South Korea Personal Information Protection Act Compliance

Lawful Bases for Processing Under PIPA

Consent is important under PIPA, but it is not required for every processing activity. For example, processing necessary to perform a contract can rely on a statutory basis rather than consent.

PIPA does not require consent for every collection or use of personal information.

Depending on the circumstances, processing may be permitted under statutory grounds including:

• Consent from the data subject
• Necessity for entering into or performing a contract
• Compliance with statutory obligations
• Processing necessary for certain legitimate interests recognized under PIPA
• Emergency circumstances involving life, body, or property
• Other circumstances specifically permitted under the Act

The PIPC has specifically emphasized that organizations should not improperly label processing as requiring consent when a statutory basis, such as contractual necessity, applies.

This distinction is important when designing website consent experiences.

Consent Under PIPA

Where consent is used as the legal basis, organizations should provide individuals with clear information about the processing and obtain consent in accordance with PIPA's requirements.

Consent interfaces should distinguish relevant processing activities rather than combining unrelated purposes into a single unclear choice.

Organizations should maintain evidence showing:

• What information was presented
• The purpose of processing
• The consent option presented
• The individual's decision
• Date and time of consent
• Relevant privacy-policy or notice version
• Any subsequent withdrawal or change

ConsentX can help maintain this evidence for website-level consent activities.

Separate Consent Requirements

PIPA contains circumstances in which separate or additional consent is required.

These can include processing involving:

• Sensitive personal information
• Unique identifying information
• Certain third-party disclosures
• Certain cross-border transfers

The PIPC has taken enforcement action where businesses failed to obtain or properly communicate consent for cross-border processing.

Sensitive Personal Information

PIPA provides enhanced protection for sensitive personal information.

This includes information revealing or relating to areas such as:

• Ideology
• Political opinions
• Religious beliefs
• Health and medical information
• Sexual life
• Other categories specified under the law

Processing sensitive personal information is restricted and requires an appropriate legal basis and additional safeguards. Where consent is the applicable basis, separate consent is required.

Organizations should maintain separate controls for:

• Collection
• Purpose specification
• Access
• Storage
• Disclosure
• Retention
• Security
• Consent

Unique Identifying Information

PIPA provides additional protections for unique identifying information.

Organizations processing information such as certain identification numbers must comply with specific statutory requirements.

Where consent is required, organizations should not assume that a general privacy consent automatically covers the processing of unique identifying information.

Consent and privacy workflows should clearly distinguish this processing where applicable.

Children's Personal Information

PIPA provides additional protections for children under 14 years of age.

Where required, organizations must obtain consent from the child's legal guardian and implement appropriate procedures for verifying and documenting that consent. The PIPC's guidance for foreign businesses specifically identifies guardian consent for children under 14 as an important PIPA obligation.

Organizations serving children should therefore consider:

• Age verification
• Guardian identification
• Guardian consent
• Consent records
• Child-specific privacy notices
• Appropriate data minimization
• Deletion and retention controls

Data Subject Rights Under PIPA

PIPA provides individuals with important rights concerning their personal information.

Depending on the circumstances, individuals may exercise rights including:

• Access to personal information
• Correction of inaccurate information
• Deletion
• Suspension of processing
• Suspension of transmission
• Other rights provided under the Act

The PIPC provides mechanisms for individuals to request access, correction, deletion, and suspension of processing.

Organizations should maintain documented workflows for:

• Receiving requests
• Verifying the requester
• Identifying relevant personal information
• Evaluating the request
• Applying any statutory restrictions or exceptions
• Completing the requested action
• Communicating the result
• Maintaining evidence of the response

Privacy Notices

PIPA requires organizations to establish and disclose an appropriate privacy policy.

The policy should provide understandable information about relevant personal information processing, including matters such as:

• Personal information collected
• Purpose of processing
• Retention and use periods
• Third-party provision
• Entrusted processing
• Cross-border processing
• Data-subject rights
• Security measures
• Contact details and responsible personnel
• Other information required by PIPA

The PIPC specifically highlights privacy-policy disclosure as an obligation for foreign businesses subject to PIPA.

Data Minimization and Purpose Limitation

Organizations should collect and use personal information only to the extent necessary for legitimate and defined processing purposes.

Businesses should regularly review:

• What information is collected
• Why it is collected
• Whether each field remains necessary
• How long information is retained
• Which third parties receive it
• Whether the information is used for additional purposes

Data that is no longer required should be destroyed in accordance with applicable PIPA requirements.

Data Security Requirements

PIPA requires organizations to implement appropriate safeguards to protect personal information from:

• Loss
• Theft
• Leakage
• Unauthorized access
• Alteration
• Destruction
• Other security incidents

Organizations should establish both technical and organizational controls.

These can include:

Technical safeguards

• Access controls
• Authentication
• Encryption
• Security monitoring
• Vulnerability management
• Network protection
• Access logging

Organizational safeguards

• Privacy policies
• Employee training
• Access-management procedures
• Incident-response plans
• Vendor oversight
• Periodic security assessments
• Assigned privacy responsibilities

The PIPC has increasingly emphasized preventive privacy and security management rather than relying only on post-incident enforcement.

Personal Information Breach Notification

Organizations must respond promptly to qualifying personal information breaches.

Under the current framework, businesses generally must notify the relevant authority and affected data subjects without undue delay and within 72 hours where the applicable notification requirements are triggered. The PIPC has also emphasized the 72-hour requirement for foreign businesses handling Korean data subjects' information.

A breach-response program should include:

• Incident detection
• Risk assessment
• Containment
• Regulatory notification
• Individual notification
• Remediation
• Evidence preservation
• Post-incident review

The PIPC has imposed significant sanctions where organizations failed to maintain adequate safeguards or delayed breach notifications.

Cross-Border Data Transfers

PIPA contains specific requirements for transferring personal information outside South Korea.

Depending on the circumstances and applicable mechanism, organizations may need to:

• Obtain separate consent
• Provide required transfer information
• Enter into appropriate contractual arrangements
• Use another legally recognized transfer mechanism
• Conduct the required assessments
• Maintain appropriate safeguards

The PIPC has actively enforced these rules against companies transferring Korean users' information overseas without satisfying the applicable requirements.

Cross-Border Processing by Overseas Vendors

Organizations should distinguish between:

Entrusted processing

An overseas service provider processes personal information on behalf of the organization under the applicable outsourcing/entrustment arrangement.

Third-party provision

The recipient independently receives or processes the information in a manner that falls outside ordinary entrusted processing.

The distinction matters because the applicable legal basis, transparency, contractual obligations, and transfer requirements can differ.

The PIPC has specifically emphasized that simply describing every external transfer as "sharing" or "outsourcing" is not sufficient; organizations should correctly characterize the relationship.

Domestic Representative for Foreign Businesses

Certain foreign businesses subject to PIPA may be required to designate a domestic representative in Korea.

The representative can serve as an important point of contact for privacy-related communications, regulatory matters, and data-subject rights.

Foreign organizations should assess whether their business activities and processing volumes trigger the applicable domestic-representative requirements.

Chief Privacy Officer and Privacy Governance

PIPA places significant emphasis on organizational accountability.

Organizations should establish clear responsibility for personal information protection, including the role of the Chief Privacy Officer (CPO) where applicable.

The 2026 amendments further strengthen management accountability and the role of privacy officers, including measures relating to organizations handling large amounts of personal information or sensitive information.

Privacy governance should cover:

• Internal privacy policies
• Data-processing oversight
• Risk management
• Security coordination
• Employee training
• Breach response
• Vendor management
• Compliance reviews
• Executive reporting

Privacy Impact Assessments

Organizations processing personal information in circumstances covered by PIPA's assessment requirements may need to conduct a Personal Information Impact Assessment (PIA).

A PIA can help organizations identify:

• Processing risks
• Security vulnerabilities
• Excessive collection
• Privacy risks to individuals
• Appropriate mitigation measures

Organizations should assess whether their processing activities fall within mandatory PIA requirements.

Cookies and Online Tracking Under PIPA

PIPA is not a dedicated cookie-consent law.

However, cookies, pixels, advertising identifiers, analytics tools, device identifiers, and other tracking technologies can involve personal information or personal-information-related processing depending on how they are used.

Organizations should therefore assess:

• What information the tracker collects
• Whether the information constitutes personal information
• Whether it can be linked with identifiable individuals
• The purpose of processing
• The legal basis
• Whether information is provided to third parties
• Whether information is transferred outside Korea
• Whether separate consent is required

For websites, organizations should avoid assuming that every cookie automatically requires consent under PIPA. Instead, the specific processing activity and applicable legal basis should be assessed.

Online Advertising and Personal Information

Advertising and analytics ecosystems can create additional PIPA compliance considerations.

Organizations should review:

• Advertising identifiers
• Behavioral analytics
• Retargeting
• Audience segmentation
• Third-party pixels
• SDKs
• Cross-border analytics providers
• Data sharing with advertising platforms

Where a third party independently processes or uses personal information, the organization should assess whether the arrangement constitutes entrusted processing or third-party provision and identify the applicable legal requirements.

Automated Decision-Making

PIPA includes protections concerning automated decision-making.

Organizations using automated systems to make decisions affecting individuals should evaluate applicable transparency, explanation, objection, and other requirements.

This area is particularly relevant for:

• AI systems
• Credit or risk scoring
• Recommendation systems
• Recruitment systems
• Personalized advertising
• Automated eligibility decisions

Organizations should document how automated processing operates and identify the applicable rights and safeguards.

AI and PIPA

South Korea's privacy regulator has increasingly developed guidance addressing the use of personal information in AI development and services.

The PIPC has recognized legitimate interests as a potential legal basis for certain AI-related processing of publicly available data where the statutory requirements are satisfied, including purpose legitimacy, necessity, and balancing of interests and data-subject rights.

Organizations using personal information for AI should therefore evaluate:

• Source of training data
• Legal basis
• Necessity
• Data minimization
• Privacy risks
• Security controls
• Data-subject rights
• De-identification
• Model and output safeguards
• Privacy impact assessments where applicable

2026 PIPA Amendments

The PIPA amendment that took effect on September 11, 2026 introduces significant changes to South Korea's privacy enforcement and governance framework.

Key developments include:

Stronger sanctions for serious and repeated breaches

The amended framework introduces punitive sanctions of up to 10% of annual turnover for specified repeated and severe data-breach circumstances.

Stronger management accountability

The amendments strengthen the responsibilities of CEOs and Chief Privacy Officers for personal information protection.

ISMS-P developments

The amended framework strengthens the relationship between privacy protection and ISMS-P certification, including additional mechanisms for oversight and prevention.

AI-related amendment

In August 2026, the National Assembly also passed a further PIPA amendment addressing the lawful use of personal information for AI development in the public interest, together with additional privacy safeguards and PIPC oversight mechanisms. Organizations should monitor the effective date and implementing requirements of this amendment.

Data Retention and Destruction

Organizations should retain personal information only for as long as necessary for the applicable processing purpose or as otherwise required by law.

Retention programs should establish:

• Retention periods
• Purpose for continued retention
• Data categories
• Legal retention requirements
• Deletion triggers
• Secure destruction methods
• Documentation of destruction

The PIPC has emphasized the importance of destroying personal information once it is no longer necessary to minimize the impact of potential breaches.

Third-Party Processors

Organizations using vendors to process personal information should maintain appropriate oversight.

This includes:

• Vendor due diligence
• Processing agreements
• Security requirements
• Confidentiality
• Sub-processor controls
• Breach notification requirements
• Data deletion
• Access controls
• Cross-border transfer assessment
• Compliance monitoring

Where an overseas vendor processes Korean personal information, the organization should separately evaluate PIPA's cross-border requirements.