Skip to content
Back to Destinations

South Korea: compliance overview

2 regulations, 15 mapped obligations and 1 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind usContact an advisor

Regulatory timeline: what comes next

  1. 2025-01-21

    Original Act promulgated as Act No. 20676

    Korea AI Framework Act

  2. 2026-01-20

    Partial amendment promulgated as Act No. 21311

    Korea AI Framework Act

  3. 2026-01-22

    The AI Framework Act enters into force, together with the bulk of the amendment

    Korea AI Framework Act

  4. 2026-03-10

    2026 amendment promulgated as Act No. 21445

    Korea Personal Information Protection Act (PIPA)

  5. 2026-07-21

    Certain amended provisions commence six months after promulgation

    Korea AI Framework Act

  6. 2026-09-11

    2026 amendment enters into force, six months after promulgation

    Korea Personal Information Protection Act (PIPA)

  7. 2027-07-01

    Mandatory privacy certification (proviso to Art. 32-2(1)) begins to apply

    Korea Personal Information Protection Act (PIPA)

Applicable regulations (2)

AmendedData & privacyRelevance Critical

Korea Personal Information Protection Act (PIPA)

A Chinese AI company falls within PIPA where it: (1) supplies apps, websites or model APIs to users in Korea and processes their personal information; (2) has no address or place of business in Korea but meets the revenue and data-holding thresholds set by Presidential Decree, in which case it must designate a domestic representative in writing and is treated as having committed any violation by that representative; (3) takes processing work on entrustment from a Korean company and is caught by the Art. 26 entrustment rules, where the principal’s failure to manage and supervise is itself surcharge-eligible; or (4) moves Korean personal information into China — Art. 28-8 defines “transfer” to include provision (including where the data can be queried), entrusted processing and storage, so merely making data queryable from Korea on a Chinese server is a transfer.

8 obligations · reviewed 2026-09-12

Phased applicationAI regulationRelevance Critical

Korea AI Framework Act

Article 4(1) states that the Act applies to acts done abroad where they affect the domestic market or users. For Chinese AI companies this means: (1) offering generative AI features to Korean users through app stores, the web or APIs triggers the Art. 31 prior-notice and output-labelling duties, and breach of the Art. 31(1) notice duty is expressly an administrative-fine offence under Art. 43; (2) placing a model whose cumulative training compute exceeds the Presidential Decree threshold on the Korean market triggers the Art. 32 risk-management system and the duty to submit implementation results to MSIT; (3) where the product falls within high-impact AI (defined in Art. 2, with criteria and examples to be published by the Minister), the five Art. 34 measures must be implemented and verifiable documentation retained; and (4) an operator with no Korean establishment that meets the user-count or revenue thresholds must designate a domestic representative or be directly exposed to an administrative fine. AI developed and used solely for national defence or national security purposes, as prescribed by Presidential Decree, is out of scope.

7 obligations · reviewed 2026-09-12

Data transfer routes

  • Korea PIPA cross-border transfer of personal information (Arts. 28-8 to 28-11)

    No volume threshold. What matters is how broadly Korean law defines transfer: providing (including where the data is accessed from abroad), entrusting processing and storing abroad are all covered - so hosting Korean user data on offshore cloud, remote access by offshore operations teams and outsourcing processing to an offshore vendor are all overseas transfers requiring one of the five bases in Art. 28-8(1). The companion provisions matter too. Article 28-9 lets the Protection Commission order a controller to suspend an overseas transfer where the transfer is continuing or further transfers are expected and either (1) Art. 28-8(1), (4) or (5) has been breached, or (2) the recipient, or the destination country or international organisation, fails to protect personal information appropriately by comparison with this Act so that damage to data subjects has occurred or is markedly likely; a controller served with such an order may object to the Commission within 7 days of receipt. Article 28-10 allows reciprocal restrictions on controllers from countries that restrict transfers out of their own jurisdiction, except where required to perform a treaty or other international agreement. Article 28-11 applies Arts. 28-8 and 28-9 mutatis mutandis where a recipient under the proviso to Art. 28-8(1) transfers the data on to a third country.

    Lead time: Estimate: 2-4 weeks for the ground (3) route (privacy policy disclosure or notification); 3-5 weeks for the separate-consent route including consent UI changes; the ground (4) certification route depends on the recipient obtaining certification and typically takes months. · Cost band Medium

What you can use right now

Playbooks

Entering Japan and Korea: APPI, PIPA and Korea’s AI Framework Act

What has actually happened here

Sources (7)

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.

GDPR · PIPL · CCPA control mapping
Traceable AI · cited when sourced
ISO 27001 alignment in progress
WCAG 2.1 AA accessibility target
South Korea: compliance overview | HaiWen HQ