South Korea

South Korea's Personal Information Protection Act (PIPA), enacted 2011 and substantially rewritten since, is enforced by the Personal Information Protection Commission (PIPC), which received EU-adequacy-driving independence and enforcement powers through the 2020 'Data 3 Act' reform. PIPA is comprehensive, applying to public and private controllers, and was further amended in March 2025 (foreign representative/domestic-corporation requirements, effective Oct 2, 2025) and March 2026 (CEO liability, 10% turnover penalty ceiling, effective Sept 11, 2026). PIPA's territorial/extraterritorial scope is not explicitly codified in the statute text, requiring case-by-case analysis.

PIPA recognises consent alongside other legal bases for processing, but the statute does not itself define 'consent,' leaving interpretive gaps filled by Supreme Court rulings and PIPC guidance. Biometric data used for unique identification is treated as a special/sensitive category requiring separate consent. Pseudonymisation is statutorily defined (Art 2(1-2)) and forms the basis for research/statistics safe-harbours.

PIPA grants individuals rights to be informed, access, rectify, and erase personal data. Rather than a general right of consent withdrawal, PIPA provides a right to obtain suspension of processing (Art 37), which terminates processing and triggers deletion. The PIPC's 2024-2026 basic plan aims to expand 'MyData' (the right to request transmission of personal information) across all sectors. Public-institution access requests must be transmitted by the PIPC without delay.

PIPA currently mandates DPIAs only for public organisations. A June 2026 draft Enforcement Decree amendment would require board-approved CPO appointment/removal notifications for large processors, mandatory ISMS-P certification for certain entities by December 31, 2028, and a 72-hour data-subject breach notification standard; these remain proposed as of this research pass. Information-and-communication service providers (ICSPs) are already bound by a stricter 24-hour breach notification rule under Article 39-4(1) PIPA. The March 2026 PIPA amendment (effective September 11, 2026) introduces personal CEO supervisory liability and raises the penalty ceiling to 10% of total turnover.

The European Commission adopted an adequacy decision for South Korea (Commission Implementing Decision (EU) 2022/254), concluding that PIPA offers protection essentially equivalent to the GDPR, including on redress and independence of the PIPC. The decision excludes processing of personal credit information under the Credit Information Act (CIA), which remains under Financial Services Commission (FSC) oversight outside PIPC's adequacy-relevant scope. PIPA itself recognises consent, international agreements, and other bases for cross-border transfers, and empowers the PIPC to suspend transfers. South Korea also participates in the APEC Cross-Border Privacy Rules (CBPR) system.

Beyond PIPA, South Korea maintains sector-specific overlays: the Credit Information Use and Protection Act (Credit Act) governs personal credit information used in credit ratings and is enforced by the Financial Services Commission (FSC); the Act on Real Name Financial Transactions and Guarantee of Secrecy applies separately to financial institutions; and the Act on Promotion of Information and Communications Network Utilization and Information Protection (Network Act/ICNA) imposes stricter obligations on information-and-communication service providers. The FSC's 'MyData' credit-information platform operates under its own manual/licence mechanism. Health, education, employment, and insurance sector-specific overlays were not evidenced in this research pass.

Under the Network Act, senders of commercial advertising messages must obtain clear, specific consent to 'advertising information' (vague terms such as 'benefit notifications' are disallowed) and must provide simplified opt-out mechanisms, per a March 2026 KISA/KCC revised anti-spam guide. Cookie/tracker-specific consent rules, dark-pattern prohibitions, opt-out signal (GPC/DAA-equivalent) frameworks, clean-room/data-collaboration rules, and cross-context-advertising-specific provisions were not evidenced in this research pass.

The PIPC has taken an increasingly assertive posture on algorithmic accountability: its January 2025 Kakao Pay/Alipay decision fined the companies KRW 8.3 billion and ordered destruction of an AI-trained credit-scoring algorithm built on unlawfully transferred user data, following on from the 2021 Scatter Lab precedent confirming PIPA's reach into AI training data. In August 2025 the PIPC published a Guide for the Development and Use of Generative AI, setting minimum legal/safety requirements across the AI lifecycle. Biometric data used for unique identification is a special category requiring separate consent. The EDPB's adequacy assessment notes that PIPA's provisions apply without limitation in the law-enforcement area, a national-security carve-out subject to ongoing EU monitoring.

PIPA requires the consent of a guardian or legal representative to process children's personal information, paralleling GDPR Art 8, but the statute lacks provisions specifically targeted at protecting children's data comparable to COPPA's granular regime. A precise, PIPA-specific statutory age threshold was not confirmed verbatim in this research pass; the analogous Location Information Act sets a 14-years-old threshold for requiring legal-representative consent to collect children's location data, which is indicative but not conclusive for PIPA's own child-consent age. Minor-profiling bans, education-settings-specific rules, and dependent-adult protections were not evidenced.

The PIPC has demonstrated sustained, aggressive enforcement, including a KRW 252 million fine against Apple (July 23, 2026) over unauthorized Siri voice-data collection and the KRW 8.3 billion Kakao Pay/Alipay fine plus algorithm-deletion order (January 2025). The March 2026 PIPA amendment substantially raises the stakes, introducing a 10%-of-turnover penalty ceiling and personal CEO supervisory liability, effective September 11, 2026; the June 2026 draft Enforcement Decree amendment would further formalize CPO governance, ISMS-P certification, and 72-hour breach notification. The EDPB's 2021 opinion flagged a lack of detailed information on PIPC's staffing and financial resources as an area needing clarification. Collective-redress/class-action and private-right-of-action mechanisms specific to PIPA were not evidenced in this research pass.