South Korea

The Personal Information Protection Act does not say in words that it applies to companies outside Korea. The Commission applies it anyway to overseas companies that use data about people in Korea. The rule on appointing a Korean representative (Article 31-2) assumes foreign companies are covered. The Network Act is explicit. It applies to acts done outside Korea that affect the Korean market or Korean users. The Enforcement Decree sets two size tests. Total revenue of 1 trillion won. Or a daily average of 1 million people in Korea over the last three months of the previous year. There is also a third route. The Commission can decide that a company it has asked for documents needs a representative. An amendment of 1 April 2025 took effect on 2 October 2025. If you have set up a Korean company, or you control one, that company must be your representative. You control a company if you appoint its chief executive. You also control it if you appoint half or more of its directors, or hold 30 percent or more of its shares. Companies that already had a representative had six months to re-appoint, so until 2 April 2026. You must train your representative at least once a year. You must also check that it is doing its job. Getting the appointment or the supervision wrong costs up to 20 million won (about $14,000). Leaving the representative's details out of your privacy policy costs up to 10 million won (about $7,200).

The starting point is a ban. You must not send personal data out of Korea, let anyone abroad view it, hand it to a supplier abroad, or store it abroad. Five things let you do it anyway. One: the person gives a separate consent for the transfer. Two: a Korean law or a treaty allows it. Three: you need to send or store the data abroad to sign or carry out a contract with that person. For this one you must either put the details in your privacy policy or tell the person by email or a similar route. Four: the recipient holds a certification that the Commission has designated, and has put the promised protections and rights in place in the destination country. Five: the Commission has recognised the destination country or international body as giving protection close to Korea's. Route five has been used once, in September 2025, for the European Union and the European Economic Area. That is 30 countries. Route four exists on paper. We found no evidence that any certification has been granted for it. If your recipient passes the data on to a third country, the same rules apply again. Six industries override all of this, each with its own rating. BANKING AND PAYMENTS: closed. A financial company or electronic payment business with its head office in Korea must keep its computer room and its disaster recovery centre in Korea. If it uses national ID numbers or personal credit information on a cloud service, that system must be in Korea too. Individual customers' national ID numbers may not go abroad at all. HEALTH: closed. Electronic medical record systems and their backup equipment must sit inside Korea. GOVERNMENT AND PUBLIC SECTOR: closed. The cloud systems, the backups, the data and the staff who manage and run them must all be in Korea. MAPPING AND GEOSPATIAL: decided case by case, and closed by default. Nobody may take basic survey results, maps or survey photographs out of Korea without the Minister's permission. Security-sensitive results need a decision from a committee of several agencies, including the intelligence service and the defence ministry. LOCATION SERVICES: allowed with conditions, and you need a Korean company. A business handling personal location data must be a corporation and must register with the media and communications regulator. TELECOMS AND ADVANCED TECHNOLOGY: allowed with conditions, but the government holds an unused power. It can order measures to stop nationally important security and advanced technology information leaving Korea over networks. We found no evidence it has ever done so.

The model is a ban with exceptions. Korea does not keep a list of banned countries. It does not limit you to a list of approved ones either. It does keep one positive list, recognised in September 2025: the European Union and the European Economic Area. Being on that list removes the paperwork. It is not something you need before you send data. For every transfer under the exceptions, the Enforcement Decree requires three things. Security measures. A route for complaints and for settling disputes. And prior agreement with the recipient, written into your contract. The Decree also sets out what a country must show before Korea recognises it. Sound protection principles. An independent regulator. Lawful government access to data. Real redress for people. And a willingness to work with the Commission. An expert committee on cross-border transfers must assess the country. A policy council must be consulted. Only then can the Commission recognise it. The Commission can attach limits to a recognition. It must keep watching the country afterwards. It can withdraw or change the recognition. Two powers over destinations sit unused. First, Korea can mirror another country's restrictions back onto that country's companies if that country restricts transfers to Korea. We found no evidence this has been applied. Second, the government can order measures to stop nationally important information leaving over networks. Again, we found no evidence of use.

Rating: aggressive. The evidence comes from the regulator's own July 2026 press releases. At its 22 July 2026 meeting it fined TikTok Pte. Ltd. 10.306 billion won. TikTok had collected behavioural data on 9.45 million active Korean users through its Pixel and software development kit tools. Those tools sat on about 71,000 Korean businesses. It had no valid legal basis, and it sent the data abroad in breach of the transfer rule. The same meeting fined Apple Distribution International and Apple Services Pte. Ltd. 252 million won over Siri voice recordings and transcripts. Apple's privacy policy did not properly explain the transfer to Apple Inc. in the United States. At its 29 July 2026 meeting it fined KT 53.979 billion won for failing its security duties. Hackers used cloned femtocells to intercept data on 16,647 subscribers. That led to about 240 million won of fraudulent small payments. The Commission ordered KT to fix the problems within three months. It recommended that the affected network get the national information security and privacy certification, known as ISMS-P. It also resolved to file a criminal complaint against KT for deleting logs and handing over false material during the investigation. The Commission runs a review service you can use before you launch something new. It runs a dispute mediation committee too. It is fully staffed and issuing decisions. By late July 2026 its full meetings for the year were numbered in the teens.

The ceiling. The Personal Information Protection Act tells you to destroy personal data without delay in three cases. The retention period has run out. You have done what you collected it for. Or the time allowed for using pseudonymised data has run out. The exception is where another law makes you keep it. Data kept under that exception must be stored and managed apart from your other personal data. Failing to destroy data costs up to 30 million won (about $22,000). The floors. The consumer protection rules for online selling set the record-keeping periods. Display and advertising records: 6 months. Contract and cancellation records: 5 years. Payment and delivery records: 5 years. Consumer complaints and disputes: 3 years. The access-log periods come from the Commission's safety standards, Notice No. 2026-9, in force 1 July 2026. Some industries must keep records longer. Financial and medical record-keeping runs longer, and the medical rules also fix where the records may sit.

You have 72 hours to tell the people affected. You can delay only in two cases. You need the time to contain the attack. Or a disaster makes it impossible. You have a separate 72 hours to report to the Commission or the Korea Internet and Security Agency. Three things start that clock. 1,000 or more people affected. A leak of sensitive data or national ID numbers. Or a leak caused by someone getting into your system, or into a staff device, without permission. If you do not yet know the cause or the size, file what you have. Add the rest as soon as you confirm it. The duty to report can fall away if you find the leak route and recover or delete the data, so the risk drops sharply. Third clock: an internet or communications service provider must report a break-in immediately. It goes to the Minister of Science and Information and Communications Technology, or to the Korea Internet and Security Agency. The exact timing is set by decree. A report already made under another law counts. Fourth clock, health only: a hospital must tell the Minister of Health and Welfare about a break-in involving treatment information. The overlap is where companies go wrong. One event usually starts the privacy clock and an industry clock at the same time. The KT case shows the cost of getting reporting wrong. The Commission filed a criminal complaint over deleted logs and false submissions.

1. The age line is 14. Using a younger child's data without the legal guardian's consent can bring up to 5 years in prison. It can also bring a fine of up to 50 million won (about $36,000). It can also bring the administrative fine of up to 3 percent of revenue. 2. It is a crime to refuse to hand over material, or to hand over false material, to hide a breach. It is also a crime to hide, destroy or fake material during an inspection. Either one costs up to 2 years in prison or 20 million won (about $14,000). The Commission filed a criminal complaint against KT on this basis in July 2026. It also asked police to investigate LG U+ for scrapping a server. 3. Pseudonymised data still counts as personal data when you send it abroad. The Commission itself flagged this in August 2026 as a barrier to international joint research. You need consent to send pseudonymised data abroad. But you can no longer tell who the people are, so you cannot ask them. 4. Under the Regulation on Outsourcing of Data Processing by Financial Companies, individual customers' unique government ID numbers must be encrypted. They must not be sent abroad. If your supplier is abroad, a report must reach the Governor of the Financial Supervisory Service 30 business days before that supplier starts work. 5. A personal location information business must be a corporation and must register with the regulator. The same law changed on 1 October 2025 to move that job to the renamed Broadcasting, Media and Communications Commission. 6. One more trap. The administrative fine starts from your total revenue, not from the revenue linked to the breach. Unrelated revenue is taken off afterwards. If you refuse to hand over your revenue figures, the Commission can estimate them.

Coming in the next 12 months: the Commission's plan for privacy in the age of artificial intelligence. It is promised for late 2026, with new law to follow. Already in force, and worth checking against what you are building: the Framework Act on Artificial Intelligence Development and Trust started on 22 January 2026. A foreign artificial intelligence business above the size limits set by decree must appoint a Korean representative. It must also tell the Minister of Science and Information and Communications Technology. A further set of amended rules took effect on 20 July 2026. Five unused powers matter more than any pending bill. First, the Commission can order you to stop sending data abroad, and you get only 7 days to object. We found no public record of it being used, so the first use will surprise people. Second, Korea can mirror another country's restrictions back onto that country's companies. Unused. Third, the government can order measures to stop nationally important security and advanced technology information leaving over networks. Unused. Fourth, the Commission can withdraw or change its recognition of Europe if it decides protection there has slipped. That would put 30 countries back into needing consent overnight. Fifth, the mapping committee kept the right to suspend or withdraw Google's export permission if Google keeps breaking the conditions or breaks them badly.