Republic of Korea: Personal Information Protection Commission issued recommendations to rectify shortcomings in generative AI privacy policies

On 4 March 2026, the Personal Information Protection Commission (PIPC) issued recommendations following discussions with generative AI companies on improving personal information handling policies to increase transparency in Artificial Intelligence (AI) data processing. The discussions addressed the personal information processing policy evaluation system, which examines whether companies clearly disclose the categories of personal data they handle, the legal basis for such processing, retention periods, third-party data sharing practices, and the mechanisms available for users to exercise their rights under the Personal Information Protection Act. The Commission identified several areas for improvement in the privacy policies of generative AI providers, including vague descriptions of the data involved, unclear explanations of the legal grounds relied upon, and limited accessibility for users. It recommended increasing the specificity of these policies so that individuals can better understand how their input data may be used for AI training, the applicable retention periods, and the opt-out options available.