Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

South Korea: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
Amended
South Korea PIPAKorea's comprehensive privacy law, with consent-centric processing, breach notification, cross-border transfer rules, automated decision rights (since 2024), and revenue-based penalty surcharges. The 2026 amendment, effective 11 September 2026, raises the maximum fine to 10% of total revenue for aggravated cases, makes the CEO the ultimate responsible person, requires notice when a breach is merely possible, and makes ISMS-P certification mandatory for certain entities from 1 July 2027.Next: Jul 1, 2027 Mandatory ISMS-P certification · in 8 months
In force
South Korea AI Basic ActKorea's comprehensive AI law: transparency duties (notify users in advance that AI is used, label generative AI outputs and deepfakes), risk management, explainability and human oversight for 'high-impact' AI (e.g. hiring, lending, healthcare), safety duties for very large models (10^26 FLOPs+ training compute), and a domestic representative for large foreign providers. MSIT is running a grace period of at least one year, deferring fact-finding and fines except in serious cases.In effect since Jan 22, 2026

Upcoming deadlines

ComplianceJul 1, 2027 · in 8 months
South Korea PIPAMandatory ISMS-P certificationISMS-P certification becomes mandatory for private entities meeting the statutory criteria.South Korea

Past deadlines

Takes effectSep 11 · 46 days ago
South Korea PIPA2026 PIPA amendments take effect10%-of-revenue fines, CEO accountability, and notice duties for possible breaches apply.South Korea
MilestoneMar 10 · 8 months ago
South Korea PIPA2026 PIPA amendment promulgated (Act No. 21445)Amendment raising fines to 10% of revenue and adding CEO accountability promulgated.South Korea
Takes effectJan 22 · 9 months ago
South Korea AI Basic ActAI Basic Act and Enforcement Decree take effectTransparency, labeling, high-impact AI, and domestic representative obligations apply (fines deferred during the grace period).South Korea