DeepSeek, a Chinese AI company, admitted to transferring personal data of South Korean users to servers outside the country. This development comes after South Korea’s Personal Information Protection Commission (PIPC) revealed that DeepSeek had shared Korean user data with four separate companies without obtaining consent beforehand or properly informing its users about the privacy policy or its move to share their information. The revelation compelled DeepSeek to release a partially updated Korean-language version of its privacy policy on Monday.

Revised Policy Addresses Regulatory Violations

According to the Yonhap News Agency, DeepSeek is under scrutiny in South Korea after regulators found that it mishandled users’ data. The Personal Information Protection Commission (PIPC) revealed that DeepSeek transmitted user prompts to Volcano Engine, a ByteDance-affiliated firm in China, without informing the user beforehand. Authorities ordered DeepSeek to delete the collected data, update its privacy practices, and provide a Korean-language privacy policy.

DeepSeek reacted by updating its rules, creating special safeguards for South Korea, and committing to abide by the Personal Information Protection Act. Nevertheless, its services remain suspended nationwide.

DeepSeek was operational in South Korea from January 15 but was halted on February 15, barely a month later, after impropriety allegations arose concerning illegal transfers of data to three Chinese companies and one based in the United States. The investigators confirmed that DeepSeek failed to disclose these data transfers in its privacy policy and did not obtain users’ consent.

The firm has admitted to mistakes in reviewing Korean data privacy regulations and has appointed a local representative to work with regulators. DeepSeek said that Volcano Engine’s services were only used to improve security and user experience.

DeepSeek has now changed its policy to enable customers to circumvent international data transfers and has suspended data transmissions since April 10. But its services still do not have access to South Korean platforms. The PIPC stated that operations may resume only after DeepSeek fully incorporates corrective measures in line with national privacy laws.

Meanwhile, as reported by Lokmat Times, South Korea’s government is accelerating activities to enhance local AI capabilities. Acting President Choi Sang-mok has stated plans to build a domestic AI chatbot as sophisticated as ChatGPT and allocated major state funds for R&D. The initiative entails acquiring 10,000 high-capacity GPUs in a year, a significant jump from the approximately 2,000 GPUs that the country had at the end of 2023, to enhance the nation’s position on the international artificial intelligence platform.

Broader Implications for Cross-Border Data Management

According to experts, South Korea’s strong regulatory posture could create a precedent for similar steps in other countries. While DeepSeek has not specified a particular date for resuming services in South Korea, the firm has stated its commitment to regulatory compliance and rebuilding user trust. In parallel, South Korean officials have issued a harsh warning that failing to achieve complete compliance may result in additional sanctions.

DeepSeek’s new policy modifications are important not only for its South Korean operations but also for the broader discussion over the regulation of cross-border data practices in the AI business. As global expectations for data privacy rise, businesses are being urged to go beyond reactive compliance and adopt a more proactive and responsible approach to handling personal information.

DeepSeek’s ability to reestablish itself in the Korean market will be largely contingent on its commitment to ongoing transparency, unyielding adherence to legal standards, and a sincere focus on user privacy.