Personal Information Protection Act (PIPA) South Korea

Regulation Summary

Timeline

Enacted: September 30, 2011
Major Amendments: August 5, 2020; March 15, 2023
Effective Dates for Amendments: September 14, 2023 (most provisions); further provisions between March 2024 and March 2025.

What Businesses Are Affected

Domestic and international organizations handling personal data of South Korean residents.
In addition to PIPA, certain industries have sector-specific regulations (e.g., the Information and Communications Network Act for online service providers and the Credit Information Use and Protection Act for financial institutions).

Exemptions

Personal data used solely for household or personal activities.
Certain government data used for national security or public safety.

Responsibilities for Businesses

Obtain explicit consent before collecting or processing personal data.
Clearly disclose the purpose of data collection and usage.
Implement robust data security measures to protect personal data from unauthorized access.
Limit data collection to only what is necessary for the stated purpose.
Ensure secure disposal of data once its purpose has been fulfilled.
Notify breaches to affected individuals and the PIPC without undue delay.

Specific Responsibilities for Website Owners

Obtain user consent for cookies and other tracking technologies.
Publish clear privacy policies outlining data collection practices.
Provide accessible mechanisms for users to exercise their data rights.

Additional Requirements

Cross-Border Data Transfers: Require explicit consent and compliance with South Korea’s standards.
Data Breach Notifications: Notify affected individuals and the PIPC without undue delay.
Children’s Data: Implement stricter safeguards for processing personal data of individuals under 14 years old.
Pseudonymized Data: Prohibit its use for uniquely identifying individuals.

Data Subject Rights

Access: Individuals can request access to their personal data.
Correction: Incorrect or incomplete data can be corrected upon request.
Erasure: Individuals can request deletion of their personal data.
Objection: Data subjects can object to the processing of their data for specific purposes.

Enforcement

Regulatory Body: The Personal Information Protection Commission (PIPC).
Penalties: Fines of up to KRW 50 million (approximately USD $42,000) for violations, with potential criminal liability for severe breaches.