South Korea accuses DeepSeek of unapproved data transfers

South Korea’s data protection authority has accused Chinese AI startup DeepSeek of transferring user data without consent.

The Personal Information Protection Commission (PIPC) claimed that DeepSeek sent personal data to companies in China and the US after launching its app in South Korea in January.

In February, South Korea suspended new downloads of the DeepSeek app for failing to comply with data protection regulations.

The PIPC said DeepSeek transmitted AI prompt content, device, and network information to Beijing Volcano Engine Technology Co. Ltd.

DeepSeek later stopped transmitting AI prompt content on April 10 and stated the data transfer was for improving user experience.

The PIPC has ordered DeepSeek to delete previously transferred AI prompt content and establish a legal framework for overseas data transfers.

DeepSeek has not responded to requests for comment.

🔗 Source: Reuters

🧠 Food for thought

1️⃣ South Korea’s privacy enforcement reflects global AI regulatory momentum

The DeepSeek case highlights South Korea’s position among the world’s strictest privacy enforcers, operating through its Personal Information Protection Commission (PIPC).

South Korea revised its Personal Information Protection Act (PIPA) in 2023 to enhance data protection and align with global standards like GDPR, introducing stronger data subject rights and stricter consent requirements 1.

This enforcement action against DeepSeek demonstrates a growing global trend where privacy regulators are taking increasingly aggressive stances on cross-border data transfers, especially for AI technologies collecting large amounts of user data.

The PIPC’s action is consistent with its history of fining major tech companies like Facebook and Google for similar privacy violations, showcasing how even well-resourced international companies must adapt to local privacy regimes 2.

For AI companies, this represents a critical operational challenge. They must develop region-specific data handling protocols while maintaining their global technology platforms.