Regulations › Rest of world › South Korea
PIPA
Personal Information Protection Act
WhenIn effect since 30 September 2011
Who enforces itPersonal Information Protection Commission (PIPC)
Who it applies toAll public and private personal information controllers, including foreign businesses that serve Korean users (which may need a domestic agent).
Tell the regulatorReport to PIPC within 72 hours where 1,000+ persons, sensitive or unique identifiers, or exter…
DPO requiredEvery controller must designate a chief privacy officer
RegistrationPublic institutions must register personal information files with the PIPC; no registration fo…
Transfers abroadTransfer abroad needs separate consent, a statutory basis, contract necessity with disclosure,…
Request deadlineAccess must be granted within 10 days of receiving the request
Maximum finePenalty surcharge up to 3% of total revenue (excluding unrelated revenue)
57%
of South Korea's 21 requirements are already met by European Union (GDPR). Here is what PIPA adds, biggest gaps first.
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
PIPA adds3 Every controller must designate a chief privacy officer; small businesses default to the owner or representative.
Art. 31 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PIPA adds3 Consent must be requested in a clearly recognizable way, item by item and separately, with key matters clearly marked in written consent.
Art. 22 · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
PIPA adds3 Access must be granted within 10 days of receiving the request.
Art. 35(3); Enforcement Decree Art. 41(4) · source ↗
DPO qualificationsGovernanceGap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
PIPA adds2 Large controllers (revenue KRW 150bn+ plus volume thresholds) need a CPO with 3+ years privacy and 6+ years combined privacy/IT experience.
Art. 31; Enforcement Decree Art. 32 · source ↗
RegistrationGovernanceGap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PIPA adds1 Public institutions must register personal information files with the PIPC; no registration for private controllers.
Art. 32 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PIPA adds2 Destroy personal information without delay once the retention period ends or the purpose is achieved.
Art. 21 · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
PIPA adds3 Notify affected data subjects of any leak within 72 hours of becoming aware.
Art. 34(1); Enforcement Decree Art. 39 · source ↗
LocalizationTransfersGap
GDPR– Not addressed
PIPA adds1 No general localization; sectoral limits exist (e.g. map data, some financial data).
None in PIPA · source ↗
Criminal liabilityEnforcementGap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PIPA adds2 Imprisonment up to 5 years (some offenses 10 years) for unlawful provision or use; corporate joint penalties.
Arts. 70-74 · source ↗
Already covered by GDPR: Reach abroad, Lawful basis, Sensitive data, Children, Rights, Marketing, DPIA, Records, Tell the regulator, Transfers abroad, Maximum fine, Private action.
A gap means PIPA is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws