Korea’s GDPR: the Personal Information Protection Act explained for foreign businesses

When foreign businesses ask whether Korea has something like the GDPR, the answer is yes, with two differences worth knowing at once. First, Korean law has historically leaned on consent more heavily than the GDPR, and still requires separate, specific consents in situations where European law would rely on legitimate interests. Second, the regulator uses its powers: global platforms, Korean tech champions and foreign e-commerce sites have all been fined, several of them for sending Korean users’ data abroad without telling them properly.

This guide explains who PIPA applies to, the core obligations, transfers abroad, the domestic agent, breach notification, enforcement and penalties, employee data, marketing rules and the related sector laws — with a side-by-side comparison with the GDPR for readers who already know it.

The legal framework

The Personal Information Protection Act (PIPA) was enacted in 2011 as Korea’s general data protection law. In 2020 the ‘three data laws’ amendments consolidated supervision in an independent Personal Information Protection Commission (개인정보보호위원회, gaein jeongbo boho wiwonhoe) (PIPC), introduced pseudonymised information (가명정보, gamyeong jeongbo) for research and statistics, and moved most online-service rules from the Network Act into PIPA. The 2023 amendment, largely in force from September 2023, unified the rules for online and offline businesses, introduced revenue-based fines, widened the grounds for transfers abroad, and added rights concerning automated decisions. A 2025 amendment tightened the domestic-agent regime for overseas businesses from 2 October 2025.

Sector laws sit alongside: the Credit Information Use and Protection Act for financial and credit data, the Location Information Act for location data, and the Network Act for advertising messages and information security certification.

Who it applies to

PIPA applies to every personal information controller (개인정보처리자, gaein jeongbo cheorija) — any public body, company, organisation or individual that processes personal information through files for business purposes. It does not have a GDPR-style territorial article, but the PIPC applies it to foreign businesses that offer goods or services to people in Korea or otherwise process their data, and has enforced it against companies with no Korean office. A foreign business with Korean customers, users or employees should assume PIPA applies.

Personal information means information relating to a living individual that identifies, or can identify when easily combined with other information, that person — names, resident registration and passport numbers, contact details, device identifiers, images. Sensitive information (민감정보, mingam jeongbo) — health, sex life, political views, union membership, genetic and biometric data, criminal records, race and ethnicity — and unique identifiers (고유식별정보, goyu sikbyeol jeongbo) such as passport and alien registration numbers face stricter rules under Articles 23 and 24. Korean resident registration numbers (주민등록번호, jumin deungnok beonho) may be processed only where a law specifically requires or permits it, under Article 24-2.

PIPA and GDPR side by side

A simplified comparison. Both laws have many qualifications not shown here.

The core obligations

Legal basis and consent

Under Article 15 a controller may collect and use personal information with the data subject’s consent or on statutory grounds, including where necessary to perform or take steps towards a contract, to comply with a legal obligation, or for the controller’s legitimate interests where these clearly override the individual’s rights and the processing is substantially related and reasonable. The 2023 amendment made contract necessity a ground in its own right, reducing the old habit of asking consent for everything. Consent, where relied on, must be obtained with a notice of purposes, items, retention and the right to refuse, and separately for distinct matters — provision to third parties (제3자 제공, je-samja jegong) under Article 17, marketing, sensitive data and unique identifiers. Bundled or hidden consents are invalid. Children under 14 need a legal representative’s consent under Article 22-2.

Minimisation, retention and destruction

Collect only what is needed for the stated purpose; the burden of proving necessity lies with the controller. Destroy personal information without delay when its purpose is achieved or the retention period ends, under Article 21, unless another law requires keeping it — tax and commercial records, for example, which must then be stored separately.

Privacy policy and the privacy officer

Every controller publishes a privacy policy (개인정보 처리방침, gaein jeongbo cheori bangchim) under Article 30 covering purposes, items, retention, third-party recipients, processors, transfers abroad, data subject rights, the privacy officer and security measures. For Korean users it must be in Korean and easy to find. Every controller designates a chief privacy officer (개인정보 보호책임자, gaein jeongbo boho chaegimja) under Article 31; larger controllers must appoint one with prescribed qualifications and independence.

Processors and outsourcing

Using a processor — cloud, CRM, payroll, call centre — is outsourcing (위탁, witak) under Article 26. It needs a written contract with prescribed terms, disclosure of the processor and its tasks in the privacy policy, and supervision of the processor’s security. Sub-processing needs the controller’s consent. The PIPC has fined foreign platforms specifically for failing to supervise overseas processors.

Security

Controllers must take the technical, managerial and physical safeguards prescribed by the PIPC’s security standards under Article 29: access control, encryption of unique identifiers and passwords, access logs kept and reviewed, internal management plans, and staff training. Large online businesses may also need the ISMS or ISMS-P certification administered by the Korea Internet & Security Agency (KISA).

Transfers abroad

This is where foreign businesses are most exposed. Under Article 28-8, personal information may be transferred outside Korea — including by giving a foreign parent, server or processor access to it — only on one of these bases:

• Separate consent after notice of the items, destination country, recipient, timing and method, purposes, retention and the right to refuse.
• A treaty or international agreement that provides for the transfer.
• Certification of the recipient under a PIPC-recognised scheme.
• An equivalent country recognised by the PIPC as providing protection substantially equivalent to PIPA.
• Contract necessity with disclosure: where outsourcing or storage abroad is necessary to conclude or perform a contract with the data subject, and the required details are disclosed in the privacy policy or notified to the individual.

The PIPC can order a controller to suspend transfers that breach the law or put individuals at risk, under Article 28-9. Onward transfers by the foreign recipient must meet the same standard.

In practice, a foreign group whose Korean subsidiary uses global HR, CRM, e-commerce or cloud systems relies mostly on the disclosure route, with the privacy policy naming each recipient, country, item and purpose — and on consent where the transfer is not necessary for the contract, for example for group marketing. Vague wording such as ‘affiliates and service providers worldwide’ is what has drawn fines.

Korea does not stop data leaving. It insists you say exactly where it goes, to whom, and why.

Voixa Korea

The domestic agent

A business with no address or place of business in Korea that meets thresholds set by decree — worldwide revenue, Korean-related revenue, the number of Korean data subjects, or involvement in a breach — must designate a domestic agent (국내대리인, gungnae daeriin) in writing under Article 31-2. The agent acts as privacy officer for Korean matters, handles breach notifications and submits materials to the PIPC; its name, address and contact details go in the privacy policy, and the foreign business is liable for its acts.

Since 2 October 2025, an overseas business that has a Korean subsidiary must designate that subsidiary as its domestic agent, and agents must be capable of actually performing the role. The PIPC fined a foreign e-commerce platform in 2025 partly for failing to appoint one. For a foreign group, the practical answer is usually its own Korean company — another reason to have one once the Korean user base is significant.

Data subject rights

Individuals can request access to their information (Article 35), correction or deletion (Article 36) and suspension of processing (Article 37). Controllers must respond within ten days, and make the procedure no harder than collection — the PIPC has penalised account-deletion flows with too many steps. Since March 2024, individuals can refuse or ask for an explanation of fully automated decisions (자동화된 결정, jadonghwadoen gyeoljeong) that significantly affect their rights under Article 37-2, relevant to credit scoring, hiring tools and fraud engines. A general right to data portability (전송요구권, jeonsong yogugwon) under Article 35-2 is being implemented sector by sector, starting with health and telecoms data.

Breach notification

When a controller becomes aware that personal information has been leaked, it must notify the affected individuals within 72 hours under Article 34, stating the items leaked, when and how, what individuals can do, what the controller is doing and whom to contact. Where the breach affects at least 1,000 people, involves sensitive information or unique identifiers, or results from unlawful external access such as hacking, the controller must also report to the PIPC or KISA within the same 72 hours. Notification can be phased where facts are still being established, but the clock runs from awareness. Prepare a Korean-language notice template and a contact route before you need them.

Enforcement and penalties

The PIPC investigates on complaints, reports and its own initiative, and publishes its decisions. Its toolkit:

Main enforcement tools under PIPA.

Recent decisions show the pattern. In 2022 the PIPC fined Google and Meta a combined KRW 100 billion for collecting behavioural data without valid consent. In 2024 it fined AliExpress about KRW 2 billion, and in 2025 Temu about KRW 1.4 billion, for transferring Korean users’ data overseas without proper disclosure, failing to supervise overseas processors and, in Temu’s case, failing to appoint a domestic agent and making account deletion difficult. Korean companies have faced fines in the tens of billions of won for breaches. Size is no shield, and neither is distance.

Employees and HR data

Employee data is personal information. Korean employers rely on contract necessity and legal obligations for payroll and social insurance, and on consent for anything beyond — background checks, monitoring, sharing with the foreign parent beyond what the employment requires. Workplace CCTV is regulated by Article 25 with signage and purpose limits, and email or device monitoring needs a clear policy and, generally, consent. Transfers of employee data to a global HR system abroad need a basis under Article 28-8 like any other transfer. Our guide to hiring in Korea covers the employment side.

Marketing messages

Advertising by text message, email, app push or phone needs the recipient’s prior opt-in consent under Article 50 of the Network Act, separately from consent to process their data. Messages must be labelled as advertising — ‘(광고)’ at the start — identify the sender and offer free opt-out; messages between 9 pm and 8 am need additional consent; and consent must be re-confirmed every two years. Breaches bring administrative penalties per message campaign and are a common source of complaints.

A practical programme

1. Map the data: what you collect from Korean users and staff, where it goes, who processes it, which countries it reaches.
2. Fix the legal bases: contract necessity where it genuinely applies, separate consents where it does not.
3. Publish a Korean privacy policy with every transfer abroad named precisely.
4. Paper the processors: outsourcing contracts with PIPA terms, and a way to supervise them.
5. Appoint people: a chief privacy officer and, above the thresholds, a domestic agent — your Korean subsidiary if you have one.
6. Prepare for breaches: a 72-hour plan with Korean notices ready.
7. Make rights easy: deletion and access in a few clicks, answered within ten days.
8. Train and record: the PIPC asks for evidence, not intentions.

A worked example

A German online retailer sells to Korean consumers through a Korean-language site, with orders processed in its EU systems and customer service outsourced to a provider in the Philippines. It maps the flows, relies on contract necessity for order processing and delivery, and discloses in its Korean privacy policy the transfer of named data items to its German entity, its EU cloud provider and the Philippine call centre, with purposes and retention. Marketing emails go only to customers who opted in separately, labelled ‘(광고)’. As Korean users pass the decree threshold, it forms a Seoul subsidiary for local marketing and designates it as domestic agent. When a misconfigured server exposes 3,000 Korean customers’ addresses, it notifies them and KISA within 72 hours using its prepared template, and the PIPC closes the matter with a corrective recommendation rather than a fine.

Mistakes we see

1. An English-only privacy policy, or a Korean one that says data goes to ‘affiliates worldwide’.
2. Bundled consents — marketing and third-party provision hidden in the terms of service.
3. No domestic agent, or one that exists only on paper.
4. Overseas processors without contracts or supervision.
5. Collecting resident registration numbers without a legal basis.
6. Account deletion hidden behind many steps.
7. No 72-hour plan until the first breach.
8. Marketing texts without ‘(광고)’ or sent at night without consent.

Korean terms you will meet

Questions readers ask

About the author

Alexander Baranov

Founder of the BCA Group · cross-border corporate and tax adviser since 2008

Alexander advises foreign founders and groups on company formation, tax structuring and corporate law in more than 40 jurisdictions across Europe, the Gulf, Asia and Latin America. He is the author of nine books on international business and tax and writes regularly for professional finance and tax journals. He works in English, German, Spanish and Russian.

This guide is based on the Korean statutes cited in the text and on our own filings. It is reviewed when the law or official rates change.

Ask Alexander on WhatsAppContact