Before you read
This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.
South Korea
Sources last checked:
South Korea’s Personal Information Protection Act, the PIPA, is enforced by the Personal Information Protection Commission.1
Source note: the English text available is an unofficial reference translation from 2023, so the sections below may not include the latest changes.
Using data
An organisation may collect and use personal information in listed cases, the first being the person’s consent.2
Your rights
You can request access to your data,3 have it corrected or erased,4 and have its processing suspended.5 You have rights over decisions made by a completely automated system.6 You can claim damages if you are harmed.7
When data leaks
An organisation must notify the people affected without delay when it learns of a loss, theft or leak.8
Sending data abroad
Transfers are allowed only in the cases the law lists.9
Fines
The baseline penalty is up to 3% of total sales.10 A 2026 change allows up to 10% of total sales for intentional or grossly negligent repeat violations within three years, damage to 10 million people or more, or a leak after failing to follow a corrective order. It took effect on 11 September 2026.11
Source note: the 2026 change rests on government news and Commission notices as returned by a search. The amended law itself was not read.