Publication
Publication
Contacts
Kim & Chang
Jung-Chull LEE
Tel: +(82) 2 3703 1163
www.kimchang.com
Supervisory Authority
National Legislation
(Please note these links are provided for information only. Any translations may not be accurate and the text may not include amendments to that legislation).
Contributed by Kim & Chang
Last updated August 2026
General | Data Protection Laws
National Legislation
National Supervisory Authority
Scope of Application
Personal Data
Sensitive Personal Data
Data Protection Officers
Accountability and Privacy Impact Assessments
Rights of Data Subjects
Security
Transfer of Personal Data to Third Countries
Enforcement
ePrivacy | Marketing and cookies
National Legislation
Cookies
Marketing by E-mail
Marketing by Telephone
General data protection laws
The Personal Information Protection Act (“PIPA”).
The Credit Information Use and Protection Act (the “Credit Information Act”) also contain provisions relevant to the processing of personal information.
This summary is mainly based on the PIPA requirements. Some aspects of the other applicable laws have been set out below also, though they are not generally described in this summary.
Entry into force
The PIPA came into effect on September 30, 2011.
The law was amended by the National Assembly on February 12, 2026 (“Amendment Act”). Most amendments are scheduled to take effect on September 11, 2026, while the provisions relating to ISMS-P certification are scheduled to take effect on July 1, 2027. For reference, an earlier amendment, promulgated on April 1, 2025, has been in force since October 2, 2025.
Details of the competent national supervisory authority
The Personal Information Protection Commission (“PIPC”)
209 Sejongdae-ro Jongno-gu
Seoul
Korea 03171
www.pipc.go.kr
Notification or registration scheme and timing
Public agencies that manage personal information files must notify PIPC of a range of information including the name of the file, its legal basis and purpose and the retention period. The PIPC must disclose the registration status to the public. There are no registration fees.
This notification obligation only applies to public agencies and not private sector companies.
Exemptions to notification
Public agencies are not obliged to notify personal information files dealing with matters such as national security, crime investigation, tax evasion or internal work processing.
What is the territorial scope of application?
The PIPA does not clearly address extra-territoriality. However, there is a consensus that it applies to both Korean companies and companies established abroad that process personal information in Korea.
Is there a concept of a controller and a processor?
The PIPA uses the term “personal information managers" to mean a public institution, corporate body, organisation or individual who manages personal information directly or via another person.
The PIPA also has the concept of a “data consignee”, who is a person who is delegated with the responsibility to process personal information, and is only responsible for compliance with more limited aspects of the PIPA.
Are both manual and electronic records subject to data protection legislation?
Yes. Both manual and electronic records are subject to the data protection laws.
Are there any national derogations?
Most of the requirements under PIPA do not apply to (i) personal information collected or requested to be provided for the analysis of information related to national security; and (ii) personal information collected or used for its own purposes of reporting by the press, missionary activities by religious organisations, and nomination of candidates by political parties, respectively.
In addition, the PIPA’s requirements on the collection and use of personal information, the establishment of a privacy policy, and the designation of a chief privacy officer will not apply to personal information that is processed by a personal information manager to operate a group or association for friendship, such as an alumni association and a hobby club.
What is personal data?
Under the PIPA, “personal information” is broadly defined as information pertaining to a living individual which identifies a specific person by name, address, image or similar identifier.
It includes information that does not, by itself, make it possible to identify a specific person, but that enables such a person to be identified easily when combined with other information. Whether a piece of information can be easily combined with other information must be determined by reasonably considering the time, cost, and technology needed to identify the data subject, including to obtain the other information that must be combined in order to identify the individual.
The PIPA defines “pseudonymized information” as a subset of personal information. Pseudonymized information is personal information which has been partially deleted or partially/wholly substituted so that the information can no longer identify an individual without utilization of, or combination with, additional information to restore the information to its original state.
Is information about legal entities personal data?
Information about a corporate entity is not considered to be personal information. However, information regarding employees of a corporate entity is considered to be personal information.
What are the rules for processing personal data?
The PIPA contains eight Personal Information Protection Principles. They require personal information to be collected for specific and lawful purposes and not used for further incompatible purposes. The principles also require personal information managers to ensure personal information is accurate and held securely, to publicise their privacy policy and to make personal information anonymous wherever possible.
The PIPA contains separate rules for the initial collection and use of personal information and any subsequent use for new purposes or new transfers to third parties.
A personal information manager may initially collect and use personal information: (i) with the consent of a data subject; (ii) where there exist special provisions in an Act or it is inevitable to fulfil an obligation imposed by or under an Act or subordinate statute; (iii) where it is inevitable for a public institution to perform its affairs provided for in an Act or subordinate statute; (iv) where it is necessary to perform an agreement entered into with a data subject or to take measures as requested by a data subject in the course of performing such agreement; (v) where it is clearly necessary for the physical safety and property interests of a data subject or a third person ; (vi) where it is necessary for the personal information manager’s legitimate interests and clearly takes precedence over the rights of a data subject (though this condition is limited to cases where the information is substantially relevant to a personal information manager’s legitimate interests and reasonable scope is not exceeded); and (vii) where it is urgently necessary for public health, safety and welfare. The personal information manager must collect the minimum amount of personal information necessary and cannot refuse to provide goods or services where additional personal information is not supplied.
A personal information manager may use personal information for a new purpose or provide personal information to a new third person if doing so does not infringe the interests of a data subject or a third person and one of the following conditions is satisfied. The conditions for further processing are: (i) the data subject consents; (ii) special provisions exist in any other Act; (iii) it is obviously necessary for the physical safety and property interests of a data subject or a third person; or (iv) it is urgently necessary for public health, safety and welfare. Additional conditions apply where the processing is by a public agency.
Furthermore, even without obtaining additional consent from the data subject, a personal information manager may use, or provide personal information in its possession to a third party, within the scope reasonably related to the original purpose of collection and use, considering the following conditions prescribed in the Enforcement Decree to the PIPA: (i) whether the additional use or provision is related to the original purpose; (ii) whether the data subject may expect the additional use or provision in the light of the background of collection of personal information or the practice of processing personal information; (iii) whether the additional use or provision unjustifiably infringes upon the data subject’s interest; and (iv) whether there are measures to secure the personal information (such as pseudonymization and encryption).
The PIPA also allows a personal information manager to process pseudonymized information for such purposes as statistical analysis, scientific research and preservation of public records, without the data subject's consent, provided that where such pseudonymized information is provided to a third party without the data subject's consent, such pseudonymized information cannot be provided together with information that can be used to identify a specific living individual.
The PIPA also has specific rules applicable to business transfers and other corporate transactions.
Are there any formalities to obtain consent to process personal data?
In general, consent can be obtained by means other than writing, such as telephone, internet click-through or email. However, certain laws such as the Credit Information Act limit methods of consent.
When obtaining consent, the personal information manager must first notify the data subject of certain information about the processing of their personal information. For instance, where a personal information manager intends to provide a data subject’s personal information to a third party, the personal information manager must notify the data subject of: (i) of the person receiving the personal information; (ii) of the purpose of processing personal information; (iii) of the items of personal information provided; (iv) of the retention period; and (v) that the data subject may refuse to give consent and the consequences of refusal.
Are there any special rules when processing personal data about children?
If the data subject is under the age of 14, the consents required under PIPA for processing the data subject’s personal information must be obtained from his/her legal guardian. However, in such a case, the minimal amount of information needed to obtain consent from the data subject’s legal guardian can be directly collected from the data subject without the legal guardian’s consent. In addition, personal information managers must use easy-to-understand forms and languages when notifying children under the age of 14 of matters related to personal information processing.
Are there any special rules when processing personal data about employees?
There are no special rules pertaining to the processing personal data about employees. There are some provisions in the labour laws that are relevant to the processing employee data, such as statutory bases for processing resident registration numbers and other specific types of personal data, and a requirement to retain certain data for three years after the employee stops working for the company.
What is sensitive personal data?
Sensitive personal information is defined as the beliefs, joining or withdrawal from a labour union or political party, political opinions, health, sexual life and other personal information prescribed by Presidential Decree which could substantially infringe on the privacy of a data subject.
The PIPA also contains specific rules on the processing of national identification numbers and the use of CCTV.
Are there additional rules for processing sensitive personal data?
There is a general prohibition on the processing of sensitive personal information. However, it can be processed: (i) to the extent a law requires it or permits it; or (ii) if separate consent has been obtained from the data subject.
Are there additional rules for processing information about criminal offences?
The Presidential Decree of PIPA prescribes that information pertaining to criminal history records under the Act on the Lapse of Criminal Sentences (“Criminal Information”) is a type of sensitive personal information under the PIPA. Therefore, the rules for processing sensitive personal data apply to the processing of Criminal Information.
Are there any formalities to obtain consent to process sensitive personal data?
Separate consent must be obtained to process sensitive personal information.
When must a data protection officer be appointed?
All personal information managers must appoint a chief privacy officer. There is an exemption for those that are below certain thresholds concerning the number of employees, the volume of sales, and others. In such case, the business owner or representative of the personal information manager shall be the Chief Privacy Officer.
For data controllers that meet certain revenue or data volume thresholds, the Amendment Act imposes stricter governance requirements under which they must: (i) obtain the approval of the board of directors when appointing, replacing, or removing a chief privacy officer; and (ii) report such appointment, replacement, or removal to the PIPC.
What are the duties of a data protection officer?
The chief privacy officer has extensive statutory duties. He/she must: (i) establish and implement a personal information protection plan; (ii) regularly survey personal information processing and make improvements; (iii) process complaints and implement relief relating to personal information processing; (iv) establish internal control systems for preventing leakage, abuse, misuse of personal information; (v) establish and implement training on personal information protection; (vi) supervise, manage and protect personal information files; and (vii) undertake such other matters as prescribed by Presidential Decree.
In addition to the foregoing duties, the Amendment Act expands the chief privacy officer’s responsibilities to include the following: (i) managing the professional personnel necessary for personal information protection and securing a sufficient budget; and (ii) reporting the status of personal information protection and key matters to the business owner or CEO and the board of directors.
Is there a general accountability obligation?
A personal information manager must issue a privacy policy containing details of: (i) the purpose of collection; (ii) the retention period; (iii) any provision of personal information to third parties (if any); (iv) any use of data consignees (if any); (iv) the rights of data subjects; (v) name of chief privacy officer or the department which handles complaints related to personal information, and contact information such as a telephone number; (vi) matters related to operation of mechanism for automatically collecting personal information, such as cookies, and methods for disabling such mechanism (if any); and (vii) other matters specified by Presidential Decree. The PIPA also requires the establishment of an internal management plan which sets forth the required managerial, technical and physical measures which a personal information manager must undertake to safeguard the personal information.
A personal information manager should regularly provide training to its employees and data consignees who process the personal information on behalf of the personal information manager to guarantee the appropriate handling of the personal information.
Are privacy impact assessments mandatory?
The head of public agencies must conduct an assessment to analyse privacy risk factors (“Privacy Impact Assessment”) and submit the results to the PIPC in the case of a probable breach of data subjects’ personal information arising out of the operation of personal information files, which meet the criteria prescribed by the Presidential Decree of the PIPA.
This obligation only applies to public agencies and not private sector companies.
Privacy notices
The personal information manager must issue a privacy policy, as set out above.
The personal information manager must also provide certain information before obtaining consent, as set out above.
Rights to access information
The data subject may request that he or she review or copy the personal information held by the personal information manager.
Rights to data portability
Data subjects may request data controllers in the healthcare, telecommunications, or energy sectors specified in the Enforcement Decree of the PIPA to transmit their personal information either to themselves or to a third party, such as a specialized personal information management institution. Upon receiving such a request, data controllers are required to transmit the relevant information in a format that can be processed by a computer or other information-processing device, to the extent reasonably practicable in light of the time, cost, and technology involved.
Right to be forgotten
A data subject who has reviewed his personal information held by the personal information manager may request that his or her personal information be corrected or deleted. However, there are certain instances which limit such rights, such as when retention of personal information is required by law.
Objection to direct marketing
To conduct direct marketing, explicit consent must be obtained from the data subject and the data subject may revoke his consent at any time.
Other rights
A data subject may request that his or her personal information be no longer processed and in such case, the personal information manager must cease to process his or her personal information.
PIPA contains new rules on automated decision making. In particular, a data subject may request an explanation from the personal information manager with respect to decisions made from processing personal information by a fully automated system, including systems using artificial intelligence, and if such decisions materially affect the data subject’s rights or obligations, the data subject has the right to refuse such decisions. If a data subject refuses an automated decision or requests an explanation, unless there is a justifiable reason to the contrary, the personal information manager shall not apply the automated decision or shall take necessary measures such as notification and explanation of the result after re-processing by human intervention. The foregoing shall not apply where the automated decision was made with the consent of the data subject, where there is a special provision in the law or it is inevitable to comply with statutory obligations, or where it is necessary to perform an agreement entered into with the data subject or to take measures as requested by the data subject in the course of executing such agreement.
Security requirements in order to protect personal data
The personal information manager must implement technical, managerial and physical measures to ensure data security.
This may include establishing an internal management plan to prevent the loss, theft, leakage and falsification of personal information. It may also include implementing limitations to access and control, store access records, apply encryption technology, install and renew security programs and other measures required by Presidential Decree. The PIPC’s notification also contains details of the required security measures.
ISMS-P (Information Security and Personal Information Protection Management System) certification was previously voluntary. However, under the Amendment Act it will become mandatory for: (i) large public system operators; (ii) identity verification service providers; and (iii) large personal information controllers. The certification process has also been reformed to focus on practical compliance, including vulnerability assessments and penetration testing.
Specific rules governing processing by third party agents (processors)
In cases where a personal information manager delegates personal information processing to a third party data consignee, such delegation must be documented in writing. The delegated work scope and the data consignee’s name must be disclosed in such a way that data subjects can easily access and review this information.
The personal information manager must also supervise and train the data consignee in such a way as to prevent the loss, theft, leakage, falsification and damage of personal information as required by Presidential Decree. Should the data consignee use personal information to promote or sell goods or services, the delegated work scope must be clearly communicated to the data subject. If the data consignee violates the law and this leads to liability, then the data consignee is treated as an employee of the personal information manager.
Notice of breach laws
In an event of personal information loss, theft, or leakage ("leakage etc."), the fact of such leakage etc. must be communicated to the data subjects within 72 hours after the leakage etc. The leakage, etc. must be reported to PIPC or Korea Internet & Security Agency (“KISA”) within 72 hours after the leakage, etc. if (i) there are more than 1,000 data subjects involved; (ii) sensitive information or unique identification information has been leaked, etc. or (iii) leakage etc. has occurred due to illegal external access to personal information processing systems or devices used for personal information processing.
The Amendment Act strengthens the notification regime in that: (i) the scope of “leakage, etc.” will be expanded beyond loss, theft, or leakage to include falsification, alteration, or damage; and (ii) data controllers will also be required to notify data subjects without delay when they become aware of the possibility of such data leakage, as prescribed by Presidential Decree.
Restrictions on transfers to third countries
The PIPA prohibits any transfer of personal information overseas by a personal information manager unless it is in any of the following cases: (i) where a separate consent for overseas transfer has been obtained from the data subject; (ii) where there exist special provisions in a statute, a treaty or other international conventions to which the Republic of Korea is a party; or (iii) where it is necessary to delegate the processing of, or retain, personal information in order to execute and perform a contract with a data subject, and the matters to be informed to the data subject when obtaining his/her consent to overseas transfer have been informed to the data subject or have been disclosed in the personal information manager’s privacy policy; (iv) where the recipient of personal information has obtained certification determined and publicly notified by the PIPC and has implemented certain measures to protect personal information; or (v) where the PIPC has recognized that the country or the international organization to where the personal information is transferred has the personal information protection system, etc. that are substantially equal to the level of those under the PIPA. The personal information manager shall also take certain technical, managerial and physical protection measures.
Notification and approval of national regulator (including notification of use of Model Contracts)
There are no separate notification or approval procedures. However, for personal credit information processed by financial institutions, prior approval by a relevant authority may be necessary in certain instances.
Use of binding corporate rules
Binding corporate rules have not been recognised by Korean regulators as a sufficient basis for transferring personal information abroad.
Fines
The sanctions for a particular breach of the PIPA will depend on the type and seriousness of the violation and include criminal fines, surcharges and penalties. For example, breach of the rules on the use of sensitive personal information can lead to a criminal fine of up to 50 million won (approximately EUR 35,000).
The main grounds for imposing administrative fines are as follows: (i) collecting, using, or providing to a third party the personal data without legitimate grounds; (ii) processing sensitive, unique identification information or resident registration numbers without legitimate grounds; (iii) neglecting to manage, supervise, or train the data consignee so that the data consignee violates the provisions of the PIPA; (iv) overseas transfer of personal data without legitimate grounds; and (v) loss, theft, leakage, forgery, modification, or damage of personal data (except where all necessary measures to ensure the safety of personal data have been taken).
In such a case, the PIPC may impose an administrative fine not exceeding 3% of the total revenue of the relevant personal data manager. Revenue unrelated to the violation are excluded from the total revenue for calculation purposes.
The Amendment Act introduces special provisions that increase the maximum administrative penalty for repeated or serious violations to up to 10% of total revenue. This applies where: (i) the same violation is repeated within three years due to wilful misconduct or gross negligence; (ii) a violation involving wilful misconduct or gross negligence causes harm to at least 10 million data subjects; or (iii) a data leakage or other incident occurs as a result of a failure to comply with a corrective order issued by the PIPC. If there is no revenue or it is difficult to calculate the amount of revenue, the maximum administrative penalty is set at KRW 5 billion (approximately EUR 3,500,000). Where there are grounds for a reduction under the Enforcement Decree of the PIPA — such as investments in and operation of personal information protection measures — the Amendment Act requires a mandatory reduction in the administrative penalty unless the violation is caused by wilful misconduct or gross negligence.
Imprisonment
The sanctions for a particular breach of the PIPA will depend on the type and seriousness of the violation and include imprisonment. For example, breach of the rules on the use of sensitive personal information can lead to imprisonment of up to five years or a criminal fine of up to KRW 50 million (approximately EUR 35,000).
Also, no person may process pseudonymized information in order to identify a specific living individual, and violators may be subject to criminal penalties of up to 5 years’ imprisonment or a criminal fine of up to KRW 50 million (approximately EUR 35,000), as well as a surcharge.
Compensation
A data subject suffering from psychological or economic loss may commence a civil action by filing a claim for compensation from the personal information manager. The personal information manager will be liable in such cases unless he or she can prove that there was no wilful conduct or negligence on his or her part.
The PIPA provides statutory damages and treble damages. For the former, the PIPA provides that if the personal information manager cannot refute that their wilful misconduct or negligence caused the loss, theft, leakage, forgery, modification or damage of personal information, data subjects may claim up to KRW 3 million (approximately EUR 2,000) in damages without having to prove the actual damages amount. For treble damages, if the personal information manager cannot refute that the same loss, theft, leakage, etc. of personal information was caused by their wilful misconduct or gross negligence, a court may award damages up to three times the amount of actual damages after conducting an analysis of the totality of the circumstances.
To facilitate quicker resolution, alternative dispute resolution (personal information dispute mediation) and collective action options are available. However, collective actions are limited to obtaining injunctions against a personal information manager who violates the law and cannot be used for compensatory purposes.
Other powers
Corrective orders can also be issued, such as an injunction, suspension or protective measures. The PIPC may, upon finding a significant violation of law with respect to protection of personal information, recommend to the head of an authority or agency that the responsible person be reprimanded.
Practice
Fines: The Korean data protection authorities actively enforce the data protection regulations. The authorities conduct audits (including on-site investigations) of companies, on a both periodic and ad hoc basis, and impose administrative fines or surcharges upon discovering violations. The specific assessment standards for administrative fines and surcharges are set forth in the Enforcement Decree of PIPA.
Other enforcement action: There is a range of enforcement activity. Major issues typically involve failing to obtain consent, security and delegation of personal information processing.
ePrivacy laws
Cookies and direct marketing are governed by the PIPA.
Additional ePrivacy matters are set out in the Protection of Use of Location Information Act, the Communications Secrecy Protection Act and the Act on Promotion of Cloud Computing and Protection of Users.
Conditions for use of cookies
Under the PIPA, in principle, consent must be obtained if the cookie contains personal information.
A personal information manager must disclose its privacy policy with respect to its configuration and management of internet access information files and other devices which automatically collect personal information.
Regulatory guidance on the use of cookies
None.
Conditions for direct marketing by e-mail to individual subscribers
Explicit consent should be obtained from data subjects prior to sending e-mails or other electronic messages for marketing purposes. Commercial information may, however, be sent without consent by electronic message to addresses obtained from a prior sale of goods or services within 6 months of the sale.
Conditions for direct marketing by e-mail to corporate subscribers
The same rules above apply to corporate subscribers.
Exemptions and other issues
In order to send commercial information by e-mail: (i) the title of the e-mail message must start with the header “Gwango” (which means “advertisement” in Korean); and (ii) the contents of the e-mail message must include the sender’s name, e-mail address, telephone number and address, as well as instructions on how recipients can easily express their intent to refuse receipt of commercial information by e-mail. Additionally, the sender must take technical measures to enable recipients to easily select the option of refusing receipt of commercial information by e-mail.
Pursuant to the amendment to the Act on Promotion of Information and Communications Network Utilization and Information Protection (“Network Act”) which will take effect on October 1, 2026, any person/entity that violates the provisions governing the transmission of advertising information may be subject to an administrative penalty of up to 6% of the total revenue.
Conditions for direct marketing by telephone to individual subscribers (excludes automated calls)
Explicit consent is needed to send commercial information to a person by telephone. However, if the telephone number was obtained from a prior sale of goods or services, then commercial information may be sent within 6 months from the sale without consent.
Conditions for direct marketing by telephone to corporate subscribers (excludes automated calls)
The same rules above apply to corporate subscribers.
Exemptions and other issues
The Korea Fair Trade Commission has established a “do-not-call” registry under the Door-to-Door Sales Act to protect consumers from illicit telephone marketing practices. A telephone marketer must confirm whether a consumer has listed its telephone number with the “do-not-call” registry and may not call consumers with numbers listed in the registry. However, due to the public’s unfamiliarity with the registry and aversion toward registering telephone numbers, the “do-not-call” registry is not popular among consumers. Data subjects’ consent to receive direct marketing by telephone should be reconfirmed at least every two years from the date of the initial consent.
Contents