Republic of Korea: Personal Information Protection Commission adopted amendments to guideline on personal data impact assessments for institutions utilising Artificial Intelligence

On 3 September 2025, the Personal Information Protection Commission adopted the amendments to the guidelines on personal data impact assessments. The guidelines apply to public institutions using Artificial Intelligence (AI) and may serve as a reference for private firms. The guidelines create AI-specific evaluation fields, covering the legality of data use, limits on sensitive data and retention of training datasets. It also focuses on safeguards against vulnerabilities, accountability between developers and operators, acceptable use policies for generative AI, and reporting of inappropriate outputs or data leaks.