PIPA

South Korea Privacy

Status

In force. The current consolidated Act and Enforcement Decree (the 2023 overhaul) took effect on 15 Sep 2023. A further amendment package (Act, Decree and PIPC notices) took effect on 11 Sep 2026.✓PIPA (Act and Enforcement Decree, enforcement date 15 Sep 2023); PIPC press release of 10 Sep 2026 · Sources: pipc.go.kr, eiec.kdi.re.kr, newsis.com

Who it applies to

Anyone processing personal information of people in Korea. The PIPC's April 2024 guidance says foreign firms are covered if they target Korean users, significantly affect Korean data subjects, or have a business presence in Korea.PIPC Handbook on applying PIPA to foreign businesses (4 Apr 2024) · Sources: shinkim.com

Size thresholds

No general size threshold applies; PIPA covers all controllers. A foreign controller with no Korean address or office must designate a domestic agent if it meets an Enforcement Decree criterion: prior-year total revenue of KRW 1 trillion or more; information-and-communications-service revenue of KRW 10 billion or more; an average of 1 million or more Korean data subjects daily over the 3 months before the end of the prior year; or a PIPC request to submit materials after an incident.PIPA Art. 31-2(1); Enforcement Decree Art. 32-2 · Sources: elaw.klri.re.kr

Regulator

Personal Information Protection Commission (PIPC); breach reports via KISA✓Sources: pipc.go.kr, dlapiperdataprotection.com

Breach or incident reporting

Notify affected individuals within 72 hours of becoming aware. Report to the PIPC or KISA within 72 hours if 1,000+ people, sensitive or unique ID data, or outside hacking is involved. From 11 Sep 2026 notice also covers possible breaches and forgery or alteration (e.g. ransomware).✓Sources: dlapiperdataprotection.com, eiec.kdi.re.kr, newsseoul.co.kr, newsis.com

Deadline to answer personal data requests

Access must be given within 10 days of receiving the request (PIPA Art. 35(3); Enforcement Decree Art. 41(4)). If access is limited, postponed or refused, the controller must notify the person, with reasons and how to object, within 10 days (Decree Art. 41(5) / Art. 42). Correction, deletion and suspension requests (Arts. 36-37) also have 10-day handling periods under the Decree.PIPA Arts. 35-37; Enforcement Decree Arts. 41-44 · Sources: prighter.com, prighter.com

Data protection officer

Every controller must designate a Chief Privacy Officer (CPO). Larger controllers need a qualified CPO with set experience. From 11 Sep 2026 certain controllers need board approval and a PIPC filing when appointing or changing the CPO.✓Sources: eiec.kdi.re.kr, dlapiperdataprotection.com, newsseoul.co.kr

Local representative

A foreign controller with no address or office in Korea that meets the Enforcement Decree criteria (based on factors such as revenue and the volume of personal information held) must designate a domestic agent in writing (Art. 31-2(1)). The agent handles privacy grievances and damage relief (Art. 31(3)3), breach notification and reporting (Art. 34(1) and (3)), and submission of materials to the PIPC (Art. 63(1)). The agent must have an address or office in Korea. If the controller has set up a Korean company, or a Korean company exercises dominant control over it, that company must be the agent (Art. 31-2(2)). The controller must train and supervise the agent (Art. 31-2(3)) and list the agent's name, address, phone number and email in its privacy policy. The agent's violations are treated as the controller's. The Korean-company rule came from the amendment of 1 Apr 2025, in force since 2 Oct 2025.✓PIPA Art. 31-2 (as amended by Act No. 20897, 1 Apr 2025) · Sources: elaw.klri.re.kr, digitalpolicyalert.org, shinkim.com

Sending data abroad

Overseas transfer (provision, outsourced processing or storage abroad) is allowed only on an Art. 28-8(1) basis: (1) separate consent; (2) a statute, treaty or other international agreement; (3) outsourcing or storage needed to conclude or perform a contract with the data subject, disclosed in the privacy policy or notified by email or similar; (4) the recipient holds a PIPC-designated certification and takes the required protection measures in the destination country; or (5) the PIPC recognises the destination country or international organisation as giving substantially equivalent protection. The PIPC can order a transfer suspended if it breaches Art. 28-8, or if the recipient's protection is inadequate and harm has occurred or is likely. The controller may object within 7 days (Art. 28-9).✓PIPA Arts. 28-8(1), 28-9 · Sources: elaw.klri.re.kr, dlapiperdataprotection.com, bkl.co.kr

Cookies and consent

Cookies, logs and IP addresses can be personal information where they can easily be combined with other information to identify someone (Art. 2(1)(b)). Each matter needing consent must be presented clearly and consented to separately, including consent to use data to promote or sell goods or services (Art. 22(1)). Children under 14 need legal-guardian consent, which the controller must verify (Art. 22-2).✓PIPA Arts. 2(1), 15, 22(1), 22-2 · Sources: elaw.klri.re.kr, elaw.klri.re.kr, dlapiperdataprotection.com

Maximum penalty

Fines up to 3% of total revenue (excluding unrelated revenue). From 11 Sep 2026, up to 10% for repeated, intentional or grossly negligent breaches, very large breaches, or ignoring PIPC orders. Punitive damages up to 5x actual losses.✓Sources: eiec.kdi.re.kr, dlapiperdataprotection.com, mt.co.kr, newsseoul.co.kr

Facts marked “Being verified” are still being confirmed and are not given as answers.

What you must do✓

• Rely on a legal basis under Art. 15 and get separate, clearly presented consent for each matter, including marketing (Arts. 15, 22)
• Get verified legal-guardian consent before processing data of children under 14 (Art. 22-2)
• Designate a Chief Privacy Officer (Art. 31)
• Publish a privacy policy that discloses overseas transfers and your domestic agent (Arts. 28-8, 30, 31-2)
• Transfer data abroad only on an Art. 28-8(1) basis
• Appoint a domestic agent if you meet the Decree criteria, using your Korean subsidiary if you have one (Art. 31-2)

Recent changes

Under the amendment in force 11 Sep 2026 (PIPC release, 10 Sep 2026), fines can reach 10% of total revenue for repeated, intentional or grossly negligent leaks, and prior investment in protection now reduces fines. Major controllers need board approval and a PIPC filing to appoint, change or remove a CPO, with a grace period to 31 Dec 2027. Data subjects must be notified at the 'possible leak' stage, and the scope of breach notices and reports was widened. Separately, from 2 Oct 2025 a foreign business's Korean entity must act as its domestic agent, and in Sep 2025 the EU/EEA was recognised as equivalent for transfers.✓

Sources

• Primary source: https://www.pipc.go.kr/eng/user/lgp/law/lawDetail.do
• Second source: https://www.dlapiperdataprotection.com/index.html?t=law&c=KR
• Regulator: Personal Information Protection Commission (PIPC); breach reports via KISA

✓ = confirmed by two independent sources, at least one official. How we verify

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.