Appendix D. Reference documents

All documents were checked on 20 October 2026, with changes made during review rechecked on 21 October. Some pages blocking automated access were cross-checked against search-indexed official-page content on the same day.

National Law Information Center

• Basic Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust — Act No. 21311, effective 21 July 2026
• Enforcement Decree of the same Act — Presidential Decree No. 36580, effective 20 August 2026. Includes Schedules 1 and 2 and prescribed forms
• Personal Information Protection Act — Act No. 21445, effective 11 September 2026
• PIPA Enforcement Decree — Presidential Decree No. 36671, effective 11 September 2026
• Standards for Measures by Personal Information Controllers Regarding Automated Decisions — PIPC notice, schedule (assessment examples)

Ministry of Science and ICT / Korea Policy Briefing

• AI Basic Act takes effect on the 22nd — Grace period policy, 21 January 2026
• Guidelines for Ensuring AI Transparency released — Press release and attachments, 21 January 2026
• Ministry of Science and ICT website — Latest guidelines and ministerial notices

Personal Information Protection Commission

• Standards for processing public data for AI training established — Public personal information processing guidance, 17 July 2024
• Personal information processing standards for generative AI development and use released — Generative AI personal information processing guidance, 6 August 2025
• Personal Information Protection Commission website — Original guidance documents

OpenAI

• Business data privacy, security, and compliance
• Enterprise privacy
• Data controls in the OpenAI platform
• Temporary chat in ChatGPT
• How your data is used to improve model performance
• Deprecations — Assistants API retired 26 August 2026
• Usage policies
• Preparedness Framework v2

Anthropic

• Privacy Center
• Is my data used for model training? (commercial)
• How long do you store my organization's data?
• Is my data used for model training? (consumer)
• How long do you store my data? (consumer)
• Custom data retention controls for Enterprise
• How do I view and sign your DPA?
• Usage Policy — Revision scheduled to take effect 12 November 2026
• Usage Policy, version effective 15 September 2025
• Covered Models
• Responsible Scaling Policy — Version 3.4 PDF

Google

• Generative AI in Google Workspace Privacy Hub
• Turn the Gemini app on or off
• Google DeepMind — Frontier Safety

Microsoft

• Data, Privacy, and Security for Microsoft Copilot
• Manage Microsoft feedback for your organization
• Agent Registry in Microsoft 365 admin center
• Data, privacy, and security for web search in Microsoft Copilot
• Foundry Models sold by Azure — data privacy

AWS

• Amazon Bedrock — Data protection
• Amazon Bedrock — Data retention

NIST / ISO / OWASP

• NIST — AI Risk Management Framework
• NIST AIRC — AI RMF Core
• NIST AIRC — Trustworthy AI characteristics
• NIST AI 600-1 — Generative AI Profile
• ISO/IEC 42001:2023
• ISO/IEC 42001 explained
• OWASP Top 10 for LLM Applications