Compliance
Otter.ai in South Korea
Structured issue-spotting for deploying Otter.ai in South Korea, read against the rules for that jurisdiction.
- Source
- Rules engine over a generic brief — no anchored quote on this page
- Verified
- Evidence not verified
- Confidence
- Low
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
01What this reading assumes
- Jurisdiction
- South Korea
- Principal framework
- Personal Information Protection Act (개인정보 보호법). The version in force is Act No. 20897, effective 2 October 2025. It sets consent and alternative bases, purpose limitation, retention limits, security duties, breach notification and cross-border rules, and since March 2023 has carried Article 37-2, the right of a data subject to object to or refuse a decision made by a completely automated system — expressly including systems applying artificial intelligence — where that decision significantly affects their rights or duties. An amendment promulgated on 10 March 2026 takes effect on 11 September 2026.
- Delivery assessed
- Enterprise SaaS
- Data leaves the network
- unknown — the deciding question for a hosted product
- Vendor home jurisdiction
- the United States
- Verified vendor positions
- none — every vendor position below is a question, not an assurance
- Rules evaluated
- 19
- Rules fired
- 13
Assumptions about use
- An internal deployment used by employees, not a public-facing product.
- A person reads the output before acting on it — but that is not recorded, so the engine reports it as a gap rather than assuming it.
- No significant automated decision is taken about a person by the system alone.
02Issues to work through
Cross Cutting
Confidentiality duties bind independently of data protection law
Material can be entirely free of personal data and still be the material a contract stops you disclosing. Client retainers, non-disclosure agreements, supplier contracts and common-law duties are the usual sources, and several of them require consent before a third party processes the material at all — which a model API call is.
- Required checks
- Review the confidentiality clauses in the contracts covering the material going into the system.
- Identify any contract requiring notice or consent before a subcontractor processes the material.
- Decide whether the deployment needs a confidentiality carve-out negotiated into new contracts.
- Vendor questions
- Will the vendor accept a confidentiality undertaking beyond its standard terms?
- Which staff at the vendor can access customer content, under what controls?
- Technical controls
- Segregate the most sensitive corpora into an index that the general assistant cannot reach.
Human review required — take this to your counsel
What ends up in a prompt, and where it goes next
Every prompt is a transfer of whatever it contains. Staff paste more than they intend, retrieved context travels with the prompt, and system prompts can often be extracted from the output. Assume anything reaching the model has left your control unless the contract and the architecture say otherwise.
- Required checks
- Write down which categories of information may be entered into a prompt, and tell people.
- Establish what the system prompt contains and whether disclosing it would matter.
- Establish which shadow tools staff are already using; the policy has to name the permitted ones.
- Vendor questions
- Are prompts and completions retained, for how long, and can retention be set to zero?
- Are prompts used for abuse monitoring, and if so who can read them and for how long?
- Technical controls
- Redact or block high-risk patterns before the prompt leaves the application.
- Keep prompt and completion logs out of general-purpose observability tools.
- Set an explicit retention period on prompt logs and enforce it.
The acceptable-use policy may exclude your use case
Acceptable-use policies commonly carve out unsupervised legal, medical and financial advice, decisions about people without human review, and some surveillance and biometric uses. They are incorporated into the contract by reference and change without a signature, so the version that matters is the one live on the day you rely on it.
- Required checks
- Read the acceptable-use policy against your actual use case, not against a summary of it.
- Where a carve-out applies, decide whether human review brings the use back inside the policy.
- Set a reminder to re-read the policy — it changes without notice to you.
- Vendor questions
- Does your acceptable-use policy permit this use case, and will you confirm that in writing?
- How are we notified when the acceptable-use policy changes?
Human review required — take this to your counsel
Being able to reconstruct a decision months later
The question that arrives after a complaint is what the system was shown and what it produced on a particular day. Models change, prompts change, and indexes are rebuilt, so the answer has to be recorded at the time. Without it, the only available response is that the output cannot be reproduced.
- Required checks
- Decide what is recorded per interaction: model and version, prompt template version, retrieved document ids, output, reviewer and outcome.
- Set how long those records are kept, balanced against the retention duties that also apply to them.
- Vendor questions
- Does the vendor pin model versions, and how much notice is given before a model is retired or changed?
- Technical controls
- Version prompt templates in source control and log the version used.
- Log the model identifier and version returned by the provider, not the one you requested.
Vendor documentation has not been verified
We could not verify a data processing agreement, a subprocessor list, a position on training on customer data and a stated processing region for this vendor from a retrieved document. That is a gap in our evidence, not a finding against the vendor: until a document has been fetched and read, nothing here should be treated as settled either way.
- Required checks
- Obtain the current versions of the processing agreement, subprocessor list, security page and any regional-processing commitment.
- Check that what the sales conversation promised also appears in the contract.
- Vendor questions
- Where is your data processing agreement published, and which version applies to us?
- Where is your subprocessor list, and how much notice do we get before it changes?
- Do you train on customer content by default, and where is that stated contractually?
- In which country or region is inference performed, and where are logs retained?
We were not told whether a person reviews the output
Where output influences a decision about a person, the reviewer has to be able to disagree with it. That needs three things a rubber-stamp review lacks: enough information to judge, enough time to judge, and an override that is used often enough to be real. Design it before the volume makes it impossible.
- Required checks
- Name the role that reviews the output and what they see when they do.
- Decide what evidence is retained about each review, so the practice can be shown to exist.
- Set a threshold below which the system must not act without review.
- Vendor questions
- Does the product expose the retrieved context and the confidence behind a suggestion, or only the answer?
- Technical controls
- Show the reviewer the retrieved sources next to the suggestion, not the suggestion alone.
- Record the reviewer’s decision, including overrides, as part of the audit trail.
Human review required — take this to your counsel
An AI deployment creates new copies of the data
Vector indexes, prompt logs, completion caches, evaluation datasets, fine-tuning checkpoints and backups are all copies of the source material in places the existing retention schedule does not mention. Deletion requests are the moment this is discovered, because deleting the source document does not delete its embedding.
- Required checks
- List every store the deployment creates and add each to the retention schedule.
- Establish how a deletion request propagates to the index, the caches and the logs.
- Establish how long backups keep material that has been deleted from the live system.
- Vendor questions
- What does the vendor retain, where, and for how long after we delete our copy?
- Technical controls
- Store the source document id with every embedding so deletion can cascade.
- Set time-to-live on prompt and completion logs rather than relying on manual cleanup.
The vendor’s terms may not permit the deployment you are planning
Provider terms routinely restrict things architectures assume: sharing seats, building a competing service, benchmarking and publishing results, reselling capacity, and processing certain data categories. A consumer or self-serve plan often carries different terms from the enterprise agreement, and the enterprise agreement is the one worth reading.
- Required checks
- Identify which contract actually governs — self-serve terms, an order form, or a negotiated agreement.
- Check restrictions on seat sharing and on service accounts, which a shared internal assistant can breach without anyone noticing.
- Check whether the terms allow the categories of data you intend to send.
- Vendor questions
- Which agreement governs our use, and can we have the current version in writing?
- Are there restrictions on the data categories or the industries we may use the service for?
South Korea
Cross-border provision needs a route, and the PIPC can stop it
PIPA permits providing personal information abroad on defined bases, and the Commission may order a transfer suspended where protection in the destination is inadequate. As elsewhere, the transfer in an AI deployment is often the inference call rather than the storage contract, so the analysis has to follow the data rather than the contract.
- Required checks
- Identify the route relied on and make sure it matches how the data actually moves.
- Give the required information about the destination and the recipient.
- Vendor questions
- Where is inference performed for Korean customers, and is a Korean or regional option available?
Human review required — take this to your counsel
Article 37-2 — the right to refuse an automated decision
PIPA gives a data subject the right to object to, or refuse, a decision made by a completely automated system — expressly including a system applying artificial intelligence — where that decision significantly affects their rights or duties. The controller must also disclose the criteria and procedure of such decisions. The PIPC has published guidance on what that requires in practice.
- Required checks
- Decide whether the system produces a decision or a suggestion, and whether the human step is real.
- Prepare the disclosure of the criteria and procedure before launch.
- Build the objection route and name who handles it.
- Vendor questions
- Does the product expose the reasoning behind an output at a level we could disclose?
- Technical controls
- Record the inputs behind each decision so an objection can be answered.
Human review required — take this to your counsel
The AI Framework Act is in force — settle whether this is high-impact AI
Korea’s AI Framework Act has applied since 22 January 2026, with the current consolidated version in force since 21 July 2026. Its heavier duties attach to high-impact AI, assessed on the area of use and the seriousness of the risk; the Enforcement Decree treats a system with a person in the final decision as controllable and therefore outside the category. The Ministry of Science and ICT has stated it will defer regulation for at least a year, running a guidance period for investigations and fines — that is enforcement policy, not a change to the law.
- Required checks
- Assess whether the use falls into one of the areas the Act names, and record the reasoning.
- Where a human decides, document how and confirm the human step is not nominal.
- Plan for the grace period ending; it is discretionary and dated from January 2026.
- Vendor questions
- Have you assessed this system against the Korean AI Framework Act, and will you share that assessment?
Human review required — take this to your counsel
PIPC guidance covers training data and the generative AI lifecycle
The Commission has published a guide on processing publicly available personal information for AI development and services, and a further guide organising personal-data issues by generative AI lifecycle stage. Neither is binding; both are the standard the regulator applies. A statutory special provision for AI training passed the National Assembly on 20 August 2026 but had not been promulgated on the review date, so it is not yet available relief.
- Required checks
- Work through the lifecycle guide for the stage you are actually at, rather than the whole document.
- Where training or fine-tuning is planned on collected data, check the publicly-available-data guide first.
- Vendor questions
- Is our content used for training, and can that be excluded contractually?
PIPA — a basis for the AI processing, and a version to cite
PIPA requires a basis for each purpose, purpose limitation and retention limits. Two amendments are in motion: one promulgated on 10 March 2026 takes effect on 11 September 2026, and an AI-training special provision passed the National Assembly on 20 August 2026 and has not been promulgated. Any statement about a PIPA article should name the version it is reading.
- Required checks
- Identify the basis for the AI processing specifically, not for the underlying system.
- Check whether the article you are relying on changes on 11 September 2026.
Structured issue-spotting to support your own review — not legal advice. Verify against the cited primary sources and your counsel.
03What this reading does not know
- Whether any of the data falls into a special or sensitive category.
- Whether any material is covered by legal professional privilege.
- Whether prompts or documents leave the company network.
- Whether a person reviews the output before it is acted on.
04Instruments these issues point at
- guidancePIPC Generative AI GuidePIPC guidance organising personal-data issues by generative AI lifecycle stage and setting out the legal standards and safeguards for each. Non-binding, and a workable structure for an internal assessment of a RAG or fine-tuning project.
- guidancePIPC Public Data AI GuidePIPC guidance offering an interpretive standard for processing publicly available personal information to develop AI, covering the legal basis, safety measures, data subject rights and the role of AI companies. The guide states on its own cover that it has no legal binding force.
- statuteAI Framework ActKorea’s comprehensive AI statute, in force since 22 January 2026. Sets duties around high-impact AI and generative AI and creates a national AI governance structure. An amendment promulgated two days before commencement deferred a handful of provisions to 21 July 2026; the Act as a whole was not delayed.
- guidancePIPC Automated Decision GuidePIPC guidance on what a controller must do when a data subject exercises rights over an automated decision, and on disclosing the scope, criteria and procedure of such decisions. It is the operative guidance for PIPA Article 37-2.
- guidanceMSIT AI Act Grace PeriodA government policy briefing recording that the Ministry of Science and ICT will defer regulation for at least a year to give firms time to prepare, running a guidance period for fact-finding investigations and administrative fines, with investigations reserved for exceptional cases such as loss of life or serious harm to rights.
- statutePIPAKorea’s data protection statute. Sets bases for processing, purpose limitation, retention limits, security duties, breach notification and cross-border rules, and gives a data subject the right to object to or refuse a decision made by a completely automated system, including one applying artificial intelligence, where it significantly affects their rights or duties.
- statutePIPA 2026 AmendmentA promulgated amendment to PIPA that takes effect on 11 September 2026, six months after promulgation, with two provisions deferred to 1 July 2027. The law information centre publishes it as a pending version alongside the text in force.
- proposalPIPA AI Special ProvisionAn amendment creating a special provision allowing lawfully collected personal data to be used for AI development where pseudonymised or anonymised data is insufficient, where public or social benefit is recognised, and subject to enhanced safeguards and Commission deliberation. It passed the National Assembly on 20 August 2026 and takes effect six months after promulgation, which has not yet occurred.
05Vendor documents being watched
- Pricinghttps://otter.ai/pricingnot yet fetched
- Privacy policyhttps://otter.ai/privacy-policynot yet fetched
- Terms of servicehttps://otter.ai/terms-of-servicenot yet fetched
06Ask about your own deployment
This page reads the rules against a generic organisation. Your size, industry, data and existing contracts change which of these issues matter and which fall away.