South Korea Flags DeepSeek for Unauthorized Data Transfers to China and U.S.

South Korea’s Personal Information Protection Commission (PIPC) has accused Chinese AI startup DeepSeek of transferring personal user data and prompt content without consent during its app launch in January 2025. The PIPC found that Hangzhou DeepSeek Artificial Intelligence Co. Ltd shared sensitive information with firms in China and the U.S., including Beijing Volcano Engine Technology Co. Ltd.

According to the PIPC, DeepSeek failed to obtain user consent while transmitting personal data, violating South Korea’s strict data privacy regulations. In February, the agency suspended new downloads of the DeepSeek app in South Korea after the company admitted it had overlooked certain compliance requirements.

The watchdog revealed that DeepSeek had sent user-entered AI prompt content, along with device, network, and app data, to Volcano Engine. The company later claimed the data transfer was intended to enhance user experience and has since halted the sharing of prompt content as of April 10.

In response, the PIPC issued a corrective recommendation requiring DeepSeek to delete all prompt data previously sent to Volcano Engine and to establish a legal basis for cross-border data transfers moving forward.

While DeepSeek has not commented on the matter, China’s Foreign Ministry responded by denying any state involvement in illegal data practices, stating that Chinese authorities have never instructed companies to unlawfully collect or store personal data.

This case underscores growing scrutiny over data privacy in AI applications and highlights the regulatory pressure on foreign tech firms operating in South Korea’s digital market. As data security concerns continue to rise globally, compliance with local privacy laws remains a critical requirement for international AI developers.