PIPA (South Korea)

What is South Korea’s PIPA?

PIPA is South Korea’s general data protection law and one of the strictest in Asia. In 2020, the “three data laws” amendments made the PIPC a central, independent regulator and introduced pseudonymised data. The 2023 amendments further aligned PIPA with international standards and harmonised online and offline rules.

Who does it apply to?

Personal information controllers, public and private, that process personal information in operating their business. Foreign companies that target Korean users are also covered, and those above set thresholds must appoint a domestic agent.

Key duties

• Lawful processing: consent remains important, but the 2023 amendments widened other bases, such as contract necessity, so consent is no longer the default for everything. Sensitive and unique identifying information, such as resident registration numbers, has strict rules.
• Transparency: privacy policies with prescribed content, and clear notice of purposes, items and retention periods.
• Rights: access, correction, deletion, suspension of processing, and (since 2023) rights relating to automated decisions and data portability, phased in.
• Security: technical, administrative and physical safeguards under PIPC standards, and a designated Chief Privacy Officer.
• Breach notification: notify affected individuals within 72 hours, and report to the PIPC or KISA when a breach meets thresholds, for example 1,000 or more people, or sensitive data.
• Cross-border transfers: consent or other routes the 2023 amendments added, such as certification, adequacy-style recognition and contract necessity with disclosure.

Enforcement

The 2023 amendments set the maximum administrative fine at 3% of total revenue, excluding revenue unrelated to the violation. Criminal penalties also exist for serious violations. The PIPC actively fines global platforms.

How does it relate to other frameworks?

Korea has a mutual adequacy arrangement with the EU. The ISMS-P certification scheme covers information security and personal information management together.