Regulations › Rest of world › South Korea
PIPA
Personal Information Protection Act
WhenIn effect since 30 September 2011
Who enforces itPersonal Information Protection Commission (PIPC)
Who it applies toAll public and private personal information controllers, including foreign businesses that serve Korean users (which may need a domestic agent).
Tell the regulatorReport to PIPC within 72 hours where 1,000+ persons, sensitive or unique identifiers, or exter…
DPO requiredEvery controller must designate a chief privacy officer
RegistrationPublic institutions must register personal information files with the PIPC; no registration fo…
Transfers abroadTransfer abroad needs separate consent, a statutory basis, contract necessity with disclosure,…
Request deadlineAccess must be granted within 10 days of receiving the request
Maximum finePenalty surcharge up to 3% of total revenue (excluding unrelated revenue)
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
No express territorial clause, but foreign controllers meeting Decree thresholds without a Korean address must designate a domestic agent; PIPC applies the Act to services targeting Koreans.Art. 31-2 · source ↗
Extraterritorial reach rests on the domestic-agent rule and PIPC practice, not an explicit scope article.
Lawful basis
1
Consent, law, public duties, contract, vital interests, legitimate interests that clearly override data subject rights, and urgent public safety.Art. 15(1) · source ↗
Consent
3
Consent must be requested in a clearly recognizable way, item by item and separately, with key matters clearly marked in written consent.Art. 22 · source ↗
Sensitive data
2
Sensitive data (beliefs, union, politics, health, sex life, etc.) may be processed only with separate consent or where law requires or permits.Art. 23 · source ↗
People's rights
Rights
3
Access, portability (transmission), correction, erasure, suspension of processing, and the right to object to or seek explanation of automated decisions.Arts. 35, 35-2, 36, 37, 37-2 · source ↗
Request deadline
3
Access must be granted within 10 days of receiving the request.Art. 35(3); Enforcement Decree Art. 41(4) · secondary source · source ↗
Decree text read via Prighter reproduction of the Enforcement Decree.
Marketing
2
Electronic advertising requires the recipient's prior explicit opt-in consent.Network Act Art. 50 · secondary source · source ↗
Article number not stated by source; from memory.
Governance
DPO required
3
Every controller must designate a chief privacy officer; small businesses default to the owner or representative.Art. 31 · source ↗
Amendment passed 12 Feb 2026, in force 11 Sep 2026 (per DLA Piper). Certain organizations must now report CPO designation to PIPC.
DPO qualifications
2
Large controllers (revenue KRW 150bn+ plus volume thresholds) need a CPO with 3+ years privacy and 6+ years combined privacy/IT experience.Art. 31; Enforcement Decree Art. 32 · secondary source · source ↗
Decree article number not verified this session.
Registration
1
Public institutions must register personal information files with the PIPC; no registration for private controllers.Art. 32 · source ↗
DPIA
1
Mandatory for public institutions with high-risk files; private controllers should endeavor to conduct one.Art. 33 · source ↗
Scored 1 for private-sector organizations.
Records
1
Public institution file registration and privacy policy disclosures; no general ROPA for private controllers.Arts. 30, 32 · source ↗
Retention
2
Destroy personal information without delay once the retention period ends or the purpose is achieved.Art. 21 · source ↗
Enforcement Decree sets a 5-day destruction window (not verified this session).
Breaches
Tell the regulator
2
Report to PIPC within 72 hours where 1,000+ persons, sensitive or unique identifiers, or external hacking are involved.Art. 34(3); Enforcement Decree Art. 40 · secondary source · source ↗
72-hour figure from DLA Piper. Amendment passed 12 Feb 2026, in force 11 Sep 2026 (per DLA Piper). Trigger now includes the possibility of a breach and forgery or alteration.
Tell people
3
Notify affected data subjects of any leak within 72 hours of becoming aware.Art. 34(1); Enforcement Decree Art. 39 · secondary source · source ↗
Act says 'without delay'; 72 hours from Decree per DLA Piper.
Transfers
Transfers abroad
2
Transfer abroad needs separate consent, a statutory basis, contract necessity with disclosure, a certified recipient, or a PIPC-recognized country.Art. 28-8 · source ↗
PIPC may order suspension of transfers (Art. 28-9).
Localization
1
No general localization; sectoral limits exist (e.g. map data, some financial data).None in PIPA · secondary source · source ↗
Enforcement
Maximum fine
3
Penalty surcharge up to 3% of total revenue (excluding unrelated revenue); up to 10% for repeat, mass (10m+) or post-order breaches.Art. 64-2 · secondary source · source ↗
Amendment passed 12 Feb 2026, in force 11 Sep 2026 (per DLA Piper). Transition rules apply to the 10% ceiling.
Criminal liability
2
Imprisonment up to 5 years (some offenses 10 years) for unlawful provision or use; corporate joint penalties.Arts. 70-74 · secondary source · source ↗
Max terms from DLA Piper; article mapping not re-verified.
Private action
3
Damages with reversed burden of proof, up to 5x for intentional or negligent leaks, statutory damages up to KRW 3 million, and group suits.Arts. 39, 39-2, 51 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws