Personal Information Protection Commission

Press Release

The PIPC Overhauls Guidelines on Pseudonymization by Introducing a Risk-Based Approach

- The overhauled guidelines ensure consistency in risk assessments and streamline paperwork and procedures

March 31, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) has overhauled its Guidelines on Pseudonymization to reflect the AI transformation (AX) and the fast-evolving data utilization landscape.

What is the Pseudonymized Data Scheme? 

- Objective: The Personal Information Protection Act (PIPA) introduced a special provision on pseudonymization to enable the safe use of data—a key driving force without compromising privacy 

- The Scheme Explained: It is a scheme to use data for AI training and other scientific research purposes by pseudonymizing data to prevent specific individuals from being identified, without having to obtain consent from data subjects 

- Pseudonymization Process: i) Preparation ii) iii) iv) Risk Review Pseudonymization Adequacy Review v) Safe Management

The revised guidelines aim to comprehensively address the difficulties and challenges arising from the ground since the launch of the Pseudonymized Data Scheme, rather than merely supplementing the existing framework.

To this end, the PIPC conducted fact-finding surveys and in-depth interviews with fifty AI powered companies and public institutions across the country to gather feedback from practitioners. It also thoroughly identified and analyzed challenges and areas for improvement through task forces comprising practitioners and experts. 

Standardized Risk Assessment System 

The Pseudonymized Data Scheme has created inconsistencies in assessing potential risks associated with pseudonymization. The assessment criteria have varied across organizations and persons in charge, as the assessment results were based on who reviewed it and entity specific interpretations. As a result, even similar cases produced different assessment results, undermining predictability and creating friction for practitioners willing to use pseudonymization. 

To address such challenges, the PIPC has newly established the Standardized Risk Assessment System, focusing on who will use pseudonymized data and under what conditions pseudonymization practice takes place. Under the revised guidelines, risks are categorized into three levels: low, medium, and high. Data utilization within the same organization is categorized as low risk, and third-party provision is categorized as medium or high risk, depending on whether the processing is controlled. The standardized criteria enable consistent and predictable assessments for the same cases. 

Meanwhile, the revised guidelines allow flexibility in adjusting risk levels by taking case specific considerations and internal rules into account.

Streamlined Procedures and Paperwork to Cut Red Tape

Previously, complex review procedures and extensive paperwork requirements have placed burdens on practitioners engaged in pseudonymization. Without clear criteria for streamlining such procedures, practitioners faced compliance burdens under the Personal Information Protection Act (PIPA). One-size-fits-all requirements, detached from real-world risk levels, have been applied to all practitioners willing to use pseudonymized data.

Outdated practices associated with pseudonymization have created barriers to data utilization, requiring excessive time and resources for unnecessary reviews and documentation. Even entities with limited capacity to pseudonymize were often discouraged to leverage pseudonymization. 

In this regard, the overhauled guidelines have introduced a risk-based differentiation of review procedures and documentation requirements, including a simplified procedure for processing pseudonymized data for low-risk cases, and significant reduction in documentation formats (from 24 to 10).

For instance, when pseudonymized data is used within the same organization, it does not entail new risks that arise from third-party provision. Such cases are classified as low risk, so it only requires review by the person in charge, rather than by a review committee. It also requires minimal documentation.

Aligning Guidelines with AI Developments in the Real World 

In lockstep with advancements in AI, the Pseudonymized Data Scheme has become more practical and adaptable in terms of its operational rules.

The Pseudonymized Data Scheme was criticized for being detached from the reality. It adhered to initial purposes and data minimization within agreed timelines. This approach often failed to keep pace with the scale-up and iterative training for AI.

For instance, once AI was developed for a specific purpose, such as scientific research, AI scale-up for other domains or performance improvement requires a new round of pseudonymization and review, as it was beyond the initial purposes. 

The overhauled guidelines allow entities to set pre-defined scalable purposes, laying the groundwork for using the same pseudonymized data for other purposes repeatedly within an expected scope. 

At the same time, the revised guidelines have introduced flexible criteria for setting processing periods, allowing continuous use of pseudonymized data for a certain duration to develop and advance AI services, given the nature of AI, which requires iterative training fed by data for performance improvement. 

Meanwhile, conducting a full review of large amounts of unstructured data (e.g., images, videos, and text) is often impractical. The guidelines have introduced more review mechanisms to improve data processing efficiency, including:

● Partial review

● Statistical sampling 

● Heuristic sampling

Improved Readability through Structural Reorganization

The overhauled guidelines focus on improving readability for a diverse range of target readers, from the general public to practitioners.

Previously, the guidelines addressed all the details of pseudonymization in a single guidance material, compromising readability. To improve readability, the guidelines are divided into two parts: 

i) Main Part: Provides definitions and procedures for pseudonymization in an easy to understand manners 

ii) Annex for Practitioners: Covers pseudonymization techniques, safeguards, instructions for documentation, and other details for practitioners to get it right

In addition, the guidelines include various use-case scenarios and Q&A sections to help practitioners address challenges arising from pseudonymization practices.

Chairperson Kyung Hee Song said, “The Pseudonymized Data Scheme faced a higher entry barrier due to complex procedures and conservative operational practices.” She added, “By fundamentally overhauling the Guidelines on Pseudonymization based on candid feedback from practitioners, the PIPC expects the overhauled guidelines to serve as a turning point for significantly expanding the use of pseudonymized data in an accelerating AX environment.” 

* A PDF file, formatted for better readability, is attached.