South Korea’s Personal Information Protection Commission (PIPC) has found that the Chinese artificial intelligence startup DeepSeek collected and transferred personal data from local users to entities in China and the United States without their consent. The PIPC released its written findings on Thursday, following a thorough privacy and security review of DeepSeek. This investigation comes after DeepSeek voluntarily removed its chatbot application from South Korean app stores in February at the recommendation of the PIPC. At the time, DeepSeek pledged to address the agency’s concerns and cooperate fully. The PIPC discovered that during DeepSeek’s operation in South Korea, the company shared user data with multiple firms in China and the U.S. without obtaining the required permissions or informing the users. Specifically, the agency found that DeepSeek transmitted information from user-written AI prompts, along with device, network, and app usage data, to Beijing Volcano Engine Technology Co., a Chinese cloud service provider. While the PIPC noted that Beijing Volcano Engine Technology is affiliated with ByteDance, the owner of TikTok, the watchdog clarified that the cloud platform operates as a separate legal entity and has no direct relationship with ByteDance. DeepSeek stated that it utilized Beijing Volcano Engine Technology’s services to enhance the security and user experience of its chatbot application. However, in response to the PIPC’s findings, the company halted the transfer of AI prompt information effective April 10. This move underscores DeepSeek’s attempt to rectify the situation and align with South Korea’s stringent data protection regulations. The incident highlights ongoing concerns about the handling of sensitive user data by AI startups operating internationally and the importance of robust data governance measures to ensure compliance with local laws. As countries continue to tighten their data protection frameworks, companies like DeepSeek will need to be increasingly transparent and cautious in how they manage and share user information.