South Korea PIPA

Korea PIPA Article 34 personal information breach notification regime. Notification to data subjects without delay (typically interpreted as 72 hours per PIPC guidance) + categories + cause + countermeasures + contact + complaint avenues. PIPC notification within 72 hours for breaches affecting 1000+ data subjects + sensitive information + unique identifiers + high-risk. Article 34-2 (legacy public sector breach reporting + measures). Article 39 compensation for harm + Article 39-2 statutory damages up to 3M Korean won without proof of harm (consumer-friendly enforcement mechanism). Article 39-3 mandatory minimum insurance coverage OR reserves for controllers above certain thresholds processing sensitive or unique identifier information at scale (Korea-unique financial-resilience requirement). Article 39-4 punitive damages multiplier (added 2023) up to 5x for willful violations causing s

• Article 34 data subject notification records (72 hour)
• PIPC breach report submissions (1000+ subjects)
• Article 39-3 insurance policy or reserves evidence
• Article 39-4 punitive damages exposure analysis
• Cyber incident response playbook
• KrCERT and CC coordination records

• Late notification
• Missing insurance coverage
• No Article 39-3 reserves documentation
• Inadequate IR playbook
• No KrCERT and CC liaison

Korea PIPA Articles 28 + 31 + 33 governance regime. Article 28 obligations of personal information handlers including security measures + training + supervision of processors. Article 31 mandatory designation of Chief Privacy Officer (CPO equivalent of DPO) for all controllers + minimum qualifications + independence + reporting + role obligations. CPO has direct reporting to CEO + executive officer designation requirement for large processors after 2023 amendment. Article 32 registration with PIPC (largely repealed 2023 amendment for private sector). Article 32-2 Personal Information Protection Certification (ISMS-P - Information Security and Privacy Management System integrated certification + voluntary but standard market signal). Article 33 mandatory Personal Information Impact Assessment (PIA) for public agencies processing certain high-risk personal information categories (RRN + bio

• CPO designation records and reporting line
• Article 33 PIA reports (public agencies)
• ISMS-P certification certificate
• Article 26 processor outsourcing contracts
• Annual training records (PIPC syllabus)
• Article 33-2 AI PIA records

• CPO without reporting to CEO
• No PIA for high-risk processing
• Outsourcing without Article 26 contract
• Annual training not delivered
• No Article 33-2 AI PIA

Korea PIPA Articles 28-8 + 28-9 cross-border transfer regime (substantially overhauled 2023 amendment). Article 28-8 cross-border transfer of personal information requires one of: (1) data subject separate consent + specified destination + safeguards; (2) law or treaty; (3) PIPC certification of recipient or recipient jurisdiction (similar to GDPR adequacy decisions); (4) PIPC-approved Standard Contractual Clauses (similar to GDPR SCCs) + Binding Corporate Rules equivalents; (5) ISMS-P certification of recipient. Article 28-9 PIPC suspension order against ongoing cross-border transfers found to risk Korean data subjects (jurisdictional protective measure). EU adequacy decision granted 17 December 2021 for personal information protection under PIPA - first East Asian country with EU adequacy + 4-year review (renewed 2025) + paired CBPR Cross-Border Privacy Rules (APEC + Global). Korea-Jap

• Cross-border transfer inventory
• Article 28-8 lawful-basis documentation per transfer
• Separate consent records for cross-border
• PIPC-approved SCC executed copies
• ISMS-P certification of recipients
• EU adequacy reliance memo
• Article 28-9 suspension-order response procedure

• Cross-border without separate consent
• Old SCCs not refreshed to PIPC-approved version
• Reliance on adequacy without renewal review
• No suspension-order response plan

Korea PIPA Articles 35-37 + 37-2 data subject rights regime. Article 35 right of access (controller information + processing purposes + categories + retention + recipients + rights). Article 36 right to correction + deletion (with mandatory carrier verification for inaccurate data). Article 37 right to suspension of processing. Article 35-2 right to portability (Transmission Request) added 2023 amendment - data subject may request electronic transmission to themselves or another designated controller (broader than GDPR portability). Article 37-2 rights concerning automated decisions (added 2023 amendment) - right to explanation + opt-out of fully automated decisions producing legal or significant effects + analogue to GDPR Article 22. Article 38 method of exercise (free + written + electronic + reasonable timeframe). Article 39 compensation for damages including statutory damages without

• Rights request handling SLAs and logs
• Article 35 access response templates
• Article 35-2 transmission request records
• Article 37-2 automated-decision explanation programme
• Article 39 damages claim register
• Identity verification policy

• No specific handling for Article 35-2 portability and transmission
• Missing Article 37-2 automated-decision opt-out
• Article 39 statutory damages not tracked
• Identity verification mishandled

Korea PIPA Articles 15-22 lawful basis for collection + use of personal information. Article 15 consent + statute + Article 16 minimum collection + Article 17 provision to third parties + Article 18 use beyond original purpose + Article 19 restriction on provision by recipient + Article 20 collection from third party + notification + Article 20-2 notification of use records + Article 21 destruction + Article 22 methods of consent (specific + informed + free + unambiguous + withdrawable). Article 22-2 children under 14 verifiable parental consent. Direct marketing opt-in consent required. Notice to data subject covering categories + purposes + retention + third party recipients + rights. Privacy policy publication mandatory Article 30. Article 30-2 PIPC privacy policy evaluation programme.

• Privacy notices (Korean and English)
• Consent records (granular and withdrawable)
• Direct marketing opt-in evidence
• Privacy policy publications
• Children under 14 verifiable parental consent records
• Article 20-2 use records notifications

• Bundled consent without granularity
• No separate consent for direct marketing
• Missing children verification mechanism
• Privacy notice not in Korean
• No Article 20-2 notification programme

Korea PIPA Articles 28-2 + 28-3 pseudonymisation regime (added 2020 amendment - one of Korea most innovative provisions). Article 28-2 pseudonymised information processing for statistical + scientific research + public interest purposes without consent (subject to safeguards). Article 28-3 controlled combining of pseudonymised information from different controllers via PIPC-designated specialised institutions. Article 28-4 prohibition on re-identification. Article 28-5 designation of expert combining agencies + technical + organisational safeguards. Articles 63-64 PIPC investigation + inspection powers + access to premises + records + data. Article 63 PIPC investigation including on-site + documentation + interviews + production orders. Article 64-2 administrative fines (surcharges) up to 3 percent of preceding-year turnover related to violation (raised from 1 percent in 2023 amendment -

• Article 28-2 pseudonymisation method documentation
• Article 28-3 combining-institution designation records
• Article 28-4 re-identification controls
• Article 63 PIPC investigation response plan
• Article 64-2 3 percent surcharge exposure calculation
• Article 70-72 criminal-risk register

• Pseudonymisation without technical assurance
• No re-identification controls
• Insufficient surcharge exposure analysis
• No criminal-risk register

Korea Personal Information Protection Act (PIPA) Act No. 10465 of 29 March 2011 + effective 30 September 2011 + comprehensive 2020 amendment (effective 5 August 2020) + 2023 amendment (effective 15 March 2024). Universal application to all controllers + processors (public + private) processing personal information of individuals in Korea + extraterritorial application to overseas processing affecting Korean data subjects. Personal Information Protection Commission (PIPC) established 2020 as independent central regulator (was previously MOIS subordinate). Korea Internet Security Agency (KISA) coordination + KISA Privacy Help Centre. Article 1 purpose + Article 2 definitions (personal information + processing + data subject + controller + processor + sensitive information + unique identification information + pseudonymised information). Article 3 8 principles. Article 4 data subject rights

• Personal data inventory and flow maps
• Applicability assessment
• PIPA scope memo
• PIPC engagement records
• Legal opinion on extraterritorial application
• Privacy programme charter

• Failure to identify all controllers and processors
• Missing extraterritorial scope analysis
• No PIPA-specific compliance programme
• Treating PIPA same as GDPR without Korea-specific provisions

Korea PIPA Articles 23-25 special categories + unique identifiers. Article 23 sensitive information (ideology + belief + trade union + political affiliation + health + sexual orientation + biometric + genetic + criminal record) requires separate explicit consent or law. Article 24 unique identification information regulation. Article 24-2 strict restriction on processing of Resident Registration Numbers (RRN i-Pin alternative) - the Korea-unique 13-digit citizen identifier - prohibited except as expressly permitted by law + consent + emergency. Article 25 Closed Circuit Television (CCTV) image information processing devices in publicly accessible places (signage + designated operator + retention limits + restricted purposes). Article 25-2 Mobile Visual Data Processing Devices (added 2023 amendment) regulating drones + body-worn cameras + smart glasses + dashcams.

• Sensitive data inventory
• Resident Registration Number alternative-method records
• CCTV deployment register and signage photos
• Article 24-2 RRN legal basis documentation
• Mobile image device (drone and body cam) policy
• Sensitive consent records

• Processing RRN without explicit legal authority
• No CCTV signage at all deployments
• Missing Article 25-2 mobile device policy
• Sensitive consent not separately captured