PIPA (Personal Information Protection Act)
South Korea's general data protection law, amended in February 2023 (effective September 2023) to formally recognize legitimate interest and contract performance as processing grounds alongside consent, in a narrower scope than GDPR's equivalents, administered by the Personal Information Protection Commission (PIPC).
Defined in 2 GAGE programs, which carry 6 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
South Korea's general data protection law, amended in February 2023 (effective September 2023) to formally recognize legitimate interest and contract performance as processing grounds alongside consent, in a narrower scope than GDPR's equivalents, administered by the Personal Information Protection Commission (PIPC).
South Korea's comprehensive data-protection law, under which Scatter Lab was found to have processed personal data beyond its stated collection purpose.
South Korea's data protection statute, which confines the use of personal information to the scope of the purposes stated at the time of collection, enforced by the Personal Information Protection Commission (PIPC).
South Korea's comprehensive data protection law, enforced by the Personal Information Protection Commission (PIPC), which permits cross-border transfer through a PIPC equivalence determination, transfer-specific consent, or comparable contractual safeguards.
South Korea's principal data protection law, which includes registration and record-keeping duties for personal information files, enforced by the PIPC.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Purpose archaeology: what your data was collected FOR versus what it feeds now · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Lawful basis, spelled out: consent, contract, legitimate interest, and which one actually covers each dataset · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Cross-border data: where your data may live and travel, decided with citations · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- The records of processing: the register a regulator reads first · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- The deletion that was not: personal data found in a model trained last year · Data Incidents, Certified AI Data Governance Professional (CADGP)
- Consent archaeology: what this data was collected for versus what you want to do · Data Reality, Certified AI Governance Professional (CAIGP)
Where it shows up at work
A definition is where PIPA (Personal Information Protection Act) starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Applies GDPR, CCPA and sector rules to training data, inference, automated decisions, lawful basis, individual rights and cross-border transfer.
2 lessons on this page teach it as a primary outcome.
Traces where data came from, what transformed it, who owns each hop and where it flows downstream, so a number can be defended.
2 lessons on this page teach it as a primary outcome.
Turns controls into enforceable obligations: data use, change notice, audit rights, incident duties, subcontractors, IP, exit and deletion.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Privacy Analystneeds working knowledge
- Chief Data Officer, data leadership editionneeds it at depth
- AI Regulatory Counselneeds it at depth · 14 open postings this week
- AI Privacy Engineerneeds it at depth · 6 open postings this week
- Data Governance Leadneeds it at depth · 2 open postings this week
- Third-Party AI Risk Analystneeds working knowledge
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: GDPR; CCPA/CPRA; EU AI Act Article 27; EU AI Act Article 10.
One interview question about it
Apply a privacy law you know to a model trained on customer records. Where is the legal basis, and where is the risk?
Asked of candidates for privacy law applied to ai. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Privacy and data protection carries it as work you can show: Privacy assessments and lawful-basis records are your work product.
- Legal and paralegal work carries it as a claim to back up: Privacy and consumer law are usually within reach.
- A law degree (JD, LLB or LLM), no AI work yet carries it as a claim to back up: Privacy and data protection law are usually a course, not yet a file.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.