Law note · South Korea
PIPC Guideline on Processing Publicly Available Data for AI Development and Services
cite PIPC Guideline (issued 2024-07-18), applying Personal Information Protection Act (Act No. 10465, as amended), Art. 15(1)(6)
stage In effect
since 2024-07-18
reviewed 2026-08-23
PIPC guidance interprets PIPA Art. 15(1)(6)'s legitimate interest ground as the lawful basis authorizing an AI developer to collect and use publicly available personal data from the open web for AI training and service development, provided the controller's interest clearly overrides data subjects' rights. It treats such data as remaining within PIPA's scope, not exempt, given the privacy risk from addresses, unique identifiers, and financial data mixed into public web content.
The guideline's own text addresses AI developers and service providers generally, with no stated limit to private-sector controllers.
What it asks of an app
- An app training AI models on personal data scraped from publicly accessible Korean web sources must rely on and document PIPA Art. 15(1)(6)'s legitimate interest basis, since publicly available data is not exempt from PIPA.
When LexLint raises it
Declared activities: crawls_web, trains_models
Primary source: PIPC official English-language notice