South Korea has created a legal exception that lets companies use original personal data, including video and audio, for AI development. The Personal Information Protection Commission (PIPC) said on Aug. 20 that a revision to the Personal Information Protection Act containing special provisions for AI technology development passed the National Assembly's plenary session. The change takes effect six months after Cabinet approval and promulgation.
The AI industry has argued that existing privacy regulations constrained development of technologies requiring original data. Using personal data for purposes other than those for which it was collected required consent from the data subject or a separate legal basis. Some applications, including voice-phishing prevention and autonomous robot development, received exemptions through regulatory sandboxes, but those exemptions were limited to two years in principle and up to four years at most.
How the exception works
The revision creates a dedicated pathway for AI. When AI development is difficult using only pseudonymized or anonymized data and a public-interest or social need is recognized, legally collected personal data may be used after enhanced safeguards are put in place and the PIPC reviews and approves the case.
The measure does not allow personal data to be freely used for AI development. The PIPC will review the necessity of the data use and the safeguards in advance, allowing exemptions only in approved cases. For developers working on AI systems, this means the legal route to original data now exists, but it comes with a documented review process rather than a blanket waiver.
Risk measures and streamlined reviews
The revision also includes measures to reduce privacy risks. Companies and institutions handling sensitive data or unique identification information in high-risk cases must assess potential risks in advance and establish mitigation measures. Details of the special provisions applied must be disclosed in their privacy policies, while the PIPC will also publish information on their implementation on its website.
AI technologies and services that are substantially identical or similar to cases already reviewed and approved will be subject to a streamlined review process. The measure is intended to reduce the burden of repeated assessments - relevant for teams building on previously approved use cases.
The PIPC plans to consult experts and industry participants before implementation to establish detailed guidelines and subordinate regulations governing the special provisions. For professionals tracking how regulation shapes AI development, this is a concrete example of a jurisdiction adapting privacy law to accommodate training needs. Those building AI systems may want to follow how the PIPC defines "public-interest or social need" in its forthcoming guidelines.
Why this matters for IT and development
For developers, the practical takeaway is that South Korea has opened a legal path to use original personal data in AI training where pseudonymized or anonymized data falls short. That path is conditional - it requires advance approval, risk assessment, and public disclosure. If your organization works with voice, video, or other personal data in AI pipelines, the PIPC's implementation guidelines will determine how usable this exception actually is. The streamlined review for similar cases also means an approved use case could serve as a template for related projects. For a broader view of how AI regulations affect development work, see AI for IT & Development. Developers looking to build compliant AI systems can also explore the AI Learning Path for Software Developers.
Your membership also unlocks:
