Personal Information Protection Commission

Press Release

The PIPC’s Privacy Protection Framework Reform is Open to Public Consultation for the Era of AI 

- The PIPC’s Privacy Protection Framework Reform is open to public consultation from August 6 to August 31, 2026

- Open discussions are scheduled to be held to delve into proposals and ideas gathered during the public consultation period in order to transform the way the PIPC works

August 6, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) will kick off its reform of the privacy protection framework in earnest to address privacy challenges amid the ever-evolving AI landscape. On July 30, 2026, the PIPC launched a task force for reforming the Commission’s privacy protection framework. The window for submitting ideas on reforms has been open for public consultation since August 6, 2026, via the Privacy Portal (www.privacy.go.kr) and the Communication Reform 24 (www.sotong.go.kr).

1. Why Do We Need to Reform the Current Privacy Protection Framework?

The reform initiative aims to focus on capacity building and streamlining privacy regulations by overhauling the existing privacy protection framework. The PIPC will review the current framework to ensure it remains effective and practical in the ever-evolving data processing landscape, with a view to safeguarding privacy.

In the mid-1990s, Korea introduced its legal frameworks for privacy protection in the public, information and communications, and financial sectors. The legal framework evolved through the enactment of the Personal Information Protection Act (PIPA) in 2011. In 2020, the PIPA was amended in major parts by integrating laws and regulations that had been fragmented across individual sectoral laws.

However, Korea’s legal frameworks for privacy protection were designed in the context of the digital environment of more than thirty years ago. Accordingly, the PIPA has been largely consent-based, requiring data controllers to establish legal bases for the collection, use, and provision of personal information at each stage of data processing.

In the past, data processing mechanisms were much simpler than they are now. Data controllers, including entities and companies, collected and used personal information and they destructed after it became no longer necessary.

However, as we enter a data-driven economy, the scope of personal information has expanded beyond structured data of an individual to include unstructured data of third parties. In the context of AI, AI models are being trained on a wide range of data, multiple organizations increasingly link and utilize data, and agentic AI develops its own workflows to perform tasks on behalf of users.

Against this backdrop, concerns are constantly being raised that consent-focused privacy regulations have limitations in providing practical and meaningful protection, while causing inconvenience for individuals when using AI services or in the course of data processing.

The following explains the identified limitations.

Scenario 1: Obtaining Consent in a Repeated Manner

Under the current PIPA, legal bases for processing personal information beyond consent have expanded, but superficial consent practices still persist. Data subjects have limited understanding of privacy statement of policy which is TLDR; they are often bombarded with consent prompts. Such repeated consent requests can also lead to so-called “consent fatigue,” presenting challenges for data subjects seeking to exercise control over their personal information. Also, consent-based legal frameworks also undermine the effectiveness of privacy protection.

Scenario 2: Limitations in Conducting International Joint Research Using Pseudonymized Data

The current PIPA permits the use of pseudonymized data for scientific research, including medical research. However, practical difficulties may arise when such research is conducted jointly with overseas research institutions. In particular, additional requirements relating to cross-border data transfers may make international collaboration difficult. Where data has already been pseudonymized or de-identified, obtaining additional consent from data subjects is impractical in practice.

Scenario 3: Challenges in Providing Agentic AI Services

Agentic AI develops its own workflows in response to a user’s request, accessing and using a wide range of information to perform its tasks. When multiple agents interact with one another or are connected with external services or tools, obtaining new consent might be necessary. These developments highlight the limitations of applying consent-based legal frameworks to agentic AI environments and call for setting a new accountability structure for agentic AI. 

Scenario 4: Emerging and Unprecedented Privacy Challenges 

The emergence of physical AI is bringing new forms of devices that collect and process personal information, including robots, drones, smart glasses, and others. Such new and emerging technologies give rise to privacy issues that cannot be dealt with under the existing legal frameworks. In this regard, establishing or adjusting privacy principles, safeguards, plans to respect the rights of data subjects is needed in light of the evolving technological landscape.

2. The PIPC’s Privacy Protection Framework Reform Initiative

The PIPC’s privacy protection framework reform initiative is open to public consultation from August 6 to August 31, 2026. The public, businesses, academia, or civil society can give their views on how we can bring a reform in the current privacy protection framework to identify areas for improvement and challenges encountered in the field. Anyone can join this public consultation to share their ideas and proposals, including:

● Areas and tasks that require improvement in the privacy protection framework for the era of AI 

● Difficulties and challenges experienced by the public and the industry under the current legal and policy framework 

● Plans for improvement to enable the safer use of personal information 

● Privacy principles that need improvement or tweaks in the context of AI 

● Innovative ideas proposed by the public 

Those who significantly contribute to this public consultation will be recognized with the PIPC Chairperson’s award.

The Commission will review the proposals and select policy tasks, considering their feasibility and potential to bring meaningful improvements to the existing framework. Then, the PIPC will hold open discussion sessions and seminars. Such events will bring together members of the public, businesses, and experts to build social consensus on the need for reforms. Building upon a series of public consultation and review process, the PIPC plans to announce its plan to reform the privacy protection framework for the era of AI by the end of this year.

This initiative holds significance in that feedback and input from the public and hands-on experience serve as a starting point of policy making, rather than merely designing policies around the views of stakeholders and experts. Such shifts aim to change the way the government has been working.

Chairperson Kyung Hee Song said, “The PIPC’s mandate is to shape a new balance to enable the safer and responsible use of data in the public interest in the era of AI.” She added, “The PIPC will pursue reform that the public can benefit from by developing policies with the public”.  

* A PDF file, formatted for better readability, is attached.