What happened
On 10 November 2026 the European Data Protection Board adopted a declaration confirming the adequacy of South Korea’s data‑protection framework, noting new rights under the Korean PIPA. The Board also approved the final recommendations for binding corporate rules for sub‑processors (BCR‑ST) and announced the 2027 coordinated enforcement theme on automated decision‑making in AI‑assisted recruitment.
Why it matters for trust and compliance
- Its status is published. It is enacted but may not be in force yet. Check the effective date before planning around it.
- The guidance updates cross‑border transfer rules, strengthens BCR‑ST obligations and signals upcoming EU enforcement focus on AI‑driven hiring decisions.
Who is affected
technology controller processor data broker Commission européenne Autorité coréenne de protection des données
Recommended actions
- Check that privacy notices describe the practices this addresses.
- Confirm access, correction, deletion and opt-out requests are handled within the required time.
- Review the transfer mechanisms relied on for affected data flows.
- Inventory AI or automated decision systems in scope and their assessments.
- Review age assurance and protections for minors' data.