Home › Compare laws side by side › PIPA vs EU GDPR

PIPA vs EU GDPR

Personal Information Protection Act (Republic of Korea) (South Korea) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	PIPA South Korea 11/14 facts confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force. The current consolidated Act and Enforcement Decree (the 2023 overhaul) took effect on 15 Sep 2023. A further amendment package (Act, Decree and PIPC notices) took effect on 11 Sep 2026.✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Anyone processing personal information of people in Korea. The PIPC's April 2024 guidance says foreign firms are covered if they target Korean users, significantly affect Korean data subjects, or have a business presence in Korea.	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	No general size threshold applies; PIPA covers all controllers. A foreign controller with no Korean address or office must designate a domestic agent if it meets an Enforcement Decree criterion: prior-year total revenue of KRW 1 trillion or more; information-and-communications-service revenue of KRW 10 billion or more; an average of 1 million or more Korean data subjects daily over the 3 months before the end of the prior year; or a PIPC request to submit materials after an incident.	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Personal Information Protection Commission (PIPC); breach reports via KISA✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Notify affected individuals within 72 hours of becoming aware. Report to the PIPC or KISA within 72 hours if 1,000+ people, sensitive or unique ID data, or outside hacking is involved. From 11 Sep 2026 notice also covers possible breaches and forgery or alteration (e.g. ransomware).✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	Access must be given within 10 days of receiving the request (PIPA Art. 35(3); Enforcement Decree Art. 41(4)). If access is limited, postponed or refused, the controller must notify the person, with reasons and how to object, within 10 days (Decree Art. 41(5) / Art. 42). Correction, deletion and suspension requests (Arts. 36-37) also have 10-day handling periods under the Decree.	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	Every controller must designate a Chief Privacy Officer (CPO). Larger controllers need a qualified CPO with set experience. From 11 Sep 2026 certain controllers need board approval and a PIPC filing when appointing or changing the CPO.✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	A foreign controller with no address or office in Korea that meets the Enforcement Decree criteria (based on factors such as revenue and the volume of personal information held) must designate a domestic agent in writing (Art. 31-2(1)). The agent handles privacy grievances and damage relief (Art. 31(3)3), breach notification and reporting (Art. 34(1) and (3)), and submission of materials to the PIPC (Art. 63(1)). The agent must have an address or office in Korea. If the controller has set up a Korean company, or a Korean company exercises dominant control over it, that company must be the agent (Art. 31-2(2)). The controller must train and supervise the agent (Art. 31-2(3)) and list the agent's name, address, phone number and email in its privacy policy. The agent's violations are treated as the controller's. The Korean-company rule came from the amendment of 1 Apr 2025, in force since 2 Oct 2025.✓	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	Overseas transfer (provision, outsourced processing or storage abroad) is allowed only on an Art. 28-8(1) basis: (1) separate consent; (2) a statute, treaty or other international agreement; (3) outsourcing or storage needed to conclude or perform a contract with the data subject, disclosed in the privacy policy or notified by email or similar; (4) the recipient holds a PIPC-designated certification and takes the required protection measures in the destination country; or (5) the PIPC recognises the destination country or international organisation as giving substantially equivalent protection. The PIPC can order a transfer suspended if it breaches Art. 28-8, or if the recipient's protection is inadequate and harm has occurred or is likely. The controller may object within 7 days (Art. 28-9).✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	Cookies, logs and IP addresses can be personal information where they can easily be combined with other information to identify someone (Art. 2(1)(b)). Each matter needing consent must be presented clearly and consented to separately, including consent to use data to promote or sell goods or services (Art. 22(1)). Children under 14 need legal-guardian consent, which the controller must verify (Art. 22-2).✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Fines up to 3% of total revenue (excluding unrelated revenue). From 11 Sep 2026, up to 10% for repeated, intentional or grossly negligent breaches, very large breaches, or ignoring PIPC orders. Punitive damages up to 5x actual losses.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

PIPA: Anyone processing personal information of people in Korea. The PIPC's April 2024 guidance says foreign firms are covered if they target Korean users, significantly affect Korean data subjects, or have a business presence in Korea.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under PIPA

Rely on a legal basis under Art. 15 and get separate, clearly presented consent for each matter, including marketing (Arts. 15, 22)
Get verified legal-guardian consent before processing data of children under 14 (Art. 22-2)
Designate a Chief Privacy Officer (Art. 31)
Publish a privacy policy that discloses overseas transfers and your domestic agent (Arts. 28-8, 30, 31-2)
Transfer data abroad only on an Art. 28-8(1) basis
Appoint a domestic agent if you meet the Decree criteria, using your Korean subsidiary if you have one (Art. 31-2)

Full PIPA page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.