CONTENTS
- 1. Personal Information Protection | Background of the Guideline Revision
- 2. Personal Information Protection | Key Revisions
- - Introduction of a Risk-Based Assessment Framework
- - Differentiation of Procedures and Documents
- - Reflection of the AI Development Environment
- - Improvement of the Standards for Processing Unstructured Data
- 3. Personal Information Protection | Key Practical Issues
- - Corporate Response Strategy
- - Corporate Practical Checklist
- - Implications and Risk Management Direction
1. Personal Information Protection | Background of the Guideline Revision
On March 31, 2026, the Personal Information Protection Commission announced a complete revision of the Guidelines on the Processing of Pseudonymized Information.
Although this revision does not change the statute itself, it fundamentally restructures the practical standards for how the special provisions on the processing of pseudonymized information are actually designed, reviewed, and documented, and it therefore has a direct impact on companies, public institutions, and AI developers as a whole.
In particular, the key point of this revision is the shift away from the previous formalistic and uniform operation toward a risk-based assessment framework.
Accordingly, companies will need to approach pseudonymization for personal information protection as a matter affecting the entire data governance framework.
This complete revision was carried out to reflect the practical problems that had continually been raised in the field.
The Personal Information Protection Commission conducted a fact-finding survey and in-depth interviews with 50 AI companies and 1,441 public institutions, and the following matters were identified as the principal problems.
- Ambiguity in the criteria for assessing risk
- Excessive burden of documentation and procedures
- The gap between the AI development environment and regulatory standards
- The burden of full inspection of unstructured data such as video, images, and text
Previously, even for identical matters, conclusions often varied depending on the institution or the person in charge, and practitioners tended to operate conservatively, regardless of the actual risk, because of the burden of liability.
This revision improves that structure by shifting to a framework that reflects both the realities of data utilization and the risk of re-identification.
2. Personal Information Protection | Key Revisions
The key revisions are as follows.
Item | Previous Problem | Revised Content | Practical Meaning |
Risk assessment | Variation in assessment by institution | Introduction of criteria based on the utilizing entity and the processing environment | Securing consistency in assessment |
Procedures and documents | Excessive documentation requirements | Differentiation by risk level | Reduced costs for low-risk cases |
AI development | Rigidity in purpose and period | Expanded purposes, flexible periods | Model advancement made possible |
Unstructured data | Burden of full inspection | Sample inspection permitted | Processing of large volumes of data made possible |
Documentation framework | Mixed structure | Separation into a main volume and supplementary volumes | Improved practical accessibility |
Introduction of a Risk-Based Assessment Framework
The most important change is the standardization of the criteria for risk assessment.
Whereas previously risk factors were enumerated and evaluated individually, after the revision the assessment centers on the following two criteria.
Accordingly, the following structure has been established.
Category | Assessment Criteria | Risk Level |
Internal use within the same personal information controller | No external provision, internal analysis and combination | Low risk |
Provision to a third party + controllable environment | Controllable, such as an analysis space | Medium risk |
Provision to a third party + uncontrollable environment | External transfer, and the like | High risk |
Differentiation of Procedures and Documents
- Number of forms: reduced from 24 types to 10 types
- Low risk: minimal documentation and review by the person in charge
- Medium and high risk: in-depth review by stage
This structure lowers the barrier to entry for low-risk projects while allowing high-risk projects to be managed more precisely.
Reflection of the AI Development Environment
- Permitting expandable purpose definitions
- Flexible processing periods
- Repeated training and model advancement made possible
As the previous rigid purpose restrictions have been relaxed, the practical usability of AI project design has improved significantly.
Improvement of the Standards for Processing Unstructured Data
- Full inspection changed to permitted sample inspection
- Reflecting the reality of processing large volumes of data such as video, audio, and text
However, the burden of proof has been further strengthened with respect to the reasons for selecting the inspection method, the sample design, supplementary measures, and recordkeeping.
3. Personal Information Protection | Key Practical Issues
The core of this revision is that it treats the processing of pseudonymized information not as a mere technical matter but as a management framework spanning the entire process.
Companies must be able to explain the following matters.
In particular, the risk level is not a fixed value but a factor that varies according to the project design.
- Internal use leads to low risk in principle
- External provision leads to an increase in risk depending on the level of control
- Unstructured data is a high-risk factor in principle
Accordingly, advance classification and the recording of reasons for adjustment are expected to serve as key compliance elements.
Corporate Response Strategy
In response to this change, companies should establish the following response strategies.
Legal and Compliance Organizations
- Reclassify all data utilization projects
- Review whether they fall within the scope of the special provisions on the processing of pseudonymized information
- Make purpose statements more specific (AI training broken down into model and metric units)
Data and AI Organizations
- Design on the premise that unstructured data = high risk
- Establish a sample inspection design and recordkeeping framework
- Separate training data from service output
Security, IT, and Business Divisions
- Redesign the external provision structure
- Review the contractual structure with entrusted service providers
- Establish a framework for access privileges, log management, and transfer control
Corporate Practical Checklist
The following items are criteria that can be used in actual internal corporate reviews.
Data Utilization and Risk Management
- Are there criteria for the advance classification of risk by project
- Is internal use distinguished from external provision
- Has a controllable analysis environment been secured
Pseudonymization and Inspection Framework
- Are there criteria for reviewing the appropriateness of the pseudonymization method
- Is there a separate inspection framework for unstructured data
- Are the sample inspection design and supplementary procedures documented
Documentation and Evidentiary Framework
- Securing specificity in purpose definition (by model and metric unit)
- Recording the grounds for risk assessment
- Retaining records of review and approval procedures
Contractual and External Provision Structure
- Reflecting personal information protection clauses in contracts with entrusted service providers
- Establishing a framework for transfer control and the management of access privileges
- Securing log records and the capacity for subsequent tracing
Implications and Risk Management Direction
This revision conveys the following message.
Data utilization is expanding, but the responsibility to demonstrate the legitimacy and safety of that utilization is being strengthened.
The simplification of low-risk cases, the expansion of AI purposes, and the permitting of sample inspection are clear regulatory relaxations, yet they operate favorably only for companies that have an explainable risk management framework.
The revised guidelines are not a matter that can be resolved through a technical response alone, and the appropriateness of processing pseudonymized information ultimately comes down to a question of legal explainability.
Daeryun Law Firm LLP provides the following advisory services throughout the entire process of corporate data utilization.
In particular, for issues that combine data, IT, and legal matters, the firm provides an integrated advisory framework that understands both technology and law at the same time, which makes it possible to secure practical response capabilities.
If you need assistance with a related matter, you are welcome to schedule a 🔗legal consultation with the firm.
