South Korea's Regulatory Landscape at a Glance
South Korea's framework centres on PIPA, which since 2020 has consolidated rules previously spread across the Network Act and other statutes, with the Personal Information Protection Commission as the single central authority. Sectoral legislation including the Credit Information Act and the Location Information Act continues to apply alongside it.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- South Korea
- Primary data protection framework
- Personal Information Protection Act (PIPA), 2011
- Major amendments
- Data 3 Act consolidation in 2020 and the comprehensive amendment of 2023
Key Regulations in South Korea
Personal Information Protection Act (PIPA)
PIPA governs the processing of personal information by public institutions, corporations, organisations, and individuals. It applies broadly to any personal information controller that processes personal information to operate personal information files.
PIPA is notably more prescriptive than most regimes about consent: separate consent is generally required for distinct purposes, for third-party provision, for sensitive information, and for overseas transfer.
Depending on applicability, organisations may need to address:
- Obtaining consent separately for each distinct purpose.
- Restrictions on processing sensitive information and unique identifying information.
- Appointment of a privacy officer.
- Notice and disclosure through a published privacy policy.
- Safety and security measures prescribed in subordinate legislation.
- Breach notification to data subjects and to the Commission.
- Conditions for providing personal information to third parties.
- Grounds for transferring personal information overseas.
PIPA's consent architecture does not map cleanly onto a GDPR lawful basis analysis, and treating consent as interchangeable between the two regimes is a common source of non-compliance.
The 2020 Data 3 Act Consolidation
In 2020 Korea amended PIPA, the Network Act, and the Credit Information Act together, in a package commonly called the Data 3 Act. Data protection provisions that had sat in the Network Act were moved into PIPA, and the Personal Information Protection Commission was elevated to a central independent authority.
The package also introduced the concept of pseudonymised information, which may be processed without consent for statistical, scientific research, and public archiving purposes, subject to safeguards.
Consequences of the 2020 consolidation may include:
- A single regulator for most personal information matters.
- Removal of the separate information and communications service provider regime from the Network Act.
- Introduction of pseudonymised information and permitted processing without consent.
- Restrictions on combining pseudonymised datasets between controllers.
- Prohibition on attempting to re-identify pseudonymised information.
Special provisions applying to information and communications service providers were retained within PIPA for a period and have since been restructured. Confirm which provisions apply to your business model.
The 2023 Amendment
A comprehensive amendment taking effect from September 2023, with some provisions following later, revised several core elements of PIPA. It expanded the grounds for cross-border transfer beyond consent, changed the calculation basis for administrative surcharges, revised the breach notification deadline, and introduced rights concerning automated decisions.
The amendment also strengthened the Commission's powers, including the ability to order suspension of cross-border transfers.
Changes introduced by the amendment may include:
- Additional lawful grounds for transferring personal information overseas.
- Surcharges calculated by reference to total revenue rather than related revenue.
- A revised deadline for notifying data subjects and the Commission of a breach.
- A right to refuse or seek explanation of fully automated decisions.
- Expanded provision for data portability in specified sectors.
Provisions of the 2023 amendment commenced on different dates and depend on subordinate decrees. Confirm the commencement position for each measure before relying on it.
Cross-Border Transfers and the Domestic Agent
Transferring personal information outside Korea requires a ground under PIPA. Historically this meant separate consent in nearly all cases; following the 2023 amendment additional grounds are available, including where the destination country or recipient has been recognised as providing protection equivalent to PIPA, or where certification has been obtained.
Separately, overseas controllers without a domestic place of business that meet prescribed criteria must designate a domestic agent in Korea, in writing, to handle privacy officer duties including complaints and breach notification.
Organisations transferring data out of Korea may need to consider:
- Which transfer ground is available and how it is documented.
- Disclosures about overseas recipients required in the privacy policy.
- Whether a domestic agent must be designated and how that is evidenced.
- The Commission's power to order suspension of a transfer.
- Onward transfer by the overseas recipient.
The domestic agent requirement is distinct from a GDPR Article 27 representative and must be assessed separately against the Korean criteria.
Security Measures and Subordinate Legislation
Much of the operational detail of Korean compliance sits in the Enforcement Decree and in notifications issued by the Commission, particularly the standards for securing the safety of personal information. These are prescriptive, covering matters such as access control, encryption, and log retention.
Prescribed measures may address:
- Internal management plans and access authority control.
- Encryption of unique identifying information and authentication credentials.
- Retention and review of access logs.
- Measures against malicious programs and physical safeguards.
- Destruction of personal information once the purpose is achieved.
Because these requirements are specified rather than risk-based, a programme designed only around a general reasonableness standard will usually fall short in Korea.
Sectoral Legislation
Sector-specific statutes continue to apply alongside PIPA. The Credit Information Act governs credit information and is supervised by the Financial Services Commission, the Location Information Act governs location data, and the Network Act retains provisions on network security and unsolicited commercial communications.
Sectoral considerations may include:
- Credit information rules for financial institutions and MyData services.
- Permits and consent requirements under the Location Information Act.
- Rules on unsolicited commercial electronic transmissions.
- Sector guidance issued by the Financial Services Commission.
Where a sectoral statute applies, it may prevail over PIPA on the matters it addresses.
Who Needs to Comply With Korean Data Protection Law?
PIPA and related requirements may apply to:
Organisations operating in Korea
Any personal information controller processing personal information in Korea, including corporations, organisations, and individuals.
Overseas businesses serving Korean users
Companies outside Korea whose processing affects data subjects in Korea, which the Commission has pursued in practice.
Organisations needing a domestic agent
Overseas controllers without a Korean place of business that meet the prescribed criteria must designate a domestic agent in Korea.
SaaS and outsourcing providers
Entrusted processors handling personal information for a controller, where the entrustment must be documented and disclosed.
Employers
Organisations handling employee and recruitment information, including resident registration numbers subject to specific restrictions.
Financial and location service providers
Businesses subject to the Credit Information Act or the Location Information Act in addition to PIPA.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under PIPA
Consent, Separately Obtained
Where consent is the basis for processing, PIPA generally requires it to be obtained separately for distinct matters, including collection and use, provision to third parties, processing of sensitive information, and overseas transfer. Data subjects must be told the required matters and that they may refuse, together with any consequence of refusal.
Bundling consents into a single acceptance is a frequent finding in Korean enforcement actions.
Privacy Officer and Internal Governance
A personal information controller must designate a privacy officer responsible for overseeing processing, handling complaints and remedies, and establishing internal controls. An internal management plan and prescribed safety measures must be implemented.
Overseas controllers meeting the criteria must designate a domestic agent in Korea to perform these functions locally.
Unique Identifying Information
Resident registration numbers may be processed only where specifically permitted by statute or in other narrowly defined circumstances, and alternative identification methods must generally be offered. Other unique identifying information is also subject to additional conditions and encryption requirements.
Collecting resident registration numbers by default, including for account verification, is restricted and should be assessed carefully.
Breach Notification
On becoming aware that personal information has been lost, stolen, or leaked, a controller must notify the affected data subjects of prescribed matters without delay, and must report to the Commission or a specialised institution within the period set by PIPA, which the 2023 amendment set at 72 hours.
Notification to data subjects is required irrespective of a harm threshold, which is stricter than regimes with a risk-based trigger.
Entrustment and Third-Party Provision
PIPA distinguishes entrusting processing to a service provider from providing personal information to a third party. Entrustment requires a written agreement covering prescribed matters and public disclosure of the entrusted work and entrustee, while third-party provision generally requires separate consent.
Characterising a vendor relationship incorrectly changes the consent and disclosure requirements, so the distinction should be documented.
Destruction and Retention
Personal information must be destroyed without delay once the retention period expires or the purpose of processing is achieved, using a method that makes recovery impossible. Where other legislation requires retention, the information should be stored separately.
Data Subject Rights Under PIPA
PIPA gives data subjects a number of rights over their personal information. Depending on the circumstances, these may include:
Right to Be Informed
Data subjects may be informed of the processing of their personal information and of the matters required at the point of consent.
Access
Data subjects may request access to their personal information held by a controller, including through the Commission for public institutions.
Correction and Deletion
Data subjects may request correction or deletion of their personal information, subject to statutory retention requirements.
Suspension of Processing
Data subjects may request that processing of their personal information be suspended, on the grounds set out in the Act.
Automated Decisions
The 2023 amendment introduced rights to refuse or to seek an explanation of decisions made by fully automated means that significantly affect rights.
Data Portability
Provision for transmitting personal information to the data subject or another controller has been introduced, with sectoral implementation.
Controllers must provide a method for exercising these rights that is no more difficult than the method used to collect the information.
South Korea's Regulatory Timeline
Korea consolidated and then substantially strengthened PIPA over a decade.
- September 2011
PIPA in Force
The Personal Information Protection Act took effect, creating a general framework covering both the public and private sectors.
- August 2020
Data 3 Act Consolidation
Amendments moved data protection provisions from the Network Act into PIPA and established the Commission as the central independent authority.
- December 2021
EU Adequacy
The European Commission adopted an adequacy decision for Korea, supporting transfers of personal data from the EEA.
- September 2023
Comprehensive Amendment
A major amendment revised cross-border transfer grounds, surcharge calculation, breach notification timing, and automated decision rights.
Important: provisions of the 2023 amendment commenced on different dates and depend on subordinate decrees. Confirm the current position using official sources before changing your compliance programme.
Data Protection Authorities in South Korea
The Personal Information Protection Commission (PIPC) is Korea's central data protection authority. Since 2020 it has consolidated supervisory functions previously shared with other bodies. It issues guidance and decrees, investigates, and can impose corrective orders, administrative fines and surcharges, and order the suspension of cross-border transfers. It publishes its enforcement decisions.
Other authorities may be relevant depending on the activity, including the Financial Services Commission for credit information, the Korea Communications Commission for certain network and marketing matters, the Korea Internet and Security Agency for security and certification, and prosecutors for criminal matters.
Organisations should identify which authority supervises their sector rather than assuming that the PIPC is the only one.
Penalties for Non-Compliance
Korea applies both administrative and criminal sanctions, which makes it unusual in severity. Administrative surcharges for serious violations are calculated by reference to revenue, and the 2023 amendment changed the basis from revenue related to the violation to total revenue, with a statutory ceiling of 3%. Separate administrative fines apply to a long list of specific procedural failures, and the Commission can issue corrective orders and order the suspension of overseas transfers.
Criminal liability is genuine rather than theoretical. PIPA provides imprisonment and criminal fines for conduct such as processing without the required consent, providing personal information to a third party without a lawful basis, or re-identifying pseudonymised information, with the most serious offences carrying multi-year prison terms. Data subjects may also claim damages, and PIPA provides for statutory damages in cases of loss, theft, or leakage without the data subject needing to prove actual loss.
How RegulatoryBridge Supports Compliance in South Korea
RegulatoryBridge helps organisations assess South Korea's regulatory requirements and coordinate their compliance activities with wider international programmes.
PIPA Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Privacy Officer and Domestic Agent Assessment
Review your Chief Privacy Officer appointment and, for overseas controllers, whether a domestic agent in Korea is required and how that role is documented.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and PIPC Notification
Evaluate breach assessment procedures, escalation responsibilities, PIPC notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess cross-border transfers against the grounds in PIPA, including consent, certification, and recognised equivalence, and the disclosures required in your privacy notice.
Sectoral Compliance Coordination
Help organise requirements across PIPA, the Credit Information Act, financial sector rules, and location information legislation.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, PIPC guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to South Korea Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to South Korea.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About South Korea Compliance
Need PIPA support in South Korea?
We support your privacy officer and domestic agent arrangements, PIPC interactions, and breach notification readiness - so your global product team doesn't have to.