⁦PIPA⁩

⁦South Korea⁩ الخصوصية

الحالة

⁦In force. The current consolidated Act and Enforcement Decree (the 2023 overhaul) took effect on 15 Sep 2023. A further amendment package (Act, Decree and PIPC notices) took effect on 11 Sep 2026.⁩✓⁦PIPA (Act and Enforcement Decree, enforcement date 15 Sep 2023); PIPC press release of 10 Sep 2026 ·⁩ المصادر: ⁦pipc.go.kr⁩, ⁦eiec.kdi.re.kr⁩, ⁦newsis.com⁩

على من ينطبق

⁦Anyone processing personal information of people in Korea. The PIPC⁩'⁦s April 2024 guidance says foreign firms are covered if they target Korean users, significantly affect Korean data subjects, or have a business presence in Korea.⁩⁦PIPC Handbook on applying PIPA to foreign businesses (4 Apr 2024) ·⁩ المصادر: ⁦shinkim.com⁩

حدود الحجم

⁦No general size threshold applies; PIPA covers all controllers. A foreign controller with no Korean address or office must designate a domestic agent if it meets an Enforcement Decree criterion: prior-year total revenue of KRW 1 trillion or more; information-and-communications-service revenue of KRW 10 billion or more; an average of 1 million or more Korean data subjects daily over the 3 months before the end of the prior year; or a PIPC request to submit materials after an incident.⁩⁦PIPA Art. 31-2(1); Enforcement Decree Art. 32-2 ·⁩ المصادر: ⁦elaw.klri.re.kr⁩

الجهة الرقابية

⁦Personal Information Protection Commission (PIPC); breach reports via KISA⁩✓المصادر: ⁦pipc.go.kr⁩, ⁦dlapiperdataprotection.com⁩

الإبلاغ عن الخروقات أو الحوادث

⁦Notify affected individuals within 72 hours of becoming aware. Report to the PIPC or KISA within 72 hours if 1,000+ people, sensitive or unique ID data, or outside hacking is involved. From 11 Sep 2026 notice also covers possible breaches and forgery or alteration (e.g. ransomware).⁩✓المصادر: ⁦dlapiperdataprotection.com⁩, ⁦eiec.kdi.re.kr⁩, ⁦newsseoul.co.kr⁩, ⁦newsis.com⁩

مهلة الرد على طلبات البيانات الشخصية

⁦Access must be given within 10 days of receiving the request (PIPA Art. 35(3); Enforcement Decree Art. 41(4)). If access is limited, postponed or refused, the controller must notify the person, with reasons and how to object, within 10 days (Decree Art. 41(5) / Art. 42). Correction, deletion and suspension requests (Arts. 36-37) also have 10-day handling periods under the Decree.⁩⁦PIPA Arts. 35-37; Enforcement Decree Arts. 41-44 ·⁩ المصادر: ⁦prighter.com⁩, ⁦prighter.com⁩

مسؤول حماية البيانات

⁦Every controller must designate a Chief Privacy Officer (CPO). Larger controllers need a qualified CPO with set experience. From 11 Sep 2026 certain controllers need board approval and a PIPC filing when appointing or changing the CPO.⁩✓المصادر: ⁦eiec.kdi.re.kr⁩, ⁦dlapiperdataprotection.com⁩, ⁦newsseoul.co.kr⁩

الممثل المحلي

⁦A foreign controller with no address or office in Korea that meets the Enforcement Decree criteria (based on factors such as revenue and the volume of personal information held) must designate a domestic agent in writing (Art. 31-2(1)). The agent handles privacy grievances and damage relief (Art. 31(3)3), breach notification and reporting (Art. 34(1) and (3)), and submission of materials to the PIPC (Art. 63(1)). The agent must have an address or office in Korea. If the controller has set up a Korean company, or a Korean company exercises dominant control over it, that company must be the agent (Art. 31-2(2)). The controller must train and supervise the agent (Art. 31-2(3)) and list the agent⁩'⁦s name, address, phone number and email in its privacy policy. The agent⁩'⁦s violations are treated as the controller⁩'⁦s. The Korean-company rule came from the amendment of 1 Apr 2025, in force since 2 Oct 2025.⁩✓⁦PIPA Art. 31-2 (as amended by Act No. 20897, 1 Apr 2025) ·⁩ المصادر: ⁦elaw.klri.re.kr⁩, ⁦digitalpolicyalert.org⁩, ⁦shinkim.com⁩

نقل البيانات إلى الخارج

⁦Overseas transfer (provision, outsourced processing or storage abroad) is allowed only on an Art. 28-8(1) basis: (1) separate consent; (2) a statute, treaty or other international agreement; (3) outsourcing or storage needed to conclude or perform a contract with the data subject, disclosed in the privacy policy or notified by email or similar; (4) the recipient holds a PIPC-designated certification and takes the required protection measures in the destination country; or (5) the PIPC recognises the destination country or international organisation as giving substantially equivalent protection. The PIPC can order a transfer suspended if it breaches Art. 28-8, or if the recipient⁩'⁦s protection is inadequate and harm has occurred or is likely. The controller may object within 7 days (Art. 28-9).⁩✓⁦PIPA Arts. 28-8(1), 28-9 ·⁩ المصادر: ⁦elaw.klri.re.kr⁩, ⁦dlapiperdataprotection.com⁩, ⁦bkl.co.kr⁩

ملفات تعريف الارتباط والموافقة

⁦Cookies, logs and IP addresses can be personal information where they can easily be combined with other information to identify someone (Art. 2(1)(b)). Each matter needing consent must be presented clearly and consented to separately, including consent to use data to promote or sell goods or services (Art. 22(1)). Children under 14 need legal-guardian consent, which the controller must verify (Art. 22-2).⁩✓⁦PIPA Arts. 2(1), 15, 22(1), 22-2 ·⁩ المصادر: ⁦elaw.klri.re.kr⁩, ⁦elaw.klri.re.kr⁩, ⁦dlapiperdataprotection.com⁩

أقصى عقوبة

⁦Fines up to 3% of total revenue (excluding unrelated revenue). From 11 Sep 2026, up to 10% for repeated, intentional or grossly negligent breaches, very large breaches, or ignoring PIPC orders. Punitive damages up to 5x actual losses.⁩✓المصادر: ⁦eiec.kdi.re.kr⁩, ⁦dlapiperdataprotection.com⁩, ⁦mt.co.kr⁩, ⁦newsseoul.co.kr⁩

المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.

ما يجب عليك فعله✓

• ⁦Rely on a legal basis under Art. 15 and get separate, clearly presented consent for each matter, including marketing (Arts. 15, 22)⁩
• ⁦Get verified legal-guardian consent before processing data of children under 14 (Art. 22-2)⁩
• ⁦Designate a Chief Privacy Officer (Art. 31)⁩
• ⁦Publish a privacy policy that discloses overseas transfers and your domestic agent (Arts. 28-8, 30, 31-2)⁩
• ⁦Transfer data abroad only on an Art. 28-8(1) basis⁩
• ⁦Appoint a domestic agent if you meet the Decree criteria, using your Korean subsidiary if you have one (Art. 31-2)⁩

التغييرات الأخيرة

⁦Under the amendment in force 11 Sep 2026 (PIPC release, 10 Sep 2026), fines can reach 10% of total revenue for repeated, intentional or grossly negligent leaks, and prior investment in protection now reduces fines. Major controllers need board approval and a PIPC filing to appoint, change or remove a CPO, with a grace period to 31 Dec 2027. Data subjects must be notified at the⁩ '⁦possible leak⁩' ⁦stage, and the scope of breach notices and reports was widened. Separately, from 2 Oct 2025 a foreign business⁩'⁦s Korean entity must act as its domestic agent, and in Sep 2025 the EU/EEA was recognised as equivalent for transfers.⁩✓

المصادر

• المصدر الأساسي: ⁦https://www.pipc.go.kr/eng/user/lgp/law/lawDetail.do⁩
• المصدر الثاني: ⁦https://www.dlapiperdataprotection.com/index.html?t=law⁩&⁦c=KR⁩
• الجهة الرقابية: ⁦Personal Information Protection Commission (PIPC); breach reports via KISA⁩

✓ = مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق

معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على ⁦contact@⁩⁦glancedeskjurisdiction.com⁩.