The South Korean Personal Information Protection Commission (PIPC) has presented its third three-year basic plan (2027-2029) aimed at adapting the data protection framework to the era of artificial intelligence (AI).

This plan proposes a transition to a protection system centered on principles and proportionate to risks, moving away from uniform regulation deemed unsuitable for AI. It foresees the creation of a "Secure Support Center for AI Transformation (AX)" to support innovation. The focus is on a preventive approach, with enhanced controls for high-risk sectors and incentives for companies investing in proactive protection measures, such as reductions in financial penalties. The responsibility of executives and data protection officers will be increased, while breaches will be subject to harsher sanctions, including the introduction of coercive fines and penalties for illegal data circulation. The plan also aims to strengthen individuals' sovereignty over their data through a "MyData" platform (OnMyData) and to address risks related to new technologies such as agentic AI, physical AI, and deepfakes by establishing risk assessments and transparency standards.

The plan foresees interministerial collaboration to harmonize regulations and avoid duplication, notably with financial and competition authorities. On the international level, it aims to extend the network of secure data transfers beyond the European Union, to countries such as the United Kingdom, Japan, and the United States, relying on tools such as standard contractual clauses and binding corporate rules. An impact assessment on cross-border data transfers will also be established. For data subjects, a single point of contact will be set up to facilitate the exercise of rights, from complaint to compensation. Particular attention will be given to the protection of sensitive information such as biometric and video data, as well as to the protection of minors.