Source: IAPP

South Korea’s Personal Information Protection Commission released revised Pseudonymized Information Processing Guidelines on 31 March 2026 that operationalize an existing legal design to enable AI data use by treating pseudonymization as a legal gateway permitting certain processing without consent. The Guidelines emphasize a risk-based, contextual approach to pseudonymization that assesses processing environments, access controls, intended use and residual re-identification risks rather than fixed technical thresholds. They explicitly align the framework with AI development by clarifying that activities involving hypothesis-setting, data analysis, validation and iterative refinement may qualify as “scientific research,” and they list examples including fraud detection systems, medical imaging analysis, chatbots and intelligent CCTV.

The 2026 Guidelines let organizations define expandable purposes for closely related downstream uses of the same dataset to reflect iterative AI model development, and they follow earlier PIPC steps from 2024 and 2025 that clarified public-data use under legitimate interest and provided generative AI guidance. The trajectory is reinforced by a July 2025 South Korean Supreme Court decision holding that pseudonymization does not constitute “processing” for purposes of a data subject’s right to request suspension of processing, narrowing an ex ante avenue for blocking reuse and indicating judicial support for enabling data use under the pseudonymization regime.