The Personal Information Protection Commission (PIPC, 개인정보보호위원회) is South Korea's central administrative agency for data protection, enforcing the Personal Information Protection Act (PIPA). Alongside the AI Basic Act framework, the PIPC's data-protection authority is one of the two principal levers of South Korean AI governance.
3rd Basic Plan (2027–2029)
On July 3, 2026, the PIPC unveiled its 3rd Basic Plan for Personal Information Protection, covering 2027–2029. The plan shifts the commission's posture toward risk-proportional regulation of AI — scaling obligations to the risk a processing activity poses rather than applying uniform rules — and expands South Korea's overseas data-transfer networks with the United States, United Kingdom, and Japan (Source: korea.kr).
The plan was announced in the same week as several other Asia-Pacific regulatory moves, including Vietnam's Decision 33/2026 high-risk AI list and Hong Kong's personal-data AI sandbox for schools (Source: techieray.substack.com).
Relationships
- related: South Korea AI Basic Act (Framework Act on AI Development and Trust, 2024/2026) — companion AI-specific statute in South Korean AI governance.
- related: AI and Privacy — data-protection regulation of AI processing.
- related: Risk-Based AI Regulation — the plan's risk-proportional approach.
Sources
Coverage rests on the Korean government policy-news release (July 3, 2026) as summarized in secondary reporting; the plan's full text has not been ingested.