Korea Personal Information Protection Act (PIPA)

Collection, use and provision of personal information must rest on one of the grounds in Arts. 15, 17 and 18; where consent is relied on, it must be obtained separately and distinguishably under Art. 22, and service must not be refused because consent beyond what is necessary was declined. Processing the data of a child under 14 requires the legal representative’s consent.

Applies when

All personal information controllers processing data of users in Korea, including entities established abroad.

Evidence to retain

• · Processing inventory mapped to lawful bases
• · Korean-language consent UI screenshots and itemised consent records
• · Age-determination records for under-14s and legal-representative consent records
• · Documentation distinguishing mandatory from optional consent items

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Transfers abroad — defined to include provision (including where the data can be queried), entrusted processing and storage — are prohibited unless one of five routes applies: (1) the data subject’s separate consent to the cross-border transfer; (2) a special provision in law, a treaty to which Korea is a party, or another international agreement; (3) entrusted processing or storage necessary to conclude and perform a contract with the data subject, where the Art. 28-8(2) items are disclosed in the privacy policy or notified to the data subject by email or another method prescribed by Presidential Decree; (4) the recipient holds a certification under Art. 32-2 or one recognised by PIPC notice and has taken the safety and rights-protection measures required, plus the measures needed to implement the certified matters in the destination country; or (5) PIPC recognises that the destination country or international organisation has a protection system, scope of rights guarantees and remedial procedures substantially equivalent to this Act. Before consent under route (1), the data subject must be informed of the items transferred, the destination country, timing and method, the recipient’s name and contact details, the recipient’s purpose and retention period, and the method, procedure and effect of refusing; any change requires fresh notice and consent. Contracts for cross-border transfer whose content breaches this Act are prohibited.

Applies when

Chinese AI companies routing Korean users’ or customers’ personal information into China for training, inference, annotation, support or operations. Mainland China is not currently recognised under route (5), so in practice route (1), (3) or (4) must be used.

Evidence to retain

• · Cross-border transfer register: recipient, country, data items, purpose, retention period
• · Separate consent UI and consent records, or archived privacy-policy disclosure page
• · Certification documents and description of measures implementing the certified matters in the destination country (route 4)
• · The cross-border transfer contract with legal review confirming it does not breach PIPA
• · Records of fresh notice and consent where transfer particulars changed

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

A controller with no address or place of business in Korea that meets the revenue and data-holding thresholds set by Presidential Decree must designate a domestic representative in writing to handle: complaint handling and damage relief under Art. 31(4)5; the notifications under Art. 34(1)–(2) and the breach report under Art. 34(4); and the submission of materials under Art. 63(1). The representative must have an address or place of business in Korea; where the controller has established a Korean corporation, or a Korean corporation over which it exercises dominant influence on officer appointments or business operations, the representative must be designated from among those entities. The controller must educate, inspect and supervise the representative as prescribed by Presidential Decree. The representative’s name, address, telephone number and email must appear in the privacy policy. A violation by the representative in respect of those matters is deemed committed by the controller.

Applies when

Chinese AI companies with no Korean entity that operate apps, websites or model APIs for Korean users. Where a Korean subsidiary exists, the representative must be designated from within it rather than a third party.

Evidence to retain

• · Written designation of the domestic representative
• · Screenshot of the representative’s details in the published privacy policy
• · Records of education and business-status inspection of the representative
• · Register of complaints and breach reports handled by the representative

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

On becoming aware that personal information has been leaked or otherwise compromised, the controller must without delay inform data subjects of the Art. 34(1) items: the data items involved; the time and circumstances; the specific steps the data subject can take to minimise harm; the controller’s response measures and damage-relief procedures; the department and contact point for reports of harm; the legal rights arising from the breach — damages under Art. 39, statutory damages under Art. 39-2 and dispute mediation under Art. 43 — and how to exercise them; and other matters prescribed by Presidential Decree. The 2026 amendment adds Art. 34(2): where the controller becomes aware of circumstances indicating a possibility of a leak, as prescribed by Presidential Decree, it must without delay inform all potentially affected data subjects of the prescribed matters. The controller must also take measures to prevent the spread of harm, including recovery and deletion, and must report to PIPC or a specialised body without delay as prescribed.

Applies when

All controllers processing Korean personal information; entrusted processors should contractually guarantee immediate notification to the principal so it can meet its own deadlines.

Deadline: Without delay; the precise timing and reporting method are prescribed by Presidential Decree

Applies from: 2026-09-11

Evidence to retain

• · Incident response plan covering the Korean reporting path and Korean-language notice templates
• · Data-subject notice text covering every Art. 34(1) item
• · Record of the report filed with PIPC or the designated specialised body
• · Assessment record of a possible leak and proof that notification was sent
• · Execution records of measures preventing the spread of harm, including recovery and deletion

Estimated first-time effort: 6–15 person-days (estimate, not a commitment)

Article 37-2 provides that where a decision is made by processing personal information through a fully automated system, including one applying artificial intelligence technology, and that decision significantly affects the data subject’s rights or obligations, the data subject may require the controller to refuse to apply it — except where the decision is made under Art. 15(1)1, 2 or 4. The data subject may also request an explanation of an automated decision already made. On receiving such a request the controller must, absent justifiable grounds, refrain from applying the automated decision or take necessary measures such as human re-processing and explanation. The controller must also publish, in a form the data subject can readily check, the criteria and procedure for automated decisions and the way personal information is processed.

Applies when

Chinese AI products in Korea with automated approval, credit scoring, CV screening, insurance pricing, content distribution or risk-based blocking. Purely recommendatory features without significant effect on rights or obligations require a case-by-case assessment.

Evidence to retain

• · Inventory of automated decisions with the “significant effect” assessment
• · Published page describing the decision criteria, procedure and processing method
• · Register of refusal and explanation requests with handling and responses
• · Standard operating procedure and execution records for human re-processing
• · Written justification where a request is not acceded to on justifiable grounds

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

The 2026 amendment inserts Art. 30-3, expressly designating the business owner or representative as the person ultimately responsible for the processing and protection of personal information. Article 31 is strengthened accordingly: the controller must secure the staffing and budget the CPO needs, controllers meeting the Presidential Decree thresholds must file the designation, change or removal of the CPO with the competent authority, and such designation, change or removal must be resolved by the board of directors. Designating a person who does not meet the CPO qualification requirements, failing to obtain a board resolution, or failing to file, attracts administrative fines under Art. 75(2).

Applies when

Controllers with a Korean corporation or meeting the Presidential Decree thresholds; Korean subsidiaries of Chinese groups must put the CPO designation on the board agenda.

Applies from: 2026-09-11

Evidence to retain

• · Board resolution appointing the CPO and the filing acknowledgement
• · Documentation verifying the CPO qualification requirements
• · Evidence of the staffing and budget secured for the CPO
• · Internal governance document recording the owner’s or representative’s accountability

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Article 29 requires technical, managerial and physical measures to ensure safety and prevent loss, theft, leakage, forgery, alteration or damage of personal information. Article 64-2(1)9 makes a leak itself surcharge-eligible unless the controller has taken all the measures necessary under Art. 29 — which makes the evidence of Art. 29 implementation the core of any defence. Article 26(4) requires the entrusting controller to supervise and train the entrusted processor, and a failure that results in a violation by that processor is itself surcharge-eligible.

Applies when

All entities processing Korean personal information, including Chinese vendors acting as entrusted processors.

Evidence to retain

• · Evidence pack of safety measures across technical, managerial and physical categories
• · Configuration evidence for encryption, access control and log retention
• · Entrustment agreements plus training and supervision records for processors
• · Periodic security assessments with remediation closure records

Estimated first-time effort: 12–30 person-days (estimate, not a commitment)

The 2026 amendment adds a proviso to Art. 32-2(1): controllers meeting thresholds set by Presidential Decree on revenue and processing scale must obtain privacy certification. That provision and Art. 75(2)15 (administrative fine for failing to obtain certification) commence on 1 July 2027, so the certification lead time should be planned in advance. Article 28-8(1)4 also makes holding such certification one of the routes for cross-border transfer, so certification carries both compliance and commercial value.

Applies when

Controllers meeting the Presidential Decree thresholds in Korea, and companies intending to use the certification route to support transfers back to China.

Deadline: The mandatory certification duty applies from 1 July 2027

Applies from: 2027-07-01

Evidence to retain

• · Assessment of whether the size thresholds apply
• · Gap analysis and remediation plan for certification readiness
• · Certification application and certificate
• · Description of measures implementing the certified matters in the destination country, where used as a transfer route

Estimated first-time effort: 20–60 person-days (estimate, not a commitment)