South Korea

The Personal Information Protection Act has no express extraterritoriality clause, but the Commission applies it to overseas controllers who process the data of people in Korea, and the domestic-representative rule in Article 31-2 assumes foreign controllers are in scope. The Network Act does have an express clause (Article 5-2: it applies to acts done outside Korea that affect the domestic market or users). Enforcement Decree Article 32-3 sets the two thresholds (1 trillion won total revenue; a daily average of 1 million domestic data subjects over the last three months of the previous year) plus a third catch-all where the Commission resolves that a company asked for documents needs a representative. The 1 April 2025 amendment (in force 2 October 2025) added Article 31-2(2) second sentence: where the controller has established a Korean corporation, or controls one (appoints the CEO or 50%+ of directors, or holds 30%+ of shares), the representative must be chosen from among those corporations. Controllers that already had a representative had six months from commencement, i.e. until 2 April 2026, to re-designate. The controller must also train the representative at least once a year and check that it is doing its job. Failure to designate correctly, or to supervise, carries an administrative fine of up to 20 million won (about $14,000); leaving the representative's details out of the privacy policy carries up to 10 million won (about $7,200).

Article 28-8 of the Personal Information Protection Act starts from a prohibition: a controller must not provide (including allowing to be viewed), outsource the processing of, or store personal data outside Korea. Five exceptions follow: (1) separate consent to the transfer; (2) a special provision in a statute or a treaty; (3) where outsourcing or storage is necessary to enter into or perform a contract with the person, provided the required details are either published in the privacy policy or notified by email or similar; (4) the recipient holds a certification designated by the Commission and has taken the protective and rights-guarantee measures needed to honour it in the destination country; (5) the Commission has recognised the destination country or international organisation as substantially equivalent. Route 5 has been used exactly once, in September 2025, for the European Union and the European Economic Area (30 countries). Route 4 is on the books but we found no evidence of a certification actually granted for this purpose. Onward transfers from the first recipient to a third country are caught by the same rules (Article 28-11). SECTOR OVERRIDES, each with its own rating: BANKING AND PAYMENTS - closed. A financial company or electronic financial business operator headquartered in Korea must site its computer room and its disaster recovery centre inside Korea, and if it processes unique identifying information or personal credit information through a cloud service the processing system must be in Korea. Individual customers' unique identifying information must not be transferred abroad at all. HEALTH - closed. Electronic medical record systems and their backup equipment must be physically located inside Korea. GOVERNMENT AND PUBLIC SECTOR - closed. Cloud systems, backup systems, the data, and the people who manage and operate them must all be physically in Korea. MAPPING AND GEOSPATIAL - case by case, effectively closed by default. Nobody may take basic survey results, maps or survey photographs out of Korea without a Minister's permission, and security-sensitive results need a decision by an inter-agency committee that includes the intelligence service and the defence ministry. LOCATION SERVICES - conditional plus a local-entity requirement. A business handling personal location data must be a corporation and must be registered with the media and communications regulator. TELECOMS AND ADVANCED TECHNOLOGY - conditional, dormant. The government holds a standing power to order measures stopping nationally important security and advanced technology information from flowing abroad over networks; we found no evidence of it being exercised.

Model: prohibition-with-grounds rather than blocklist or allowlist. There is no populated blocklist of banned destinations. There is one populated positive list under Article 28-8(1)5 (the EU and EEA, recognised September 2025), which removes the paperwork rather than being a precondition. Enforcement Decree Article 29-10 requires, for every transfer made under the exceptions, the security measures of Decree Article 30, a grievance-handling and dispute-resolution route, and prior agreement with the recipient reflected in the contract. Decree Article 29-9 sets the criteria for equivalence recognition (protection principles, an independent supervisor, lawful public-sector access, effective redress, ability to cooperate with the Commission) and requires evaluation by a cross-border transfer expert committee and consultation with a policy council before the Commission can recognise a country. The Commission may attach limits to a recognition, must monitor the country afterwards, and may revoke or vary it. Two destination-control powers sit dormant. Article 28-10 is a reciprocity clause: Korea may impose equivalent restrictions on controllers from countries that restrict transfers to Korea; we found no evidence of it being applied. Article 51 of the Network Act lets the government order measures to prevent nationally important information leaving via networks; again, no evidence of use found.

Rating: aggressive. Evidence, all from the regulator's own July 2026 press releases: 22 July 2026 plenary imposed 10.306 billion won on TikTok Pte. Ltd. for collecting third-party behavioural data from 9.45 million active Korean users via TikTok Pixel and SDK tools deployed at some 71,000 Korean businesses without a valid basis, and for transferring it abroad in breach of Article 28-8(1); and 252 million won on Apple Distribution International and Apple Services Pte. Ltd. over Siri voice recordings and transcripts and inadequate privacy-policy disclosure of the transfer to Apple Inc. in the United States. 29 July 2026 plenary imposed 53.979 billion won on KT for failing security duties after hackers used cloned femtocells to intercept data on 16,647 subscribers, leading to about 240 million won of fraudulent micropayments; the Commission also ordered corrective measures within three months, recommended ISMS-P certification of the affected network, and resolved to file a criminal complaint against KT for deleting logs and submitting false material during the investigation. The Commission also runs a pre-review service for novel processing and a dispute mediation committee. The Commission is unambiguously staffed and issuing decisions at plenary meetings numbered in the teens by late July 2026.

Ceiling: Personal Information Protection Act Article 21(1) requires destruction without delay once the retention period expires, the purpose is achieved, or pseudonymised-data processing time runs out, unless another statute requires preservation. Article 21(3) requires data kept under such an exception to be stored and managed separately from other personal data. Failure to destroy attracts an administrative fine of up to 30 million won (about $22,000) under Article 75(2)4. Floors: Enforcement Decree of the Act on Consumer Protection in Electronic Commerce Article 6(1) sets 6 months for display and advertising records, 5 years for contract and withdrawal-of-offer records, 5 years for payment and supply-of-goods records, and 3 years for consumer complaint or dispute records. Access-log floors come from the Commission's Standards for Securing the Safety of Personal Data, Notice No. 2026-9, Article 8(1), in force 1 July 2026. Sector floors add more: financial and medical record-keeping duties run longer, and the medical rules also fix where the records may sit.

Enforcement Decree Article 39(1) sets 72 hours for notice to data subjects, with a narrow deferral where urgent containment is needed or a disaster makes it impossible. Article 40(1) sets 72 hours for the report to the Commission or the Korea Internet and Security Agency, triggered by any of: 1,000 or more data subjects; leakage of sensitive data or unique identifying information; or leakage caused by unlawful external access to the processing system or to a device used by staff. Where the cause or scope is not yet known, you must file what you have and top it up as soon as more is confirmed. The reporting duty can fall away where the leak route is identified and the data recovered or deleted so the risk drops sharply. Third clock: Network Act Article 48-3(1) requires an information and communications service provider to report an intrusion incident to the Minister of Science and ICT or the Korea Internet and Security Agency immediately, with the timing set by decree; a report already made under another statute counts. Fourth clock, health only: Medical Service Act Enforcement Rule Article 16-2 requires notice to the Minister of Health and Welfare of a treatment-information intrusion incident. The overlap is the operational failure point, because the same event usually starts the privacy clock and a sector clock at once, and the KT case shows what happens if you get the reporting wrong: the Commission filed a criminal complaint over log deletion and false submissions.

1. Article 22-2 sets the threshold at under 14. Article 71(3) makes processing such a child's data without the legal guardian's consent punishable by up to 5 years' imprisonment or a fine of up to 50 million won (about $36,000), and Article 64-2(1)2 also exposes it to the 3-percent-of-revenue administrative fine. 2. Article 73(1)4 and (1)5 criminalise refusing to produce material or submitting false material to conceal a violation, and concealing, destroying or falsifying material during an inspection: up to 2 years' imprisonment or 20 million won (about $14,000). The Commission filed a criminal complaint against KT on this basis in July 2026 and asked police to investigate LG U+ for scrapping a server. 3. Pseudonymised data still counts as personal data for transfer purposes. The Commission itself flagged this in August 2026 as a barrier to international joint research: consent is required to send pseudonymised data abroad, and by definition you can no longer identify the people to ask them. 4. The Regulation on Outsourcing of Data Processing by Financial Companies, Article 5(1), requires individual customers' unique identifying information to be encrypted and specifically not to be transferred abroad; Article 7(1) requires a report to the Governor of the Financial Supervisory Service 30 business days before an overseas outsourcee actually starts work. 5. Location Information Act Article 5(1)1 requires a personal location information business to be a corporation and to be registered with the regulator; the same Act was amended with effect from 1 October 2025 to move that function to the renamed Broadcasting, Media and Communications Commission. 6. Bonus trap: the administrative fine is calculated on total revenue, not on revenue related to the breach, with unrelated revenue deducted afterwards; refuse to hand over revenue figures and the Commission may estimate them.

Landing in the next 12 months: the Commission's reform direction for the artificial intelligence era, promised for late 2026, with legislation to follow. Already landed and worth checking against your build: the Framework Act on Artificial Intelligence Development and Trust came into force on 22 January 2026, and Article 36 requires foreign artificial intelligence businesses above thresholds set by decree to appoint a Korean representative and notify the Minister of Science and ICT; a further set of amended provisions took effect on 20 July 2026. DORMANT SWITCHES, which matter more than pending bills. (a) Article 28-9 lets the Commission order a company to stop transferring data abroad, with only a 7-day window to object; we found no public record of it being used, so the first use will be a surprise. (b) Article 28-10 lets Korea mirror another country's restrictions back onto that country's companies; unused. (c) Article 51 of the Network Act lets the government order measures to stop nationally important security and advanced technology information leaving over networks; unused. (d) The Commission may revoke or vary the European equivalence recognition if it judges that protection there has slipped, which would put 30 countries back into consent territory overnight. (e) The mapping committee explicitly reserved the right to suspend or withdraw Google's export permission for continued or serious breach of conditions.