In 2024, South Korea has seen a number of significant developments in its data protection and cybersecurity regulatory framework.

Major amendments to the Personal Information Protection Act (PIPA) and relevant updates to key cybersecurity laws, such as the Act on Promotion of Information and Communications Network Utilization and Information Protection (Network Act), came into force in September 2023. Since then, more detailed subordinate rules have also been gradually revised to implement these legislative changes, with the latest amendments coming into force in September 2024. Key changes include:

• Updated data breach notification standards, requiring controllers and processors to notify the Personal Information Protection Commission (PIPC) within 72 hours of becoming aware of certain high-risk breaches.
• Clarified the extraterritorial application of PIPA to overseas companies that provide goods or services to, or monitor the behavior of, Korean data subjects. In April 2024, the PIPC issued guidelines outlining the criteria for determining when PIPA applies to foreign companies.
• Announced a policy plan to strengthen the protection of online behavioral information used in targeted advertising. This includes clarifying stakeholder responsibilities, assessing privacy policies, and revising targeted advertising guidelines. In July 2024, the PIPC also published guidelines on the processing of publicly available personal data for AI development and services.
• Adopted new rules for automated decisions using AI that process personal data, giving data subjects the right to object to automated decisions that significantly affect their rights or obligations, with some exceptions. In September 2024, the PIPC issued a public notice and guidelines on these decision-making rights to facilitate data subjects' understanding.

No further significant changes to Korean privacy and cybersecurity laws are expected in the foreseeable future, as the major reforms have now been completed. However, in late December 2024, the National Assembly passed the Framework Act on the Development of Artificial Intelligence and the Establishment of a Trust Foundation (AI Framework Act), which is currently awaiting promulgation. If enacted, this would make South Korea the second jurisdiction after the EU to have comprehensive AI-specific legislation.