South Korea Personal Information Protection Act (PIPA)

Why does it matter?

PIPA is the single statute that governs personal information in Korea since the 2020 amendment folded the online provider rules into it, and Article 6 makes it the default law wherever another statute is silent. The PIPC can impose a penalty surcharge of up to 3 percent of total sales under Article 64-2, order suspension of cross-border transfers under Article 28-9, publish its decisions, and refer cases for the criminal penalties in Articles 70 to 73, which reach ten years' imprisonment or a fine of 100 million won for the gravest offenses. For a foreign company the Act also reaches inside its group: Article 31-2 requires a controller without a Korean place of business, above the thresholds set by Presidential Decree, to designate a domestic agent, and since the 2025 amendment that agent must be chosen from the controller's own Korean subsidiaries where it has them.

Key benefits include:

• Statutory principles with teeth

Article 3 sets eight principles, from purpose specification and minimum collection to accuracy, safety, transparency and privacy-minimizing processing, which the PIPC applies in its corrective orders.

• Named lawful bases

Article 15(1) lists seven grounds for collection and use, including consent, statute, contract necessity, imminent danger, legitimate interests that manifestly outweigh the data subject's rights and urgent public safety.

• A fixed breach clock

Article 34 requires notice to data subjects and a report to the PIPC without delay; Articles 39 and 40 of the Enforcement Decree set 72 hours and the reporting thresholds.

• Cross-border transfer grounds

Article 28-8 allows transfers on separate consent, statute or treaty, contract necessity with disclosure, PIPC-notified certification or PIPC recognition of an equivalent level of protection.

• Surcharges on revenue

Article 64-2 lets the PIPC impose a penalty surcharge of up to 3 percent of total sales, or up to 2 billion won where sales cannot be calculated, for the listed violations.

How does it work?

Chapter I defines personal information in Article 2 as information on a living individual that identifies that person or can easily be combined with other information to do so, and includes pseudonymized information; Article 4 lists the data subject's rights, including the right to refuse or demand an explanation of a fully automated decision. Chapter II establishes the PIPC under the Prime Minister (Article 7) with the deliberation and resolution powers of Article 7-9. Chapter III governs processing: Article 15 for collection and use, Article 17 for provision to third parties, Article 18 for use beyond the purpose, Article 21 for destruction, Article 22 for consent, Article 23 for sensitive information, Article 24 for personally identifiable information and Article 24-2 for resident registration numbers, which may be processed only where a statute requires it and must be encrypted.

Chapter IV sets the safeguards. Article 29 requires technical, managerial and physical measures prescribed by Presidential Decree, including an internal management plan and access records; Article 30 requires a published privacy policy; Article 31 requires a privacy officer, who defaults to the business owner or representative where none is designated; Article 31-2 requires a domestic agent for foreign controllers above the Decree thresholds; Article 32 requires public institutions to register personal information files; Article 32-2 provides the PIPC's certification of personal information protection, valid for three years; Article 33 requires public institutions to run a privacy impact assessment through a PIPC-designated institution; and Article 34 requires breach notification and reporting. Chapter III also covers pseudonymized information (Articles 28-2 to 28-7) and cross-border transfers (Articles 28-8 to 28-11).

Chapter V gives data subjects the rights to access (Article 35), transmission (Article 35-2, phased in by Presidential Decree), correction and erasure (Article 36), suspension of processing and withdrawal of consent (Article 37) and the automated-decision rights of Article 37-2, with damages, statutory damages and the submission and confidentiality orders of Articles 39 to 39-6. Chapters VII and VIII provide dispute mediation and the class action lawsuit. Chapter IX sets the PIPC's supervision tools: corrective measures (Article 64), penalty surcharges (Article 64-2) and publication of results (Article 66); Chapter X holds the criminal penalties (Articles 70 to 73) and administrative fines of up to 50 million won (Article 75). The Enforcement Decree (Presidential Decree No. 23169, as amended) supplies the thresholds, periods and forms.

Key Elements

• Sensitive and identifying information (Articles 23, 24, 24-2)

Ideology, beliefs, union or party membership, political opinions, health, sex life and other Decree-listed categories, and personally identifiable numbers, need separate consent or a statutory basis; resident registration numbers may be held only where a statute requires it and must be encrypted.

• Privacy officer and domestic agent (Articles 31, 31-2)

A privacy officer plans, surveys, trains, handles grievances and controls personal information files; foreign controllers above the Decree thresholds appoint a domestic agent in Korea, chosen from a Korean subsidiary where one exists, and supervise it.

• Breach notification (Article 34; Decree Articles 39, 40)

Data subjects are notified within 72 hours of the facts, the timing, mitigation advice, countermeasures and a help desk; the PIPC or KISA receives a report within 72 hours where 1,000 or more data subjects are affected, sensitive or identifying information is involved, or an external intrusion caused the breach.

• Cross-border transfers (Articles 28-8, 28-9)

Transfer, including remote access, entrusted processing and storage abroad, needs one of the Article 28-8 grounds and the safeguards it lists; the PIPC may order a transfer suspended, with seven days to object.

• Rights on automated decisions and portability (Articles 37-2, 35-2)

A data subject may refuse a fully automated decision that significantly affects rights or duties, or demand an explanation, unless the decision rests on consent, statute or contract; controllers must publish their decision criteria and procedures; transmission requests apply to controllers above the Decree thresholds.

• Sanctions (Articles 64-2, 70 to 75)

Penalty surcharges up to 3 percent of total sales for unlawful processing, children's data, sensitive data, identifying numbers, safeguard failures and unlawful transfers; imprisonment up to ten years or 100 million won for the gravest crimes; administrative fines up to 50 million won.

What does it cover?

PIPA applies to every personal information controller, defined in Article 2(5) as a public institution, corporation, organization or individual that processes personal information to operate personal information files, whether in the public or the private sector, and to the processors it entrusts under Article 26. It covers the personal information of living individuals in any form, including pseudonymized information, and reaches foreign controllers that serve Korean data subjects through the domestic agent duty of Article 31-2 and the transfer rules of Articles 28-8 to 28-11. Article 58 excludes certain processing for national security, public safety, statistics, religious and political purposes, and Article 6 makes the Act the governing law except where another statute provides otherwise.

What are its objectives?

Article 1 states the purpose: to protect the freedom and rights of individuals, and further to realize the dignity and value of individuals, by prescribing the processing and protection of personal information. Article 3 translates that into eight principles for controllers.

Specify the purposes of processing explicitly and collect personal information lawfully, fairly and to the minimum extent necessary (Article 3(1)).

Process personal information appropriately for those purposes and not beyond them, and keep it accurate, complete and up to date (Article 3(2) and (3)).

Manage personal information safely according to the processing methods and the severity of the risks (Article 3(4)).

Publish the privacy policy and guarantee the data subject's rights, including access (Article 3(5)).

Process in a manner that minimizes the possibility of infringing privacy, and process anonymously or pseudonymously where the purpose can still be achieved (Article 3(6) and (7)).

Framework in Context

PIPA sits alongside the sector statutes that Article 6 leaves in place, such as the Act on Promotion of Information and Communications Network Utilization and Information Protection under which the Korea Internet and Security Agency receives breach reports, and the PIPC's Enforcement Decree and notifications supply its thresholds and technical standards. Internationally it is the basis of the European Commission's adequacy decision of December 17, 2021 for transfers from the EU to Korean controllers under the GDPR, which the Commission reviewed for the first time in July 2026, and the PIPC's own equivalence recognition under Article 28-8(1)5 is the mirror mechanism for outbound transfers. The Act's structure of principles, lawful bases, special categories, officer, impact assessment, breach reporting and transfer grounds maps closely to the GDPR, Japan's APPI and Singapore's PDPA, with the resident registration number rules and the revenue-based surcharge as its distinctive features.

Common Framework Mappings

Organizations map PIPA's obligations to the frameworks below so that one privacy program serves the PIPC, EU adequacy requirements and group-wide privacy standards.

Mapped frameworks include:

APEC PF

GDPR

ISO 27001:2022

ISO 27018

ISO 27701

APPI

NIST Privacy Framework v1.0

Singapore PDPA