Regulations › Rest of world › South Korea
PIPA
Personal Information Protection Act
WhenIn effect since 30 September 2011
Who enforces itPersonal Information Protection Commission (PIPC)
Who it applies toAll public and private personal information controllers, including foreign businesses that serve Korean users (which may need a domestic agent).
Tell the regulatorReport to PIPC within 72 hours where 1,000+ persons, sensitive or unique identifiers, or exter…
DPO requiredEvery controller must designate a chief privacy officer
RegistrationPublic institutions must register personal information files with the PIPC; no registration fo…
Transfers abroadTransfer abroad needs separate consent, a statutory basis, contract necessity with disclosure,…
Request deadlineAccess must be granted within 10 days of receiving the request
Maximum finePenalty surcharge up to 3% of total revenue (excluding unrelated revenue)
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws