The Personal Data Protection Act is a law to balance "protection of individual rights and interests" and "utilization of personal data." It has been revised since its enactment in 2003 in accordance with social conditions and technological progress. The revision in 2020, which was reviewed every three years, was aimed at "protecting the rights and interests of individuals," "strengthening the utilization of data," and "corresponding to AI and big data." The revision in 2021 integrates the three laws of the Personal Data Protection Act, the Personal Data Protection Act of Administrative Agencies, and the Personal Data Protection Act of Incorporated Administrative Agencies into one law. Regarding the protection system, the post-integration law stipulates common rules nationwide, and the entire jurisdiction will be unified by the Personal Information Protection Commission. Under such circumstances, I studied the utilization of medical data.