🇰🇷Personal Information Protection Act

← Back to laws in South Korea

Personal Information Protection Act

PIPA applies broadly to public institutions, companies, organisations and individuals that operate personal-information files for business purposes. It is supported by the Enforcement Decree and PIPC notices and guidance.

Core operational duties

Principles, grounds and notices: Articles 3, 15-18 and 20-22 require specified purposes, minimum necessary collection, an applicable statutory ground, consent standards where consent is used, and disclosures to the data subject.

Processors and lifecycle: Articles 21 and 26 require destruction when data are no longer needed and written outsourcing terms, publication and supervision of processing delegates.

Transfers: Article 28-8 permits an overseas provision, outsourced processing or storage only through a listed route and requires specified transfer information. Article 28-9 permits the PIPC to suspend unlawful or inadequately protected transfers.

Security and incidents: Articles 29 and 34 require safeguards, mitigation and notices. Enforcement Decree Article 39 generally requires notice to affected people within 72 hours after awareness, subject to its stated exceptions; the regulator-reporting triggers and procedure must also be assessed.

Governance: Article 31 requires a personal information protection officer. Article 33 makes impact assessment mandatory for qualifying public-institution files; private organisations should not be assigned a blanket statutory DPIA duty under this article.