Key points. Under Korea's Personal Information Protection Act ("PIPA"), the obligation to deal with a Korean user's refusal of, or request for an explanation of, a fully automated decision stays with the Korean entity that transferred the personal data, even where the decision was made by a system that headquarters operates. Article 28-8(4) keeps the data subject rights chapter in force after a cross-border transfer, and article 38(1) counts requests under article 37-2 among the requests that chapter governs. The response period for these requests is 30 days, extendable twice by up to 30 days each (Enforcement Decree art. 44-3(5); PIPC Notice art. 8(1)). A refusal must be notified, with reasons and the objection route, within 10 days (Notice art. 8(2)). Where the decision rests on consent, a legal obligation or contract performance, the right to refuse does not apply, but the rights to an explanation and to a review remain. A failure to comply without a justifiable reason is an administrative fine matter, not a penalty surcharge matter.
Take a group that runs recruitment screening, fraud detection or account suspension from one global platform. The platform reaches an unfavourable decision about a user in Korea. The user writes to the Korean entity, says they refuse the decision, and asks that a person look at it again and that someone explain how it was reached.
The Korean team usually forwards the ticket to headquarters, because both the system and the data are there. That routing is reasonable as an internal matter. However, Korean law names the Korean entity as the party that has to answer, and it attaches deadlines that do not match the ones most group procedures are built around.
There is a second reason the provision is often missed. Article 37-2 was inserted into PIPA by the amendment of 14 March 2023, so an English text of the Act that predates that amendment does not contain it. Which English translations are current is set out on the PIPA translation page.
Why does the Korean entity answer for a decision made at headquarters?
Three provisions fit together. Article 28-8(4) requires a company that transfers personal data abroad to continue to comply with Chapter 5 of PIPA, which is the chapter on data subject rights. Article 37-2, the provision on automated decisions, is in Chapter 5. Article 38(1) then places refusal and explanation requests under article 37-2 in the same list as requests for access, correction or erasure, and suspension of processing.
The result is that the request is the Korean entity's to receive and to answer within the statutory period. Headquarters can do the analytical work, and in most groups it will have to, because it holds the system. The Korean entity, however, is the party whose deadline is running. The underlying structure, including the rules that apply after a transfer to other data subject requests, is explained in the Korean note on data subject rights after a cross-border transfer.
Is our system making an "automated decision" in the statutory sense?
The PIPC has issued a notice on the measures processors must take for automated decisions (issued and in force 26 September 2024; referred to here as "the Notice"). It tells processors to take into account six matters, together with the examples in its annex, when deciding whether a system is in scope (Notice art. 6 and Annex). The two questions at the centre are whether a person intervened in a substantive and meaningful way, and whether the system's output is the final decision affecting the user's rights or obligations.
The annex examples draw the line in practice:
- Recruitment. A rejection based on an automatically generated score that a person only formally confirmed is in scope. Where the person with hiring authority weighed other evaluation factors and made the final decision, it is outside.
- Recommendations. Personalised recommendations are outside, because the user decides whether to act on them.
- Fraud and account action. A system that analyses a record of misconduct and itself decides to terminate the contract or delete the account is in scope.
The way a group describes a system internally, for example as "decision support", does not settle the question. What the annex examples look at is what the person in the process actually did. For recruitment systems there is a separate gap in Korean law around bias testing, discussed in the Korean note on bias testing and sensitive data.
What changes when the decision is necessary to perform the contract?
GDPR and PIPA treat this situation differently, and the difference is easy to misread as a gap in Korean protection.
Under GDPR, Article 22(1) does not apply to a decision based on contract performance or explicit consent, but Article 22(3) then requires at least human intervention, the ability to express a view and the ability to contest the decision. PIPA takes the same situation, a decision based on consent, a legal obligation or contract performance (art. 15(1)(i), (ii) and (iv)), and removes the right to refuse altogether (proviso to art. 37-2(1)). Accordingly the user cannot ask for the two measures that refusal would trigger, which are not applying the decision and having a person re-process it (Enforcement Decree art. 44-3(1)).
Two rights remain. The right to request an explanation under article 37-2(2) has neither a significant-effect condition nor a proviso. The Enforcement Decree does, however, scale what the explanation must contain: where the decision does not significantly affect the user's rights or obligations, the company may answer with the general information it has already published about the system instead of an individual explanation (Enforcement Decree art. 44-3(2), proviso; Notice art. 4(3)). The user may also submit an opinion and ask the company to consider whether to reflect it (Enforcement Decree art. 44-2(2)(ii)). Article 5 of the Notice describes how that consideration can be done: by re-processing after personal data has been added or corrected, or by reconsidering the factors the system took into account.
The two regimes are therefore not opposites. They require human involvement at different points. A group procedure that offers human review on request for contract-based decisions has to be adapted for Korea, because that trigger does not exist there, and the procedure needs a route for explanation and review requests instead.
How long does the Korean entity have?
Requests that fall under article 38(1) do not all run on the same clock.
| Request | Period | Basis |
|---|---|---|
| Access, correction or erasure, suspension of processing | 10 days | Enforcement Decree arts. 41(4)–(5), 42(2), 43(3), 44(2) |
| Refusal, explanation or review concerning an automated decision | 30 days; may be extended up to twice, by up to 30 days each | Enforcement Decree art. 44-3(5); Notice art. 8(1) |
| Notice of refusal to act, with the reasons and the objection procedure | 10 days | Notice art. 8(2) |
The 30-day period is the time for acting on the request and notifying the result in writing or by a similar method. A company that decides not to act is on a shorter clock: unless there is a justifiable reason, it must tell the user within 10 days why it is declining and how the user can object. In practice this means the decision whether to decline has to be taken early, before the analysis that the 30 days would otherwise allow.
What does complying with a refusal involve, and when can a company decline?
Complying with a refusal means doing one of two things and notifying the result: not applying the decision, or having a person re-process it. Where the company has re-processed with human involvement and notified the outcome, the Notice does not additionally require it to suspend the decision (Notice art. 3(1)).
Whether a company has a justifiable reason to decline is assessed case by case, by weighing the disadvantage to the user against the interests of the company or a third party. The considerations the Notice lists include:
- not applying the decision would make it difficult to perform the contract, and the user has not clearly said that they want to terminate it;
- giving the explanation risks unfairly harming the company's property or other interests; and
- the same review request has been made repeatedly.
Whichever ground is relied on, the refusal must come with an explanation of how to object (art. 38(5)). How these considerations apply depends on the system and on the facts of the request, and the outcome can differ from one case to another.
What happens if the Korean entity does not comply?
A breach of article 37-2 is not a penalty surcharge matter, because article 37-2 is not among the provisions listed in article 64-2(1). Instead, article 75(2)(xxiv) makes a failure to comply with a request without a justifiable reason subject to an administrative fine of up to KRW 30 million. How Korean privacy fines are calculated explains the difference between the two kinds of sanction.
Article 37-2(4) also requires the criteria and procedures for automated decisions to be made public, but no administrative fine provision corresponds to that duty. The items to disclose are covered in the Korean privacy policy checklist.
Did the 11 September 2026 amendment change any of this?
No. In the amendment that took effect on 11 September 2026 (Act No. 21445), the wording of articles 37-2 and 38 and of article 75(2)(xxiv) is unchanged. A procedure aligned with the provisions described here does not need to be redesigned because of that amendment.
A note on the AI Framework Act
Korea's AI Framework Act is a separate statute with its own duties and its own sanctions, summarised on the AI Framework Act page. The duties on this page arise under PIPA alone. A system can be subject to both, and the two sets of duties should be mapped separately rather than merged into one checklist.
What to do with this
- List the headquarters systems that make final decisions about users in Korea, and classify each one as in or out of scope using article 6 of the Notice and its annex.
- Open a route for refusal, explanation and review requests at the Korean entity that is at least as easy to use as the route by which the personal data was collected. Article 38(4) requires that making these requests be no more difficult than collection.
- Build the three clocks into the escalation procedure with headquarters: 30 days, up to two extensions, and 10 days for a refusal. Name who is responsible on each side.
- For contract-based systems, design a separate procedure for explanation and review requests, since a refusal procedure will not be the one that is used.
- Compare the group's existing GDPR Article 22 procedure against these provisions point by point instead of treating it as equivalent.
Short statutory clocks are easier to meet when the procedure exists before the first request arrives; the same is true of breach notification.
Related
- Data subject rights after a cross-border transfer — the Korean note, with an English summary
- Where global policies and Korean provisions diverge — Korean note
- Korea's AI Framework Act — a separate statute with its own duties
- PIPA translation and the changes since Act No. 20897
- Korean article — the original version, with the underlying provisions
Frequently asked questions
Q. The decision system sits at headquarters and the Korean entity only takes in the request. Does the Korean entity still have to answer?
Yes. Article 28-8(4) of the Personal Information Protection Act requires a company that transfers personal data abroad to keep complying with Chapter 5, the chapter on data subject rights, and article 37-2 on automated decisions sits in that chapter. Article 38(1) then lists refusal and explanation requests under article 37-2 among the requests a data subject may make, alongside access, correction or erasure, and suspension of processing. The party bound to handle those requests is the Korean entity that transferred the data, wherever the system that made the decision is run.
Q. How long does the Korean entity have to deal with a request about an automated decision?
Thirty days from receipt, with the outcome notified in writing or by a similar method. Where there is a justifiable reason, the period can be extended up to twice, by up to 30 days each time (Enforcement Decree art. 44-3(5); PIPC Notice art. 8(1)). A decision to decline follows a shorter clock: unless there is a justifiable reason, the company must give the reasons and explain how to object within 10 days (Notice art. 8(2)). The 10-day period that applies to access, correction, erasure and suspension requests is a different rule and does not govern the main response to an automated-decision request.
Q. Our decision is necessary to perform the contract, so the user cannot refuse it. Is there anything left to do?
Yes. The proviso to article 37-2(1) takes away the right to refuse where the decision rests on consent, a legal obligation or contract performance, so the user cannot require the company to stop applying the decision or to have a person re-process it. The right to request an explanation under article 37-2(2) has neither a significant-effect condition nor a proviso, and the user may still submit an opinion and ask the company to consider whether to reflect it (Enforcement Decree art. 44-2(2)(ii)). The Enforcement Decree does, however, scale what the explanation must contain: where the decision does not significantly affect the user's rights or obligations, the company may answer with the general information it has already published about the system instead of an individual explanation (Enforcement Decree art. 44-3(2), proviso; Notice art. 4(3)). Those requests run on the same 30-day clock.
Sources
- Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 15, 28-8, 37-2, 38, 64-2 and 75: Korean text
- Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671), articles 41, 42, 43, 44 and 44-2 to 44-4: Korean text
- PIPC Notice on the measures to be taken by personal information processors for automated decisions (issued and in force 26 September 2024), with its Annex (administrative rules, National Law Information Center)
- GDPR Article 22
This note is a general summary of Korean law for readers outside Korea and is not legal advice; whether a system is in scope and whether a refusal is justified turn on the facts and require individual review. All English renderings of Korean statutes and notices on this page are unofficial and carry no legal effect; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Other English summaries are collected at English summaries, and questions about this page can be sent through the contact page.