Personal Information Protection Commission

Press Release

The PIPC Revises Guidelines on Writing a Privacy Policy to Enhance Readability and Introduce Criteria for Generative AI 

- The PIPC has revised its “Guidelines on Writing a Privacy Policy.” 

- The revised guidelines introduce a new annex for generative AI services and the PIPC will host a briefing session to help practitioners on April 28, 2026

April 24, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) has revised its “Guidelines on Writing a Privacy Policy” to align with shifts in the data processing landscape driven by the proliferation of generative AI and on-device AI services.

A privacy policy is a document written by a data controller to inform data subjects about what personal information is collected and how it is processed. It serves as a fundamental means to ensure transparency in processing personal information and uphold the rights of data subjects.

The revision aims to ease the administrative burdens on data controllers and to safeguard the rights to self-determination of the Korean people.

The key revisions are as follows:

First, when there is a large or frequently changing number of third-party recipients or processors entrusted with data processing, data controllers may categorize them as ‘taxi drivers,’ ‘delivery workers’ and others within the privacy policy. However, the privacy policy needs to include a clear channel through which detailed information about such recipients or processors can be accessed to ensure transparency.

Second, notifying changes to a privacy policy is overhauled in a practical way. Changes that have a significant impact on data subjects’ rights should be notified without delay either before or after the revision. At the same time, changes that pose a low risk to data subjects’ rights, such as lists of entrusted or subcontracted processors, can be notified collectively in the privacy policy within a certain time frame (e.g., 4 weeks).

Third, the guidelines clarify the criteria for on-device data processing. When personal information is stored on servers, data controllers should write a privacy policy, even if they run partially on-device. Conversely, when personal information is not transferred to external servers and is processed entirely on-device, data controllers are encouraged to inform users about this practice, along with data deletion criteria.

Fourth, the revised guidelines specify what data processors should include when writing a privacy policy. Data processors’ privacy policy needs to include the information on a chief privacy officer (CPO), subcontractors, and others that are directly relevant to safeguarding data subjects’ rights.

Fifth, the guidelines also overhaul the criteria for behavioral data processing and a privacy notice (i.e., a summarized version of a privacy policy). For behavioral data processing, the revision provides processing-specific scenarios, enabling data controllers to write their privacy policies with readability and clarity tailored to their specific processing contexts. For a privacy notice, the guidelines clarify requirements, including categories and purposes of data processing, retention and use periods, the status of third-party provision and entrustment, and how to exercise data subjects’ rights.

In addition, the revised guidelines introduce a new annex dedicated for generative AI services. The annex encourages data controllers to clarify intended use cases, specifying when and for whom generative AI services are used. At the same time, the annex also requires transparency when user-entered data, including text, voice recordings, attachments, and generated outputs, are collected and stored; data controllers should include such practices as items of personal information to be processed in their privacy policies. It also encourages data controllers to take extra care for sensitive data or uniquely identifiable information within AI inputs.

The revised guidelines also advise that data controllers include whether user-entered data is used for training AI models, outline opt-out procedures, and specify how to report or lodge a complaint for inappropriate outputs in privacy policies, thereby raising the level of respect for data subjects’ rights.

On April 28, 2026, the PIPC will host a briefing session at the Korea Science and Technology Center to support businesses and practitioners in understanding the revised guidelines. Registration is available via https://privacy.kait.or.kr.

Secretary-General Cheongsam Yang said, “In a rapidly evolving technological environment driven by generative AI and on-device AI, data controllers should ensure that data subjects have a better understanding of how and for what purposes their personal information is processed.” He added, “The PIPC expects that the revised guidelines offer clearer criteria for practitioners and enable people to find out how their personal information is processed in a privacy policy.”

The revised guidelines are available on the PIPC’s website (www.pipc.go.kr) and the Privacy Portal (www.privacy.go.kr).

* A PDF file, formatted for better readability, is attached.