The Korean Personal Information Protection Act: An Overview

The Republic of Korea (Korea) has enacted and implemented the Personal Information Protection Act (PIPA) as the principal statute governing the processing of personal information across both the public and private sectors. This Chapter is intended for a global audience and provides an overview of the structure, key concepts, and core regulatory issues under PIPA that are of practical significance. Specifically, after introducing the basic regulatory framework of PIPA, it examines the definition and types of personal information regulated by PIPA. It then reviews the general obligations of data handlers, including specific duties regarding the collection and use of personal information, provision to third parties, and outsourced processing, as well as additional obligations when processing special categories of personal information, the duty to destroy personal information, the duty to implement security measures, obligations in the event of a data breach, the duty to designate a chief privacy officer, and the duty to disclose a privacy policy. Furthermore, it analyzes the main regulatory changes brought about by recent amendments to PIPA, including special provisions on the processing of pseudonymized information, the expansion of legal bases for cross-border transfers of personal information, and the addition of rights of data subjects. Finally, it addresses the extraterritorial application of PIPA and issues relating to the designation of domestic agents, which are important points of consideration for overseas businesses processing the personal information of individuals in Korean.