We Resolve Legal Matters
How can we assist you?
Blogs
More-
Generative AI and Personal Data: What Businesses Should Check Before Uploading Customer Information or Contracts
Businesses are increasingly using generative AI to review contracts, summarize meetings, respond to customer inquiries, and draft documents. However, when contracts or other materials entered into an AI service contain personal data relating to customers or employees, the issue extends beyond operational efficiency. It may raise concerns regarding personal data processing, confidentiality, and the management of internal business information. Businesses should therefore understand how an AI service stores and uses input data and establish internal rules that reflect how generative AI is actually used within the organization. How Is Information Entered into Generative AI Processed? From the user’s perspective, generative AI appears to involve simply entering a question and receiving a response. In practice, however, prompts and uploaded files are transmitted to the service provider’s systems. Depending on the service policy and account type, they may be retained as conversation records or system logs and may also be used to improve the service. Before entering business materials, companies should check: ▪️ Whether input data may be used to train the AI model ▪️ How long conversations and uploaded files are retained ▪️ Whether conversations and uploaded materials can be deleted ▪️ In which country and on which servers the data is processed ▪️ What access permissions are granted when the AI is connected to external applications or internal systems Using a paid or enterprise account does not automatically resolve every data protection issue. The relevant contractual terms and actual data-processing arrangements must also be reviewed. Is Information No Longer Personal Data Once the Name Is Removed? Removing a customer’s name or contact information from a contract does not necessarily mean that the remaining information is no longer personal data. Personal data includes not only information that directly identifies an individual, such as a name, but also information that may identify a person when combined with other readily available information. Even after a name has been removed, an individual may still be identifiable through a combination of information such as: ▪️ The company name and a specific job title ▪️ The contract date and transaction amount ▪️ The employee’s department and performance evaluation ▪️ Detailed consultation history and family relationships ▪️ A case number and the location of a dispute A company name alone is generally information about a legal entity. However, when combined with a specific position, transaction details, or other contextual information, it may make an individual employee or representative identifiable. Businesses should therefore remove information that is unnecessary for the intended task rather than deleting names alone. Actual names, contact details, company names, and similar identifiers may also need to be replaced with fictional or generic information. Does Entering Customer Information Automatically Violate Korea’s Personal Information Protection Act? Entering customer information into a generative AI service does not automatically constitute a violation of Korea’s Personal Information Protection Act, commonly referred to as the PIPA. However, a business may generally use personal data only within the scope of the original purpose of collection and an appropriate legal basis. It is therefore necessary to assess whether the intended AI use is related to the original processing purpose and whether additional consent or another legal basis is required. The relationship between the business and the AI service provider must also be reviewed. The applicable legal framework may differ depending on whether the provider processes data solely on the company’s instructions or also uses the input data for its own purposes, such as model training or service improvement. Depending on the actual arrangement, the use of the service may involve outsourced processing, third-party provision, or other forms of data processing. If personal data is transferred to servers or service providers located outside Korea, the requirements governing overseas transfers must also be considered. The applicable rules cannot be determined solely from the fact that customer information was entered into an AI service. Businesses should review the actual contractual structure and data flow, including: ▪️ The legal basis for using personal data in the relevant AI task ▪️ The purposes for which the service provider uses input data ▪️ Whether the data is used for training or service improvement ▪️ The data-retention period and deletion procedures ▪️ The server locations and countries to which data is transferred ▪️ The involvement of subprocessors or downstream service providers ▪️ How input data is handled after the service contract ends Contracts and Consultation Records Raise More Than Personal Data Issues Contracts and customer consultation records may contain confidential business information in addition to personal data. Examples include: ▪️ Transaction terms and supply prices ▪️ Sales strategies and business plans ▪️ Technical materials and development information ▪️ Confidentiality obligations agreed with customers or business partners ▪️ Strategies for litigation, investigations, or other disputes ▪️ Non-public financial information and internal decision-making materials Entering such information into an external generative AI service may raise issues under the PIPA, but it may also create risks involving contractual confidentiality obligations, trade secret protection, customer security agreements, and internal company policies. A corporate generative AI policy should therefore cover not only personal data but also trade secrets, contractual information, technical materials, and dispute-related documents. Internal Rules Businesses Should Establish for Generative AI Use When employees are left to decide individually how generative AI should be used, the company may be unable to identify what information has been entered into which external service. Rather than issuing a general instruction not to enter personal data, businesses should establish practical and specific rules that employees can follow in their day-to-day work. 1. Approved Services and Accounts The company should designate the generative AI services and account types that employees are permitted to use. Employees should also be prohibited from entering business materials through personal accounts or unapproved services. 2. Prohibited Input Data The company should clearly define the information that must not be entered into generative AI services. This may include resident registration numbers, bank account information, health information, other sensitive or high-risk personal data, trade secrets, non-public contractual terms, and materials relating to litigation or criminal investigations. 3. Approval Procedures for High-Risk Documents High-risk materials, such as contracts, human resources documents, and customer consultation records, may be made subject to prior review or approval by the responsible department. 4. Standards for Removing or Replacing Identifying Information Businesses should establish standards for removing or replacing information that could identify an individual or a transaction party, including names, contact details, company names, and transaction amounts. Rather than uploading an entire contract, employees should extract only the clauses required for the relevant task. Actual customer information may also be replaced with fictional names or sample data. 5. Conversation History and Model-Training Settings The company should determine whether the service allows input data to be excluded from model training, whether conversation history can be disabled, and how deletion features operate. 6. Internal Reporting and Incident Response Employees should be required to report promptly if personal data or confidential business information is entered into an AI service by mistake. The company should also establish procedures for deleting records, disabling external integrations, requesting deletion from the service provider, and taking any other necessary measures. What Should a Business Do If Customer Information Has Already Been Entered? If an employee mistakenly enters customer information or an internal document into a generative AI service, the company should first stop any further sharing or use of the resulting output. The following matters should then be reviewed: ▪️ Which account and AI service were used ▪️ What personal data or confidential information was entered ▪️ Whether the conversation and uploaded files can be deleted ▪️ Whether the service was connected to any external applications ▪️ Whether the information may have been used for training or service improvement ▪️ Whether a third party may have gained access to the information Where necessary, the company should delete the conversation history and uploaded files, revoke external access permissions, and request that the service provider stop processing or delete the relevant information. Whether the incident requires a personal data breach report or notification to affected individuals should be determined by considering the type and volume of information involved, the possibility of third-party access, whether the data has been deleted, and the potential harm to the individuals concerned. Effective Generative AI Use Requires Governance, Not Just Prohibition Generative AI can improve efficiency in contract review, document drafting, and customer communications. However, when its use is left entirely to individual employees, a business may have little control over where customer information and internal documents are transmitted or how they are subsequently used. Businesses should establish specific rules regarding approved services, prohibited data, the removal or replacement of identifying information, approval procedures for high-risk documents, and incident response. Decent Law Firm advises businesses on the legal use of generative AI, including compliance with Korean personal data protection requirements, review of service terms and data-processing agreements, overseas data transfers, trade secret protection, and the preparation of internal AI-use policies. This content is provided for general informational purposes only and does not constitute legal advice regarding any specific matter or business.
-
Startup Investment Contracts: Key Clauses Every Founder Must Review
You've probably heard it before: "Always have your term sheet reviewed before signing." Yet in practice, founders sign under pressure all the time — tight on cash, eager not to upset the investor, telling themselves they'll sort out the details later. It's one of the most common and costly mistakes in early-stage fundraising. Today's investment agreements are no longer simple documents. Milestone-based funding, KPIs, valuation adjustments, anti-dilution provisions, and redemption rights are all interconnected — and if you don't understand how they work together, you can lose meaningful equity and control without ever realizing it. This guide breaks down the trends we're seeing in Korean startup investment contracts right now, and what founders need to watch out for before they sign. 1. Why the Structure of Investment Contracts Has Changed Not long ago, founders could negotiate reasonably well by focusing on one question: how much equity for how much money? That's no longer enough. Modern investment agreements tie together valuation, milestone-based disbursements, anti-dilution mechanisms, redemption and repurchase rights, preferred share structures, drag-along rights, and rights of first refusal — all within a single document. Looking at any one clause in isolation is where founders get into trouble. As the funding environment has become more cautious, investors are building in more downside protection. That means founders need to be equally deliberate about guarding against excessive dilution and loss of operational control. Understanding how these contracts are structured before you sit down to negotiate can make a significant difference in the outcome. 2. Milestone-Based Funding: When Capital Doesn't Come All at Once One of the most notable shifts in recent Korean investment contracts is the move toward milestone-based disbursements. Rather than transferring the full investment amount upfront, investors release funds in tranches as the company hits pre-agreed targets. A typical structure might look like this: KRW 300 million at signing, an additional KRW 200 million upon reaching a monthly revenue target, and a final KRW 200 million tied to a product launch milestone. Before agreeing to this structure, founders should clarify three things. First, are the milestones defined precisely enough to be objectively measured? Vague language is a breeding ground for disputes. Second, what happens if a milestone is partially met — does disbursement pause entirely, or is there a proportional release? Third, who has the authority to determine whether a milestone has been achieved, and by what standard? The question isn't just whether the milestones sound reasonable on paper. It's whether your team can realistically hit them given your current resources, market conditions, and execution capacity. 3. KPI Definitions: Where Disputes Are Born As milestone structures have become more common, the question of which KPIs govern those milestones has become equally important. Founders are increasingly seeing metrics like MRR/ARR, retention rates, repeat visit rates, and conversion rates written into contracts — not just headline numbers like downloads or registered users. What matters more than the metric itself is how it's measured and over what time period. Take a seemingly straightforward target like "monthly revenue of KRW 100 million." Is that a one-time achievement, or does it need to be sustained for three consecutive months? Are refunds and discounts excluded from the calculation? Which data source governs — your internal accounting records or the settlement reports from your payment processor? These details should be spelled out explicitly in the contract. Ambiguity here is not a minor issue — it's where investor-founder disputes actually start. 4. Valuation, Dilution, and Anti-Dilution: What's Behind the Number Valuation is naturally where founders focus their attention. But the headline number matters far less than what happens to ownership percentages in subsequent funding rounds. Anti-dilution provisions protect existing investors when a later round closes at a lower valuation than the current one. The two most common mechanisms — full ratchet and weighted average — produce very different outcomes for founders. Full ratchet adjustments can significantly increase dilution; weighted average formulas tend to be more founder-friendly. Knowing which applies to your contract is essential. Refixing clauses deserve equal attention. These allow the per-share price to be retroactively adjusted if certain performance conditions aren't met. On the surface, your equity stake looks fixed. In practice, falling short of targets can trigger additional dilution you didn't plan for. A high valuation is worth celebrating — but only after you understand the dilution and adjustment mechanisms attached to it. 5. Penalties for Missed Milestones: Repurchase, Redemption, and Termination Wherever milestone structures exist, penalty provisions follow. Founders need to understand exactly what happens if targets aren't met. ✔️ Repurchase clauses require the founder to buy back the investor's shares if a milestone is missed. The key variable is price: is it the original investment amount, or does it include interest? ✔️ Redeemable Convertible Preferred Shares (RCPS) give investors the right to demand repayment under certain conditions, or to adjust the conversion ratio in their favor to protect their returns. ✔️ Contract termination clauses define how the agreement is unwound entirely if things go wrong, including how already-disbursed funds are settled. From a founder's perspective, the critical question is whether a missed milestone leaves the company any room to maneuver — or whether it creates an immediate liquidity crisis with no exit. You may not be able to eliminate these protections entirely, but their severity and scope are almost always negotiable. Before You Sign: Three Things to Check First Are the milestones and KPIs genuinely achievable given your team's current capacity and market conditions? What dilution and adjustment mechanisms are attached to the valuation, and how do they interact? And if milestones are missed, how severe are the penalties — and where are the limits? Getting clear on these three structural questions before you enter negotiations will put you in a materially stronger position. If any clause raises a red flag, or if the overall structure feels difficult to parse, we recommend reviewing the full contract rather than relying on a clause-by-clause reading. The risks in these agreements are often in how the provisions connect, not in any single term read in isolation. Decent Law Firm's Corporate Practice Team works with founders on investment contract reviews with a focus on practical risk — equity structure, dilution exposure, and penalty provisions. If you're approaching a closing, send us the key terms and we'll give you a clear, efficient assessment of where the real risks lie.
-
Korea FSS Cracks Down on Finfluencers: What KOLs Need to Know About Legal Risk
Korea's Financial Regulator Is Now Actively Targeting Finfluencers Korea's Financial Supervisory Service (FSS) has confirmed illegal activity across five YouTube channels offering paid stock recommendations and automated trading programs, and has announced it will refer the operators for criminal investigation. The finfluencer and KOL market in Korea has effectively entered a period of full regulatory scrutiny. Four of the five channels identified were found to have provided investment advice and recommendations without registering as quasi-investment advisory businesses, in potential violation of the Financial Investment Services and Capital Markets Act (FSCMA). Three of them charged tiered subscription fees ranging from approximately $2 to $450 per month for stock analysis and picks, while a fourth recommended entry and exit timing for leveraged U.S. ETFs. A fifth operator was flagged for selling an automated stock trading program without the required investment discretionary business license. The FSS has stated it will refer unregistered financial investment operators for criminal investigation and has indicated that front-running and other market manipulation activities will be pursued by its special judicial police unit. Legal Risks by Service Type ① Quasi-Investment Advisory Registration Risk (Paid Recommendations & Tip Services) If you operate a paid stock tip channel or recommendation service and collect regular subscription fees or tiered membership dues, your business may be subject to quasi-investment advisory registration requirements under the FSCMA. Describing your content as "information sharing" does not provide legal protection — regulators assess how the service actually functions. ② Unlicensed Investment Discretionary Business Risk (Automated Trading Bots & Signals) If your automated trading bot or signal service effectively executes or directs trades on behalf of subscribers, it may fall within the scope of investment discretionary business, which requires a formal license. As this latest crackdown demonstrates, operating without the required license carries serious criminal exposure. ③ Front-Running and Undisclosed Advertising Risk Recommending products or securities while in an undisclosed paid or sponsored relationship may violate both advertising disclosure laws and FSCMA investment solicitation rules. Recommending securities you already hold with the intent to sell after the price rises can constitute market manipulation, and the FSS has made clear it intends to pursue these cases aggressively. If Any of These Apply to You, Your Business May Already Be at Risk You should seek legal advice immediately if any of the following describe your situation. You operate a paid stock recommendation or tip service You sell or license an automated trading bot or signal subscription You have affiliate or sponsorship relationships with ETF, crypto, or platform providers but your disclosure practices are unclear You have seen a recent increase in refund requests or customer complaints You have received any inquiry or document request from a financial regulator or investigative authority Once a referral for criminal investigation is initiated, the consequences — channel suspension, account freezes, and criminal liability — can materialize simultaneously. A brief legal review now can prevent a far larger problem later. 5 Things You Should Review Right Now First, clarify the legal classification of your business. Whether your service constitutes simple information provision, quasi-investment advisory, or investment discretionary business has significant legal consequences — and the answer depends on how your service actually operates, not how it is labeled. Second, review your Terms of Service, disclaimer language, and product descriptions for compliance with the FSCMA, the E-Commerce Act, and the Act on Regulation of Terms and Conditions. A generic disclaimer stating that users are responsible for their own investment decisions is not sufficient protection. Third, establish internal guidelines for advertising, sponsorship, and affiliate disclosures. Conflict of interest disclosure standards and revenue-sharing transparency should be defined at the content planning stage, not added as an afterthought. Fourth, if you operate a paid community on Telegram, KakaoTalk, or Discord, document the permitted scope of content, as well as your refund and cancellation process. Clear internal rules significantly reduce the risk of disputes and regulatory complaints. Fifth, build pre-launch legal review into your routine before releasing new services, changing your fee structure, or entering into significant partnerships. Decent Law Firm's Virtual Asset Team Is Here to Help Finfluencer and KOL businesses sit at the intersection of content regulation, marketing law, community management, investment advisory rules, and platform compliance. Managing these risks requires a perspective that spans financial regulation, capital markets law, platform liability, and criminal exposure — general contract review alone is not enough. Decent Law Firm's Virtual Asset Team provides tailored legal services covering business structure assessment, compliant model design, Terms of Service and advertising guideline review, and dispute and investigation response. If you are uncertain whether your current business structure is legally sound, contact Decent Law Firm today.
-
Why AI Startups in Korea Need IT Legal Counsel
Before you build, make sure your service is structured to survive legally — not just technically. The Best Time for Legal Advice Is Before You Launch Getting an AI model up and running, connecting APIs, and opening a beta service can happen surprisingly fast. But building a service that is legally sustainable — one that properly addresses data use, privacy, copyright, and liability — is an entirely different challenge. Legal counsel is most effective not after development, but at the service planning and data architecture stage. A last-minute terms review before launch is a patch, not a solution. The following questions need to be answered before you write a single line of code. What data can you legally collect, store, and use for training? Is it legally safe to use customer data for model fine-tuning? Who owns the copyright to AI-generated outputs, and who is liable when things go wrong? Building a service without addressing these questions means going to market with structural vulnerabilities already baked in. 3 Regulatory Risks Every AI Startup in Korea Must Address As of 2026, the regulatory environment for AI startups operating in Korea has crystallized around three key areas. First, Korea's AI Basic Act is now in effect, introducing formal requirements around explainability, safety, and accountability for AI services. Second, the Personal Information Protection Commission has introduced punitive fines and class action mechanisms, making data incidents an existential risk rather than a compliance footnote. Third, when your infrastructure combines third-party AI APIs with cloud and SaaS tools, failing to clearly define terms, licensing boundaries, and liability exposure means that in any dispute, the startup absorbs all the risk while platform providers walk away unaffected. If Any of These Apply to You, Get Legal Advice Now You should seek IT legal counsel if you are in any of the following situations. You are designing a data collection or AI training pipeline for a new service You are providing B2B white-label or custom solutions built on third-party AI APIs Your Terms of Service or Privacy Policy do not accurately reflect how your service actually works Your B2B contracts have unclear SLA terms, liability caps, or IP ownership provisions You have already launched but feel uncertain about your data, contract, or terms structure The assumption that "we can fix it after launch" is a costly one. The larger your service grows, the more expensive and disruptive it becomes to restructure the legal foundation underneath it. How Decent Law Firm's Corporate Legal Team Works Decent Law Firm goes beyond reviewing contracts and terms in isolation. We take an integrated approach — examining your service architecture, data flows, and business model together to identify and address legal risks before they become problems. Service structure and data flow analysis AI, privacy, and contract risk mapping Terms of Service, Privacy Policy, and internal policy review B2B and SaaS contract structure design Legal structuring for investment readiness and international expansion If you are building an AI service or have already launched but are uncertain about your legal structure, contact Decent Law Firm today.
-
Must-read if you are wondering how to review an employment contract and respond effectively
Why an employment contract is not a mere “formality,” but a risk-management document Employment contracts are often treated as formal documents used simply to complete the hiring process. In reality, however, a significant number of labor disputes originate from the wording of the contract itself. In many cases, contracts are formally executed but contain provisions that fail to meet the standards set by the Labor Standards Act and other relevant laws, or they repeatedly use clauses where the actual working conditions differ from those stated in the contract. In practice, once a dispute arises, the rights and obligations of the parties—and the scope of liability—are determined based on the working conditions specified in the employment contract. For this reason, reviewing an employment contract should not be viewed as damage control after a problem occurs, but as a preventive measure designed to block disputes from arising in the first place. This process is not a simple document check; it is the starting point for managing legal risks that may persist for years. Key clauses that most frequently cause problems in employment contracts Clauses that lead to disputes tend to follow consistent patterns. If the structure of wages is unclear—such as the distinction between base salary, bonuses, and various allowances (overtime, night work, holiday work, etc.)—disputes often arise during the calculation of ordinary wages, average wages, and retirement benefits (Labor Standards Act Article 2(1)5 and 6). Dispute risk also increases when provisions regarding prescribed working hours, overtime, night work, and holiday work are drafted in broad or vague terms rather than with sufficient specificity. In particular, comprehensive wage systems (fixed overtime pay systems) are frequently applied in form only, without satisfying the required conditions—such as difficulty in calculating actual working hours—resulting in especially high legal risk (see Supreme Court Decision, May 20, 2010, 2008Da6052, among others). Issues also commonly arise where the title of a worker—such as fixed-term employee or freelancer—does not match the actual nature of the work performed, leading to disputes over employee status. Likewise, unclear standards for contract expiration, termination, or renewal repeatedly become sources of conflict (Act on the Protection of Fixed-Term and Part-Time Employees, Article 2(1)). Ultimately, the core issue is not whether a clause exists, but how it is drafted, which is precisely why a proper employment contract review is necessary. When is an employment contract review necessary? The most effective time is before entering into the contract, specifically just prior to signing. Review is also critical when a contract is renewed, working conditions are changed, or personnel and compensation systems are restructured. It is likewise necessary when discrepancies emerge between the terms stated in the contract and how they are actually implemented—particularly with respect to wages, retirement benefits, and working hours—or when early signs of dispute appear. Conducting an employment contract review in advance, rather than after a dispute has already arisen, can significantly reduce legal costs and risks. For those who feel uncertain or anxious due to legal ambiguity surrounding their employment contract, it is important to understand that professional review at an early stage can decisively influence the outcome of any future dispute. Conversely, delaying proper review and response may expand the scope of legal liability or make dispute resolution more difficult, requiring a cautious and proactive approach. Decent Law Office’s approach to employment contract review Decent Law Office does not stop at refining wording. Each clause is analyzed for risk based on real labor disputes and judicial precedents, with a focus on structural vulnerabilities that could lead to conflict. Furthermore, the firm considers response strategies that can be immediately implemented should a dispute arise in the future. Through this approach, employment contract review becomes not a one-time procedure, but an ongoing risk-management tool. An employment contract is not a document to consult after a dispute occurs—it is a document designed to prevent disputes from occurring at all. With Decent Law Office, a single employment contract review can reduce long-term accumulated legal risks, and that choice ultimately protects both the organization and the individual.
-
How to Draft a Contract, and Why You Need a Lawyer's Review
Contracts can be formed as "consensual contracts," meaning they are valid as long as there is mutual agreement between the parties (congruence of intentions). In other words, verbal agreements are still considered contracts, and a written contract is not always necessary for a contract to be established. If every contract in the world were honored as promised, there would be no need for written contracts. Unfortunately, because some people do not keep their promises, it is necessary to draft a contract before proceeding with any matter. The presence of a contract makes a significant difference when taking legal action against those who fail to uphold their promises. In litigation, a contract serves as a golden ticket. A contract is a dispositive document that includes the agreed-upon terms between the parties and their confirming seals or signatures. During a trial, the contract is the most crucial piece of evidence, and unless there are exceptional circumstances, the judge cannot make a decision that deviates from the content of the contract. Many people underestimate the importance of contracts. Actions such as proceeding without a contract due to "industry practices," relying on "trust," using a "standard contract," or signing a contract presented by the other party without review are all risky behaviors.
