Republic of Korea: Amendments to guideline on personal data impact assessments for institutions utilising Artificial Intelligence enters into force

On 5 September 2025, the amendments to the guideline on personal data impact assessments adopted by the Personal Information Protection Commission enter into force. The guidelines apply to public institutions using Artificial Intelligence (AI) and may serve as a reference for private firms. The guidelines create AI-specific evaluation fields, covering the legality of data use, limits on sensitive data and retention of training datasets. It also focuses on safeguards against vulnerabilities, accountability between developers and operators, acceptable use policies for generative AI, and reporting of inappropriate outputs or data leaks.