South Korea has one of Asia’s strictest privacy regimes and, since January 2026, one of the world’s first comprehensive AI laws after the EU’s. PIPA fines are calculated on total revenue, and 2026 amendments raise the ceiling to 10% in serious cases.
Foreign startups with Korean users often need a domestic representative under both PIPA and the AI Basic Act once they meet thresholds. Consent requirements are detailed and itemised, so Korean launches usually need dedicated consent screens.
- Core data law
- Personal Information Protection Act (PIPA)
- Regulator
- Personal Information Protection Commission (PIPC)
- AI law
- AI Basic Act, in force 22 Jan 2026
- Penalties
- Up to 3% of total revenue; up to 10% in serious cases after 2026 amendments
- Local presence
- Domestic representative above thresholds
- Consent
- Itemised, separate consents common
Who needs to comply
Any startup processing personal information of people in Korea
PIPA applies to personal information processors, including foreign businesses serving Korean users.
Generative AI and high-impact AI providers
The AI Basic Act requires notice and labelling for generative AI and risk management for high-impact AI.
Large foreign online services
Domestic representative duties apply above revenue or user thresholds.
E-commerce and platforms
The Act on Consumer Protection in Electronic Commerce and the Network Act add disclosures and security duties.
The laws, in detail
01Personal Information Protection Act (PIPA)
Collection, use, provision, overseas transfer, retention, destruction, security and breach notification.
When it applies
Processing personal information of data subjects in Korea.
What you must do
- Itemised consent with specified purposes, items, retention and right to refuse
- Separate consent for sensitive and unique identifying information
- Overseas transfer: consent or another legal basis, with disclosure
- Breach notification to individuals and the PIPC
- Privacy policy with prescribed contents; Chief Privacy Officer
- Domestic representative for qualifying foreign processors
Regulator
Personal Information Protection Commission
Penalties
Administrative fines up to 3% of total revenue (excluding unrelated revenue), rising to 10% for serious cases under the 2026 amendments; criminal penalties for some violations.
02AI Basic Act
Generative AI transparency, high-impact AI obligations and AI industry support.
When it applies
AI businesses whose services affect the Korean market.
What you must do
- Notify users when products use generative or high-impact AI
- Label AI-generated outputs, especially realistic synthetic media
- Risk management, explanation and human oversight for high-impact AI
- Domestic representative for qualifying foreign AI businesses
Regulator
Ministry of Science and ICT
Penalties
Fines up to KRW 30 million for certain violations, with a transition period.
03Network Act (Information and Communications Network Act)
Advertising transmission, network security and illegal information on online services.
When it applies
Online service providers and anyone sending commercial electronic messages to recipients in Korea.
What you must do
- Prior opt-in consent for advertising messages, with periodic re-confirmation
- Separate consent for ads sent between 9pm and 8am
- Identify the sender and provide easy opt-out
- Protective measures for information and communications networks
Regulator
Korea Communications Commission; Ministry of Science and ICT
Penalties
Administrative fines and corrective orders.
04Location Information Act
Collection and use of location information and location-based services.
When it applies
Businesses collecting device location or providing location-based services in Korea.
What you must do
- Report or register as a location-based service provider
- Consent for collecting and using personal location information
- Keep records of location data use and provision
Regulator
Korea Communications Commission
Penalties
Fines and criminal penalties for unlawful collection.
05Act on Consumer Protection in Electronic Commerce
Disclosures, withdrawal rights and platform duties in online sales.
When it applies
Selling goods or services to consumers in Korea online, including marketplaces.
What you must do
- Display business identity and transaction terms
- Honour withdrawal (cooling-off) rights
- Marketplace operators must disclose seller information
Regulator
Korea Fair Trade Commission
Penalties
Corrective orders and fines.
Compliance checklist
01 · Before you launch
- Design Korean itemised consent screens
- Decide the overseas transfer basis and disclosures
- Check domestic representative thresholds
- Classify AI features under the AI Basic Act
02 · At launch
- Publish a PIPA-compliant privacy policy
- Appoint a CPO
- Generative AI notices and labels
- Breach notification process
03 · As you scale
- Review penalty exposure under the 2026 amendments
- High-impact AI risk management
- Retention and destruction schedules
Key dates
- Sep 2023Major PIPA amendments (total revenue-based fines)
- 22 Jan 2026AI Basic Act in force
- 2026PIPA amendments raising maximum fines in serious cases
Common mistakes
- Bundling consents into one checkbox
- Forgetting to disclose overseas transfers and recipients
- No Korean AI labels on generated media
FAQs
Is Korea’s AI law like the EU AI Act?
It shares a risk-based idea but is lighter: transparency for generative AI, duties for high-impact AI and support measures, with lower fines.
Do we need a Korean entity?
Usually not, but you may need a domestic representative under PIPA and the AI Basic Act.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.