Data protection & privacy law in South Korea (2026)

Legal framework

Personal Information Protection Act (PIPA), enforced by the Personal Information Protection Commission (PIPC), South Korea's independent national data protection authority.

Key points: data & privacy in South Korea

1. 01Comprehensive statute

   PIPA is a cross-sectoral law governing the collection, use, processing and transfer of personal information by both public bodies and private organizations; a January 2020 overhaul (effective August 2020) consolidated the framework, and a further major amendment took effect on 15 September 2023.

   pipc.go.kr eucrim.eu

2. 02Supervisory authority

   The Personal Information Protection Commission (PIPC) is an independent, ministerial-level central administrative agency reporting to the Prime Minister, comprising nine commissioners; it sets policy, investigates violations, issues dispositions, handles complaints and dispute mediation, and enforces PIPA nationwide.

   pipc.go.kr en.wikipedia.org

3. 03Data subject rights

   PIPA grants rights to access, correct, delete and suspend processing of personal data, plus consent withdrawal; the 2023 amendment added a right to data portability (phased in from 2025) and the right to object to or seek explanation of fully automated decisions, including AI-driven processing.

   dataguidance.com pipc.go.kr

4. 04Consent and cross-border transfers

   Processing generally requires explicit, informed consent, with limited statutory exceptions. The amended PIPA broadened legal bases for overseas transfers (treaties, PIPC certification, or transfer to jurisdictions PIPC deems to have adequate protection) and empowers the PIPC to halt non-compliant cross-border transfers.

   shinkim.com dataguidance.com

5. 05EU adequacy recognition

   On 17 December 2021 the European Commission adopted an adequacy decision for South Korea, allowing personal data to flow from the EU/EEA without additional safeguards; it excludes credit data supervised by the Financial Services Commission and data transferred to religious organizations or political parties.

   eucrim.eu edpb.europa.eu

6. 06Enforcement and recent reforms

   The PIPC can impose administrative fines and corrective orders. A 2025 reform requires foreign businesses targeting Korean users to appoint a local representative (effective October 2025), and a February 2026 amendment introduces fines of up to 10% of total revenue for severe breaches and assigns CEO-level accountability, with key provisions slated to take effect in September.

   iapp.org cnil.fr

Timeline of decisions

1. 10 Mar 2026Law
   PIPA Overhauled: 10% Turnover Fines and CEO Personal Liability

   South Korea promulgated the most consequential rewrite of PIPA since 2023, raising the maximum administrative fine ceiling to 10% of total turnover and introducing statutory personal liability for CEOs who fail to supervise data-protection compliance; board-level approval is now required for Chief Privacy Officer appointments. The law takes effect 11 September 2026.

   Hunton Andrews Kurth Privacy Blog

2. 10 Mar 2026Law
   PIPA Amendment Promulgated: 10% Turnover Fines, CEO Liability, Mandatory ISMS-P

   The National Assembly passed a major PIPA overhaul on 12 February 2026, promulgated 10 March 2026 (effective September 2026; mandatory ISMS-P from 1 July 2027). Key changes include an aggravated administrative penalty of up to 10% of total annual turnover for serious or repeated violations, express CEO accountability, strengthened Chief Privacy Officer authority, and mandatory ISMS-P certification for data controllers meeting prescribed size/data-volume thresholds, converting a previously voluntary standard into a statutory obligation.

   Lee & Ko (law firm analysis of National Assembly bill)

3. 28 Aug 2025Enforcement
   PIPC Imposes Record ₩134.8 Billion Fine on SK Telecom Following Massive USIM Breach

   South Korea's Personal Information Protection Commission fined SK Telecom ₩134.8 billion (~$97 million), the largest privacy penalty in the country's telecoms sector, for failing to encrypt 26.1 million SIM authentication keys, maintaining inadequate network segmentation, and delaying breach notifications after attackers exfiltrated USIM data of roughly 23 million subscribers. The regulator ordered a company-wide security overhaul; SK Telecom filed suit in January 2026 to overturn the fine.

   DataGuidance

4. 1 Aug 2025Enforcement · official
   SK Telecom Fined Record KRW 134.8 Billion for SIM-Data Mega-Breach

   After a three-month joint investigation with KISA, the PIPC imposed South Korea's largest-ever privacy penalty on SK Telecom; investigators found the carrier failed to encrypt sensitive subscriber data, stored admin credentials in plain text, and ignored available security patches, violating core PIPA safeguard obligations.

   Personal Information Protection Commission (PIPC)

5. 15 Mar 2024Law · official
   Amended PIPA Enforcement Decree Effective: Data Portability and Automated-Decision Rights Operationalized

   The revised Enforcement Decree fleshed out the 2023 PIPA amendment by specifying security standards for data portability requests, procedures for challenging fully automated (including AI) decisions, and updated cross-border transfer rules, completing the GDPR-alignment reforms begun in 2023.

   Personal Information Protection Portal (PIPC official portal)

6. 15 Sept 2023Law
   Major PIPA Overhaul Enters Force: Unified Security Obligations and 72-Hour Breach Notification

   A sweeping PIPA amendment (passed May 2023, effective 15 September 2023) extended the stricter security and breach-notification duties previously reserved for online businesses to all data controllers. Organisations suffering hacks that expose sensitive or identifying data of more than 1,000 people must notify the PIPC and affected data subjects within 72 hours; large data controllers must purchase breach-liability insurance; and the PIPC was confirmed as the sole independent supervisory authority for all sectors.

   DataGuidance

7. 17 Dec 2021Decision · official
   EU Adopts GDPR Adequacy Decision for South Korea

   The European Commission formally recognized South Korea as providing 'essentially equivalent' data protection to the EU under GDPR, enabling free EU-Korea personal-data transfers without additional safeguards; the decision excluded transfers of financial personal-credit data and is subject to review every three to four years.

   European Data Protection Board (EDPB)

8. 5 Aug 2020Law
   'Data 3 Acts' Amendments Effective: PIPC Elevated, Pseudonymized-Data Regime Created

   Landmark amendments to PIPA, the Network Act, and the Credit Information Act (passed 9 January 2020) took effect: the PIPC became an independent cabinet-level authority consolidating all privacy enforcement, a legal framework for pseudonymized data in R&D and statistics was introduced, and OSP privacy rules were folded into PIPA, creating South Korea's modern unified data-governance architecture.

   Kim & Chang (analysis of official National Assembly legislation)

9. 21 Jan 2014Incident · official
   Korea Credit Bureau Mega-Breach: 104 Million Credit Card Records Stolen

   An IT contractor at Korea Credit Bureau copied names, resident registration numbers, and credit card details of 104 million accounts, covering roughly 40% of South Korea's population, onto a USB drive and sold them to marketing firms; the scandal exposed critical gaps in the pre-PIPC regulatory framework and accelerated demands for stronger enforcement powers.

   Financial Supervisory Service (FSS)

10. 30 Sept 2011Law · official
    Personal Information Protection Act (PIPA) Enacted, South Korea's First Unified Privacy Law

    South Korea enacted PIPA as its first comprehensive, sector-neutral data-protection statute, replacing a patchwork of conflicting sectoral rules; the law established consent requirements, data-minimization duties, mandatory breach notification, and created the Personal Information Protection Commission, laying the constitutional foundation for all subsequent privacy regulation.

    Korea Legislation Research Institute (KLRI) — official English translation

Sources

1. 1.pipc.go.kr/eng/index.do
2. 2.pipc.go.kr/eng/user/lgp/law/lawsRegulations.do
3. 3.eucrim.eu/news/commission-adopted-adequacy-decision-for-south-korea/
4. 4.edpb.europa.eu/news/news/2021/edpb-adopts-opinion-draft-south-korea-adequacy-decisio
5. 5.dataguidance.com/sites/default/files/gdpr_v_pipa_may_2023_update.pdf
6. 6.shinkim.com/eng/media/newsletter/2048
7. 7.iapp.org/news/a/south-korea-overhauls-pipa-and-ties-fines-to-ceo-accountabilit
8. 8.cnil.fr/en/korean-data-protection-authority-pipc-publishes-guidelines-foreign
9. 9.en.wikipedia.org/wiki/Personal_Information_Protection_Commission_(South_Korea)