Korea PIPA
Personal Information Protection Act (South Korea) — PIPC (Personal Information Protection Commission, South Korea)
Also known as: PIPA, Korea PIPA, Korean Personal Information Protection Act, PIPC
Official site Official change log Subscribe to Korea PIPA (RSS)
At a glance
- Current version
- Personal Information Protection Act (Act No. 21445, in force 11 September 2026)
- Published 11 September 2026. source
- Status
- In force
- Who must comply
- Personal information controllers: public institutions, corporations, organisations and individuals that process personal information to operate personal information files for their work. source
- How it is assessed
- Controllers notify data subjects and report leaks to the PIPC without delay; from July 2027 controllers meeting set criteria must hold protection certification. source
- Authority
- An Act of the National Assembly enforced by the Personal Information Protection Commission (PIPC), which orders corrective measures and imposes penalty surcharges. source
- Enforced by
- The PIPC imposes penalty surcharges of up to 3% of total turnover, or up to 10% for aggravated cases, alongside administrative fines and criminal penalties. source
- Last change
South Korea's data protection law, one of the strictest in Asia: consent-based by default, with breach notification, a data protection officer, restrictions on overseas transfer and turnover-based fines. It gives rights over automated decisions and is a single act enforced by the Commission rather than a set of sectoral rules.
Recent changes
-
Medium
Enforcement of amendment No. 137 to the PIPC's Regulatory Operations Rules
Amendment No. 137 to the Personal Information Protection Commission's Regulatory Operations Rules (훈령 개인정보보호위원회 규제업무 운영규정) has been enforced effective October 22, 2026. Specific details of …
-
Low
PIPC publishes disciplinary recommendation standards for personal data protection law violations
The Personal Information Protection Commission (PIPC) issued new disciplinary recommendation standards for violations of personal data protection regulations, effective September 11, 2026. These standards establish criteria …
-
Low
PIPC publishes guidelines for reporting Personal Information Protection Act violations
The Personal Information Protection Commission (PIPC) has published official guidelines establishing standards for reporting violations of personal information protection laws. These guidelines define the criteria and …
-
Low
PIPC announces revised administrative fine guidelines for PIPA violations
The Personal Information Protection Commission (PIPC) has issued revised administrative fine assessment guidelines under Notice No. 2026-14, effective September 11, 2026. These guidelines establish updated criteria …
-
Medium
Personal Information Protection Commission adopts rules on investigation and disposition procedures
The Personal Information Protection Commission (PIPC) of South Korea has adopted Notice No. 2026-13 establishing formal rules governing the Commission's investigation and disposition procedures. The rules, …
-
Low
PIPC publishes amended administrative rules on penalty assessment for Personal Information Protection Act…
The Personal Information Protection Commission (PIPC) has published amended administrative rules establishing criteria for imposing administrative fines on entities that violate the Personal Information Protection Act. …
-
Low
개인정보 보호책임자 지정 및 경력 인정 요건 명시
개인정보보호위원회가 개인정보 보호책임자 지정 및 경력 인정에 관한 고시를 시행했다. 이 고시는 보호책임자의 지정 요건과 경력 인정 기준을 명확히 규정한다. 기관의 개인정보 보호 체계 강화와 책임자의 …
-
Low
개인정보 보호법 위반 공표 및 공표명령 지침 발효
PIPC가 개인정보 보호법 위반 사항에 대한 공표 및 공표명령 지침을 발효했다. 이 지침은 개인정보 보호법 위반 행위에 대한 공표 및 공표명령 절차를 규정한다. 해당 기관과 조직들은 …
-
Low
개인정보 처리 방법에 관한 고시 제2026-10호 시행
개인정보보호위원회가 개인정보 처리 방법에 관한 고시 제2026-10호를 시행했다. 이 고시는 개인정보 처리자들이 준수해야 할 처리 방법 및 절차에 대한 규정을 정하고 있다. 개인정보를 처리하는 모든 조직은 …
That is the last 90 days. Sign in to read further back.
Key dates
Add these dates to your calendar- in 120 days AI development special rules (Act No. 21910) take effect
- in 234 days Mandatory personal information protection certification applies to controllers meeting the Presidential Decree criteria
- Amendment Act No. 21445 takes effect: wider breach notification and aggravated surcharges of up to 10% of turnover
- Amendment Act No. 21910 on personal information use for AI development is promulgated
- Domestic representative amendments (Act No. 20897) take effect
- The 2023 PIPA overhaul (Act No. 19234) takes effect
Amendments
-
Personal Information Protection Act (Act No. 21445, in force 11 September 2026) AmendmentCurrent text
The amendment of 10 March 2026 took effect, widening breach notification and adding an aggravated penalty surcharge of up to 10% of total turnover. source
More
- Controllers must also notify data subjects when they learn of a possible leak of a kind set by Presidential Decree, not only a confirmed one (Article 34(2)).
- The PIPC can impose up to 10% of total turnover for repeat intentional or grossly negligent violations within three years, such violations affecting 10 million or more data subjects, or a leak after ignoring a corrective order (Article 64-2(2)).
- Controllers meeting criteria set by Presidential Decree must obtain personal information protection certification from 1 July 2027 (Article 32-2(1) proviso).
-
Act No. 21910 (promulgated 8 September 2026) Amendment
Adds special rules allowing lawfully collected personal information to be used for AI development with PIPC review; it takes effect on 9 March 2027. source
More
- Use beyond the original purpose requires that anonymised or pseudonymised data would not work, safeguards set by Presidential Decree, a purpose such as the public interest, and a PIPC deliberation and resolution (Article 28-12).
- The PIPC supervises compliance periodically and must restrict processing if the conditions are not met (Articles 28-13 and 28-14).
-
Act No. 20897 (in force 2 October 2025) Amendment
A controller with a Korean subsidiary or controlled Korean company must appoint its domestic representative from that company and supervise the representative (Article 31-2). source
-
Act No. 19234 (in force 15 September 2023) Amendment
The 2023 overhaul took effect; some provisions, including the rights on automated decisions (Article 37-2), took effect one year after promulgation on 14 March 2023. source
More
- Chapter 6, the special rules for information and communications service providers, was deleted.
- The overseas transfer rules were rewritten as Articles 28-8 to 28-11.
-
Act No. 16930 (in force 5 August 2020) Amendment
The 2020 amendment introducing pseudonymised information (Articles 28-2 to 28-7) took effect. source
Show 1 older amendment
-
Act No. 10465 (in force 30 September 2011) Major version
The original Act took effect six months after promulgation on 29 March 2011, repealing the Act on the Protection of Personal Information Maintained by Public Institutions. source
Who it applies to
PIPA applies to public and private personal information controllers alike, and foreign controllers above Presidential Decree thresholds must appoint a domestic representative.
- Controllers
- A personal information controller is any public institution, corporation, organisation or individual that processes personal information, directly or through others, to operate personal information files for its work (Article 2(5)). source
- Domestic representative
- Controllers without an address or office in Korea that meet turnover or data volume criteria set by Presidential Decree must designate a domestic representative in writing (Article 31-2). source
- Overseas transfers
- Personal information may be transferred abroad only on a listed ground, such as separate consent, certification of the recipient or a PIPC finding of equivalent protection (Article 28-8). source
How compliance is assessed
Controllers notify data subjects and report leaks to the PIPC without delay; from July 2027 controllers meeting set criteria must hold protection certification.
- Breach notification
- On learning of a leak, the controller must notify the affected data subjects without delay and report to the PIPC or a designated specialised agency (Article 34(1) and (4)). source
- Certification
- The PIPC certifies controllers' protection measures; certificates are valid for three years with follow-up at least once a year, and certification becomes mandatory for controllers meeting criteria set by Presidential Decree from 1 July 2027 (Article 32-2). source
Enforcement and penalties
The PIPC imposes penalty surcharges of up to 3% of total turnover, or up to 10% for aggravated cases, alongside administrative fines and criminal penalties.
Up to 10% of total turnover
Article 64-2(2), for repeat intentional or grossly negligent violations within three years, such violations affecting 10 million or more data subjects, or a leak after ignoring a corrective order; up to ₩5 billion where turnover cannot be determined. source
Up to 3% of total turnover
Article 64-2(1), for violations such as unlawful processing, unlawful overseas transfer or a leak without the required safety measures; up to ₩2 billion where turnover cannot be determined. source
Up to 10 years or ₩100 million
Article 70, for example for obtaining personal information by fraud and providing it to third parties for profit. source
Administrative fine up to ₩50 million
Article 75(1). source
- Turnover base
- Surcharges are calculated on total turnover excluding turnover unrelated to the violation (Article 64-2(3)). source
Documents
Frequently asked questions
What is the maximum PIPA fine in South Korea?
Since 11 September 2026, up to 10% of total turnover for aggravated cases such as repeat intentional violations or violations affecting 10 million or more people, and otherwise up to 3% (Article 64-2). source
When does Korea's PIPA amendment on AI development take effect?
Act No. 21910, promulgated on 8 September 2026, takes effect on 9 March 2027. source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Korea PIPA (RSS)