North Korea: technology regulation at a glance

Framework: No published domestic crypto-specific legislation; effective prohibition enforced through DPRK's command economy and total state information control; externally governed by UN Security Council Sanctions Regime (UNSCR 1718/2006 and successors 2270/2321/2371/2375/2397) and U.S. OFAC North Korea Sanctions Regulations (31 C.F.R. Part 510)

North Korea publishes no domestic legal framework permitting or regulating cryptocurrency for citizens; the state's command economy and near-total internet blackout for ordinary citizens effectively prohibit private crypto activity. Paradoxically, the DPRK state apparatus covertly deploys cryptocurrency as its primary mechanism for sanctions evasion and weapons-program financing, through state-sponsored cyber-theft units (Lazarus Group, Andariel) that stole an estimated USD 2.1-2.17 billion in crypto in 2025 alone, culminating in the February 2025 USD 1.5 billion Bybit breach, the largest crypto theft on record. The UN Panel of Experts mandated to monitor DPRK sanctions had its mandate terminated in April 2024 following a Russian veto, weakening multilateral enforcement.

Framework: No public AI-specific law, regulator, or published governance framework. AI is addressed only as a state development priority, anchored in the 'informatization' clause added to Article 26 of the Socialist Constitution (2019) and pursued through the Ministry of Information Industry and the Artificial Intelligence Research Institute (est. 2013), not through any transparent regulatory regime.

North Korea (DPRK) has no identifiable, publicly documented framework that regulates AI: there is no comprehensive AI law, no sectoral AI rules, and no published ethical guidelines accessible to outside observers. The state instead treats AI as a development and military-modernization priority, embedding 'informatization' in its constitution and tasking institutions like the Ministry of Information Industry with advancing AI/ML capabilities. Because the regime is closed and does not publish a regulatory regime, the country's overall AI-governance posture is best characterized as 'none' (development-driven, not rule-based).

Framework: No comprehensive or sectoral personal-data protection law. The DPRK Constitution nominally guarantees privacy of correspondence (Art. 17 'inviolability of the person and the home and privacy of correspondence'), but there is no data-protection statute, no data-subject rights regime, and no independent supervisory authority. State practice is governed instead by control/surveillance laws (Law on Protection of State Secrets; the 2020 Law on Rejecting Reactionary Ideology and Culture) enforced by the Ministry of State Security.

North Korea has no personal-data protection law and no data-protection authority. While the constitution formally references privacy of correspondence and the home, the state systematically monitors phone calls, text messages, emails and other communications and conducts warrantless searches of phones and storage devices. The legal framework is oriented toward state control of information rather than protecting individuals' personal data.

Framework: Electronic Payment Law (전자결제법, adopted by the SPA Standing Committee in late October 2021 and subsequently revised), administered by the Central Bank of the DPRK, which approves and supervises electronic payment networks. No conventional payment-institution/e-money licensing taxonomy, open banking, cross-border instant rails, or BNPL rules exist.

North Korea operates a closed, state-controlled domestic electronic-payments system rather than a market-style fintech licensing regime. An Electronic Payment Law passed in 2021 puts the Central Bank in charge of approving and supervising payment networks, which may be run by banks or by approved institutions/enterprises outside the banking sector, with state-issued electronic certificates required for transactions. The country has no open banking, no internationally interoperable instant-payment rails, and no BNPL framework; it is largely cut off from the global financial system by UN/US sanctions and a SWIFT disconnection.

Framework: DPRK State General Bureau of Tourist Guidance / Korea International Travel Company (KITC) control all foreign entry; immigration is administered by the state with no published civilian residency or remote-work regime. The U.S. imposes a passport travel ban (22 CFR via Secretary of State validation).

North Korea offers no digital-nomad, remote-work, or residency-by-investment pathway, and there is no general civilian immigration route. Foreign entry is limited to tightly controlled, state-organized guided tours plus rare diplomatic, humanitarian, and specialist-worker placements approved case-by-case by the government. As of 2026 even ordinary tourism remains largely suspended, with Russian nationals the only group recently admitted, making remote relocation effectively impossible.

Framework: Internet access in North Korea (DPRK) is controlled by the state as a matter of policy and security practice rather than by a single 'online safety' statute. The global internet is barred for the general public; control rests on the Korea Computer Center-curated national intranet (Kwangmyong), state telecom monopolies, and information-control laws led by the 2020 Law on Rejecting Reactionary Ideology and Culture (revised 2022).

North Korea operates one of the world's most closed information environments: ordinary citizens cannot reach the global World Wide Web and are confined to the curated domestic intranet (Kwangmyong), while open internet access is reserved for a small set of officials, researchers, and foreigners. The regime criminalizes the possession and distribution of foreign (especially South Korean) media under the 2020 Reactionary Ideology and Culture Rejection Law, with penalties up to execution, and enforces device-level surveillance such as smartphones that take periodic screenshots and substitute regime-approved vocabulary. There is no consumer-protection style 'online safety' or platform-liability regime; the system is built around censorship and state surveillance.

Framework: Information Technology Law (amended 2022) and related statutes (e.g., Software Industry Law, 2004), administered by DPRK state organs; there is no comprehensive, dedicated cybersecurity statute or independent data-protection authority. Cyber-related rules are embedded in broader state-control IT legislation.

North Korea (DPRK) has no comprehensive, NIS2-style cybersecurity law and no modern data-breach/incident-notification regime in the Western sense. Instead, security obligations are embedded in IT-control legislation, chiefly the Information Technology Law amended in 2022, which mandates state-standard security measures and registration for information systems, framed around regime control and 'self-reliant' technology rather than protecting private data subjects. The country operates a largely isolated national intranet (Kwangmyong) with all external traffic routed through a small number of foreign providers, reflecting a model of centralized state control rather than a transparent regulatory framework.

Framework: DPRK Foreign Investment Law and related statutes (Equity Joint Venture Law, Contractual Joint Venture Law, Foreign Enterprises Law) administered by state economic bodies, but overridden in practice by UN Security Council sanctions (notably Resolution 2375, 2017) and national sanctions regimes (e.g. US EO 13722).

North Korea has a written domestic framework that nominally permits equity joint ventures, contractual joint ventures and wholly foreign-owned enterprises, mainly within designated special economic zones, with state approval. However, UN Security Council Resolution 2375 (2017) prohibits all new and existing joint ventures and cooperative entities with DPRK persons, and major jurisdictions ban new investment outright, so lawful foreign company formation is effectively closed for nearly all foreigners. FDI has collapsed to near-zero and most special economic zones have stalled.