South Korea. Comprehensive data protection. Act
PIPAPersonal Information Protection Act (개인정보 보호법)
§1Summary
- Synopsis
Korea's comprehensive privacy law, consent-heavy and highly prescriptive, enforced by an independent PIPC. Since 2023 it applies one rule set online and offline, includes rights against automated decisions and imposes revenue-based penalty surcharges.
- Key themes
- Unique features
Very granular consent requirements; 2026 amendment raises surcharges to 10% of revenue for aggravated cases and names the CEO as ultimately responsible.
- SaaS relevance
Applies to foreign SaaS processing Koreans' data; larger foreign providers must appoint a domestic representative, and overseas storage/processing needs consent or another lawful transfer basis.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Individuals within 72h; PIPC within 72h where >1,000 people, sensitive/unique IDs, or external hacking; 2026 amendment extends to 'possible' breaches
- DPO
- Yes
- Cross-border transfers
- Consent, or contract necessity with disclosure, certification, or PIPC adequacy (EU recognised 2025-09-03)
- Maximum penalty
- Up to 3% of total revenue (10% for aggravated cases from 2026-09-11)
§3Dates
- Key dates
- Adopted
- In force
- 2020 'data 3 laws' amendment (PIPC unified, pseudonymised data); major 2023 amendment (in force 2023-09-15; ADM rights 2024-03-15; portability phased); 2026-03-10 amendment mostly effective 2026-09-11; ISMS-P mandatory 2027-07-01; further AI-related amendment passed 2026-08-27
§4Text and authority
- Text
- Authoritative text law.go.kr
- English text law.go.kr
- Authority
- Personal Information Protection Commission (PIPC)
§5Where it applies
- Domestic law of
- South Korea
§6Sources and verification
- Sources consulted
- Verification
High confidence.
2023 amendment dates from general knowledge. Contents of the Aug 2026 AI-related amendment not reviewed.