Korea's National Assembly has passed an amendment that would let companies use lawfully collected personal data to develop AI without fresh consent once it takes effect, case by case and subject to the privacy regulator's deliberation and resolution on the PIPC's account

What the Assembly actually passed

On 20 August 2026 the National Assembly plenary passed an amendment to Korea's Personal Information Protection Act. The Personal Information Protection Commission announced it the same day, and the announcement is the source for everything described here.

The amendment creates what Korean practice calls a 특례, a special provision, sitting alongside the existing lawful bases for processing. It provides a route to use personal information that was lawfully collected, for the separate purpose of developing artificial intelligence, without going back for fresh consent.

The problem it addresses is one the PIPC states plainly. Under the current law, using lawfully collected personal information for a different purpose requires separate consent from the data subject or a statutory basis, or else the data must be handled in pseudonymised or anonymised form. For AI development that has been an obstacle.

Until now the only relief was the regulatory sandbox, which the PIPC describes as allowing personal information in video or voice data to be used for a narrow set of innovative services such as voice-phishing prevention and self-driving robot development. The PIPC notes the limit of that route: a sandbox grants a temporary exception, two years as standard and four at most.

The four conditions, and why they matter more than the headline

This is the part most likely to be reported loosely, so take the conditions as the regulator states them. The special provision applies where pseudonymised or anonymised information alone makes AI development difficult, where public or social necessity is recognised, subject to enhanced safety measures, and subject to the deliberation and resolution of the Personal Information Protection Commission.

Read together, those four conditions function as an approval regime rather than a blanket exemption. The release does not use that term, but on the PIPC's account the route depends on the Commission's 심의·의결, its deliberation and resolution. We do not call that prior approval, and we do not say it attaches to each use, because neither formulation is something we have verified from the enrolled text.

So the practical question for a firm is not whether its work fits an abstract definition. It is whether it is prepared to put a specific development programme in front of the regulator and have it examined.

The PIPC has separately said it intends to simplify the procedure where an AI technology or service is substantially identical or similar to one already resolved on. Weigh that carefully: the release does not present it as enacted text, it is the regulator's stated intention about how it might later administer the provision, and the provision itself is not yet in force. It is three removes from anything that binds.

The safeguards attached

The amendment carries conditions designed to limit the exposure it creates, and none of them binds anyone yet, because it is not promulgated and not in force. Once it takes effect, where sensitive information or unique identifying information is processed, or more generally where the impact and risk to a data subject's rights or interests is large, risk factors would have to be assessed in advance and improvement measures prepared.

There would be two transparency duties once the provision commences. A company or institution relying on it would be required to disclose the main content through its privacy policy, and the PIPC itself would be required to publish the operating status of the AI special provision on its website.

That second duty is worth noting for anyone tracking this from outside Korea. If it operates as described, the register of who has been permitted to do what will be public, which makes the regime observable in a way a consent-based route is not.

When any of this actually starts

It has passed the Assembly. On the PIPC's account it now goes to a Cabinet meeting for submission and resolution, then promulgation, and it takes effect six months after promulgation.

No commencement date can be calculated from that, because the promulgation date is not yet set. Anyone publishing a date today is inferring one.

The PIPC says it will gather expert and field opinion before commencement in order to prepare an operating scheme consistent with the law's purpose, and subordinate legislation. The detail that will determine how usable this provision is, in other words, does not exist yet.

The amendment is a consolidated alternative merging two bills, one introduced on 31 January 2025 and one on 13 March 2025, combined in the National Policy Committee and reviewed by the Legislation and Judiciary Committee before the plenary vote.

What a firm outside Korea should take from it

If you develop AI using personal data held in Korea, this is the first statutory route to do so without fresh consent that is not time-limited in the way a sandbox is. That matters for training programmes with a horizon longer than two to four years.

The cost of the route is visibility. A case-by-case deliberation means the regulator sees the programme, and the transparency duties mean the fact of it becomes public. A firm that would not want a specific training dataset examined should not plan around this provision.

The immediate action is not a compliance change, because nothing binds yet. It is to track the promulgation, since that is what starts the six-month clock, and to watch for the subordinate legislation, which is where the operable detail will sit.

What we did not verify

We read the PIPC press release of 20 August 2026. We did not read the enrolled bill, so we do not give article numbers, we do not quote the statutory wording of the special provision, and we do not define the scope of public or social necessity beyond the phrase the PIPC uses.

We cannot give a commencement date. The PIPC states the six-month rule but the promulgation date is not set, and we do not infer one.

We did not verify what the subordinate legislation will require, because it has not been drafted. The PIPC describes an intention to prepare it and to simplify review for substantially similar cases; that is a stated plan, not an enacted rule.

We report the conditions and safeguards as the PIPC describes them in its own release. Where the enrolled text differs from the regulator's summary, the text governs and this article does not.

We did not establish how the special provision interacts with Korea's AI Framework Act or its enforcement decree, and nothing here should be read as describing that relationship.

Related briefings

• Korea's PIPA rights over automated decisions
• The PIPC's public call to rewrite Korea's privacy rules
• Korea's AI Framework Act decree 36506 on labelling
• The PIPC on generative AI privacy and DeepSeek
• AI Regulation News hub