational management meets a standard's requirements. Not a product performance guarantee |
| Grace period |
Government policy to defer fact-finding investigations and fines in principle and focus on guidance (at least one year). Investigations remain possible for serious matters such as loss of life or human rights harm |
| High-impact AI |
An AI system potentially causing significant impact or risk to life, physical safety or fundamental rights and used in a statutory area (energy, healthcare, recruitment and loan screening, etc., under Article 2, subparagraph 4) |
| Unique identifying information |
Identifiers assigned by law to distinguish individuals uniquely, as prescribed by Presidential Decree |
| Scientific research |
Research applying scientific methods, including technology development and demonstration, basic research, applied research and privately funded research |
| Domestic representative |
A person with a Korean address or business premises acting for an operator meeting thresholds but lacking a Korean address or premises, including submitting implementation results |
| Cross-border transfer |
Providing (including access), entrusting processing or storing personal information overseas |
| Machine-readable labeling |
A generation label read by software rather than people, such as metadata. Accompanied at least once by text or audio notice |
| Data residency |
Settings determining storage and processing regions. Check storage and processing locations separately |
| Data Processing Addendum (DPA) |
A contractual document defining a vendor's customer data processing terms |
| Zero Data Retention (ZDR) |
Conditions under which requests and responses are not kept in vendor abuse logs and similar records. Usually requires approval or agreement; stateful features such as files and safety exceptions may be excluded |
| Sensitive information |
Ideology, beliefs, political views, health, sex life, genetic information, criminal records, biometric features for identification, and race or ethnicity |
| Fact-finding investigation |
A process in which the minister requests materials or investigates suspected or reported violations |
| Usage policy (AUP) |
A vendor document specifying prohibited uses or uses subject to additional requirements |
| Prior notice |
Duty to inform users in advance that a product or service is based on high-impact or generative AI (Article 31(1)) |
| Generative AI |
An AI system generating text, sound, images, video and other outputs by imitating input data structure and characteristics |
| Shadow AI |
Processing work data through AI accounts or tools not approved by the organization |
| Explainability |
Ability to answer how a decision was reached |
| Entrusted processor |
A party entrusted with personal information processing, including a sub-entrusted party |
| Safety obligations |
Risk management duties for systems meeting all three criteria, including cumulative compute of at least 10^26 operations (Article 32) |
| Processing entrustment |
Entrusting personal information processing to a third party for the controller's business purposes |
| Agent |
AI invoking tools to take actions such as retrieval, editing and sending |
| Affected person |
A person whose life, physical safety or fundamental rights are significantly affected by an AI product or service |
| AI impact assessment |
Prior assessment of high-impact AI's effects on fundamental rights. A duty to endeavor |
| Personal information impact assessment |
Risk assessment by public institutions creating or changing personal information files above specified thresholds |
| Abuse monitoring |
Automated classification and, where necessary, human review to detect usage policy violations |
| Oversharing |
Files and folders shared more widely than necessary. AI search surfaces them in answers |
| AI utilization business operator |
An operator providing AI products or services using AI supplied by a development business operator |
| Anonymous information |
Information that cannot identify a person even with reasonable use of other information. Excluded from the scope of PIPA |
| AI system |
An AI-based system with autonomy and adaptiveness that infers predictions, recommendations, decisions and other outputs for given objectives |
| AI-vulnerable groups |
People prescribed by the Enforcement Decree, including those aged 65 or older, persons with disabilities, benefit recipients and near-poor groups. Their characteristics must be reflected in impact assessments |
| Automation bias |
Tendency to trust AI suggestions excessively and accept them without review |
| Automated decision |
A decision reached by processing personal information through a fully automated system (excluding automated administrative dispositions). Significant effects on rights or duties trigger a refusal right, except for consent-, law- or contract-based decisions |
| Residual risk |
Risk remaining after controls. Documented and accepted by the authorized person |
| Legitimate interests |
Processing basis where necessary to achieve legitimate interests clearly overriding data subject rights, substantially related and within reasonable bounds (Article 15(1), subparagraph 6) |
| Processing |
All personal information acts from collection to destruction |
| Processor |
A party processing customer data on customer instructions. Comparable to an entrusted processor under Korean law |
| Additional use |
Use without consent within a scope reasonably related to the original purpose, considering disadvantages and safeguards under Decree criteria (Article 15(3)) |
| Controller |
A party independently determining processing purposes and means. Comparable to a personal information controller under Korean law |
| Transparency |
Ability to answer what happened in a system |
| Frontier safety framework |
A developer's voluntary system addressing extreme capability risks of frontier models |
| Prompt injection |
An attack changing AI's original instructions or behavior through instructions hidden in input |
| Subprocessor |
Another provider to which a vendor delegates customer data processing |
| Interpretability |
Ability to answer why a decision arose and what it means to the user |
| ISO/IEC 42001 |
International standard defining requirements for establishing, implementing, maintaining and improving an AI management system |
| NIST AI RMF |
US NIST's AI risk management framework with four functions: Govern, Map, Measure and Manage |
| RAG |
Retrieval-Augmented Generation: retrieving relevant documents and supplying them to a model with a question to generate an answer |