KR-PIPA
Personal Information Protection Act
Personal Information Protection Commission
Personal Information Protection Commission
The Personal Information Protection Act (PIPA) is South Korea's general privacy statute. The Personal Information Protection Commission (PIPC) is the independent central regulator. The current Act is Law No. 20897, effective 2 October 2025, together with the Enforcement Decree currently effective from 20 August 2026.
Law No. 21445 was promulgated on 10 March 2026 but its next principal commencement date is 11 September 2026, after the date of this review. The controls therefore use the law in force on 23 August 2026 and separately flag the enacted amendment for implementation planning.
PIPA covers lawful and limited processing, transparency, rights, processors, overseas transfers, security, privacy officers, incidents, automated decisions and public-sector impact assessments.
Do not treat the March 2026 amendment as already effective. Operate against Law No. 20897 and Decree No. 36121 now, while preparing for the provisions scheduled to start on 11 September 2026.