This site is written in Korean. Where a topic regularly comes up with headquarters legal teams, global DPOs or deal teams outside Korea, the article carries an English summary at the end. This page collects those summaries, together with a small number of self-contained English notes.
A note on what these are. They are not translations of the Korean articles — they are shorter notes written separately for a reader who needs the Korean position but does not read Korean. Statutory references follow the Ministry of Government Legislation's English translation of the Personal Information Protection Act ("PIPA") where one exists. All English translations of Korean statutes are unofficial and carry no legal effect; the Korean text governs.
About the author — Hyunsub Lee, a Korean-qualified lawyer and partner at SEUM Law in Seoul, and what this site is.
Enforcement
Korea PIPC Enforcement Tracker — every published decision, searchable in English The whole published record of Korean privacy enforcement in one filterable table: respondent, date, provisions breached, sanction and amount, with English labels for provisions, sanction types and committee bodies. The Commission's own board is searchable by title only, and almost every sanction decision carries the same title, so a company name or an article number returns nothing there. Administrative fines are the norm and surcharges the exception, and the safety-measures duty in art. 29 accounts for about half of the record. Same underlying rows as the Korean tracker.
Korea data breach damages: what the courts have awarded per person, case by case Civil damages judgments tabulated by incident: the per-person amount, the judgments at each level and whether the result is final, with the reasons claims were upheld or dismissed. Same rows as the Korean table, with English text over them.
Reporting what CCTV footage shows is "use" of personal information — Supreme Court 2023Do18539 What the Supreme Court decided when CCTV footage was viewed and its content reported for a disciplinary matter, what it left to the remand court, and what a company can check in order.
A shared group system was breached and the affiliates that outsourced to it were sanctioned too — seven PIPC decisions How the Commission treated outsourcing between affiliates: each entrusting affiliate as a separate respondent under art. 26, and why only three of the six received a surcharge.
How Korean privacy fines are calculated — a surcharge calculator and the fine table A surcharge under PIPA art. 64-2 starts from relevant turnover — total turnover less the turnover unrelated to the violation — multiplied by a base rate set by the seriousness grade, and is then adjusted, capped and rounded. The calculator applies that formula to the figures you enter, in your browser, and shows the four grades side by side because the grade is the Commission's to decide. The page also carries the base rates, the grounds for increase and reduction, and the administrative fine amounts that come up most often for a foreign operator.
The PIPC's Temu decision — five arguments, the Commission's answers, and the 30% uplift for leaving China-based affiliates out A close reading of Decision No. 2024-013-193 (Whaleco Technology Limited, 14 May 2025): how each of the respondent's arguments was answered, why an incomplete submission was treated as obstruction, and how the surcharge was built up step by step.
DeepSeek before the PIPC (2025) — prompt transfers and training on user input The Commission's 2025 prior inspection of DeepSeek ended in recommendations, not a sanction. The note sets out, issue by issue, how the Commission answered DeepSeek's arguments on the Korean privacy policy, prompt transfers, training on user input and security.
The PIPC's AliExpress decision (2024) — why a sign-up checkbox was not consent to overseas transfer A close reading of Decision No. 2024-013-192 (Alibaba.com Singapore E-Commerce Private Limited, 24 July 2024): the consent and disclosure findings under art. 28-8, the domestic representative and account-deletion findings, and how the KRW 1.978 billion surcharge was built up. The decision redacts the respondent's name; the Commission's press release identifies it.
A letter from Korea's PIPC has reached your Korean subsidiary How to tell a request for materials under article 63(1) from a prior notice of a proposed sanction and from a pre-inspection under article 63-2, how long investigations have taken in the published decisions, how many days a prior notice allows for comments, and why the figures in the first reply are likely to be compared with what the company says later.
A location-data monitoring letter from Korea has reached your app company What the 2026 monitoring letter sent on behalf of KISA asks for, how the reply deadline and an extension request work, how to tell whether the Location Information Act requires registration, a report or nothing, and what a foreign company files in its own name.
What takes effect when
Korean privacy and IT law: what takes effect when Korean statutes come into force in stages, and the stage that matters is rarely the one the headlines covered. A dated calendar for the coming twelve months, with the three stages of the Personal Information Protection Act amendment — 11 September 2026, the AI training exception on 9 March 2027, and mandatory certification on 1 July 2027 — set out separately.
Cross-border transfers
We signed the group DPA. What does Korean law separately require the transfer contract to contain? PIPA separates two layers that a global DPA usually merges: the legal basis for an outbound transfer under Article 28-8(1), and the terms Korean law separately requires the contract to contain. Signing the group-wide agreement completes only one of them.
Our headquarters is certified. Is that a transfer ground under Korean law? The list has one entry Article 28-8(1)(iv) recognises a certification-based ground, but the certification must be one the Personal Information Protection Commission has designated and published, and the entity that must hold it is the recipient. As of 5 October 2026 the designated list has one entry, ISMS-P; ISO/IEC 27701, Binding Corporate Rules and CBPR certifications are not on it. The note sets out the text of the list, how a scheme gets onto it and which grounds are used instead.
Erasure requests do not follow the data abroad Article 28-8(4) keeps the transferring Korean entity bound by Chapter 5 after the data has left. When a request concerns records held on headquarters systems, the obligation and the statutory clock still sit with the Korean entity.
Vendors and processing arrangements
Your group DPA calls us a processor. Korean law has no such slot Korean law does not divide the world into controllers and processors. Entrustment under article 26 and provision to a third party under article 17 carry different duties and different cross-border bases, and the label in the group DPA does not decide which applies. Where liability sits while the contract runs, why the direction reverses once it ends, and what the September 2026 amendment added for companies that only process on instruction.
Governance and global policy
Nine points where a global privacy programme breaks in Korea Several Korean requirements attach not to the content of a document but to who decides and what is published. Translating the programme does not address those.
Can our Korean subsidiary's CISO also be its CPO, and can headquarters' regional DPO hold the Korean CPO role? PIPA does not bar the chief privacy officer from holding another post, and for companies under the Network Act's CISO restriction the CPO role is one of the permitted ones. Who may be designated is a narrower question: the Enforcement Decree limits it to the business owner or representative or an officer, which a regional DPO employed by headquarters is unlikely to be. What the 11 September 2026 amendment added for larger controllers: a board resolution, a filing with the Commission and a reporting line.
Can we publish a Korean translation of our global privacy notice? The Korean privacy policy is a statutory document with items set by PIPA art. 30(1) and the Enforcement Decree, and it has to match what the Korean entity actually does. When a translation of the global notice can serve, when it needs supplementing, and when a separate Korean document is the safer course.
Our headquarters processes on legitimate interest. Can the Korean entity use the same basis, and for which purposes? PIPA art. 15(1)(6) permits processing necessary for the controller's legitimate interests, but only where those interests manifestly override the data subject's rights. A GDPR lawful-basis mapping does not transfer one-for-one.
Which English text of PIPA to cite — and which to avoid Since 11 September 2026 the Act in force is Act No. 21445. As checked on 25 October 2026, both the English translation on the National Law Information Center (law.go.kr) and the most recent record on the Korea Legislation Research Institute's site reflect that version; older records of the same Act remain on the Institute's site with no indication of which is current. An English copy hosted elsewhere, which ranks highly in search results, is the 2020 version and omits provisions your team may be looking for.
Korea's PIPA: 2027 changes and the AI exception (unofficial translation) Act No. 21910, the AI development exception from 9 March 2027, which neither the law.go.kr translation nor the Korea Legislation Research Institute's translation yet includes, and every other article changed after Act No. 20897, including both stages of Act No. 21445, so the changes can be read in one place. Also the articles and Attached Tables of the Enforcement Decree that changed after Presidential Decree No. 35343, up to Presidential Decree No. 36671. For the text in force, consult the law.go.kr translation first. Row by row, Korean beside English, with a status line showing whether a later amendment has appeared. Unofficial and without legal effect; the Korean text governs.
Appointing a domestic representative — full note Who must appoint one, the Enforcement Decree thresholds, and why a law firm can no longer hold the role for a group with a Korean subsidiary. The re-designation deadline passed on 1 April 2026, and the representative's statutory remit widened on 11 September 2026. Unlike the other entries on this page, this one is a self-contained English note rather than a summary appended to a Korean article; the Korean article is here, and the short summary at the end of it remains in place.
Acquisitions
We are acquiring a Korean company. Does customer data need notice or fresh consent at due diligence, and again at closing? Korean law treats two moments separately: disclosure of customer records to a prospective buyer during due diligence, and the move of the data at a business transfer or merger under article 27. A share purchase usually leaves the data where it is. What each stage requires, what the published decisions have sanctioned, and a checklist by stage.
Breach and incident response
Korea breach notification: the 72-hour clock, who to tell, and what late costs Two separate 72-hour clocks — one to the data subjects, one to the Commission or KISA — plus a third that starts on suspicion alone since 11 September 2026. The deadlines, the reporting triggers, the six items a notice must carry, and what the published decisions show about how late "late" has actually been.
Notification in Korea is not risk-based A headquarters playbook built on GDPR puts a risk assessment at the first decision point. PIPA Article 34(1) does not — notification is triggered by awareness, not by a risk threshold. The two procedures diverge at the first step.
Artificial intelligence
Korea's AI Framework Act: who it catches, and what actually happens if you ignore it The Act reaches companies that merely use AI to provide a service, not only those that build it — and it carries no surcharge at all, only an administrative fine of up to 30 million won, available for three violations. How the duties split into three enforcement tiers, why two of the most demanding ones have no enforcement route, and when a foreign company needs a domestic representative.
Bias testing with sensitive data — the EU exception has no Korean counterpart Article 10(5) of the EU AI Act permits processing special categories of data to detect and correct bias. PIPA Article 23(1) has no equivalent exception, so a headquarters bias-testing procedure may not be lawful in Korea as written.
Our headquarters' system made the decision. Who has to answer a Korean user who refuses it, and by when? A Korean subsidiary that transferred the data remains the obligated party for refusal and explanation requests about a decision made by a headquarters system, and the response period runs in Korea.
Data portability
The 20 August 2026 date means opposite things depending on which side you are on Reporting described the right as extending "to all industries" from that date. That collapses two different positions — most private companies do not become recipients of transmission requests until 20 February 2027, while agents retrieving data through automated tools are affected immediately.
Transactions and diligence
Privacy diligence: the two violations that leave no trace Incident-type violations have a date and an external record a buyer can find. State-type violations — retention past the destruction deadline, a missing transfer basis — produce none, so they have to be requested. This note lists what to ask for.
About
These notes are written by Hyunsub Lee, a partner at SEUM Law in Seoul (firm profile — the page opens in Korean; use the ENG switch at the top right for the English version). Principal practice areas are IT, personal information and data, and startup advisory.
They are general information on Korean law and are not legal advice; conclusions depend on the facts of each case. Where an entry is a summary, the link leads to the Korean article it is drawn from; the self-contained notes and the data table stand on their own.
The Korean material. Most of this site is written in Korean — around eighty articles and a set of guides, with the data tables that sit under them. The article index and the guides are in Korean; the pages listed above are the ones that can be read in English.
If one of these notes describes a problem your company has, the contact page sets out what I work on, what happens after you write, and how long a reply takes. I aim to reply within one business day, Korea time; replies can take longer.