Key points. Korea's Personal Information Protection Act ("PIPA") has a legitimate-interest basis, article 15(1)(6), but a headquarters purpose that runs on GDPR article 6(1)(f) does not automatically run on it in Korea. Three structural differences decide the outcome. First, the Korean provision asks for interests that manifestly prevail over the data subject's rights and then adds a second condition: the processing must be substantially related to those interests and stay within a reasonable scope. Second, the Korean bases are listed separately for each activity. Article 15(1) covers collection and use, and article 17(1) covers provision to third parties. The provision list includes legitimate interest (within the purpose of collection) but leaves out contract performance, article 15(1)(4). Third, use or provision beyond those lists is prohibited under article 18(1), subject to exceptions that are narrow for private companies, with a separate and limited route for further use under articles 15(3) and 17(4). The practical question is therefore not whether Korea "has" legitimate interest. It is which of the headquarters' purposes fit which Korean list.

A Korean subsidiary that is asked to align its lawful-basis register with the group usually receives a Legitimate Interests Assessment ("LIA") from headquarters. The document sets out the purpose, explains why the processing is necessary and records the balancing of the company's interests against those of the data subject. Under GDPR it is the record a controller keeps when it relies on article 6(1)(f), and group LIAs are generally well prepared.

The question that follows from the subsidiary is whether the same document can stand as the basis in Korea. Part of it usually can. Which part depends on what the processing is for, and this note works through the common purposes in turn.

Why one mapping does not carry over

GDPR sets out its lawful bases once, in article 6, and applies that list to processing as a whole. Collection, internal use and disclosure to another party all draw on the same six bases.

PIPA organises the same ground by activity. Collection and use draw on the seven bases in article 15(1). Provision to a third party draws on a separate set of two, in article 17(1). Article 18 then deals with use and provision that go beyond those two lists, by prohibiting them and enumerating exceptions.

The lists do not line up with each other. A basis that supports collection may not support provision, and a register that labels a whole data flow "legitimate interest" will not show where in that flow the Korean basis runs out. For that reason the analysis below follows the purpose rather than the basis.

Purpose by purpose

What headquarters does with the dataBasis usually recorded under GDPRWhere the Korean analysis sitsWhat changes in Korea
The Korean entity collects and uses data for its own legitimate interestArt. 6(1)(f)PIPA art. 15(1)(6)"Manifestly prevail", plus the second sentence on close relation and reasonable scope
Data collected on that basis is passed to an affiliate or partnerArt. 6(1)(f)PIPA art. 17(1)(2)Available within the purpose of collection; beyond it, art. 18 applies
Data is passed to a payment provider or a delivery company to fulfil an orderArt. 6(1)(b)PIPA art. 17(1); or art. 26 if the recipient processes on the company's behalfContract performance, art. 15(1)(4), is not in the provision list
Data is reused for marketing analysis or a new servicePurpose limitation and compatibility, arts. 5(1)(b) and 6(4)PIPA art. 18; arts. 15(3) and 17(4); Enforcement Decree art. 14-2(1)A prohibition with listed exceptions, and a narrow further-use route

The GDPR column describes how groups commonly document these purposes. It is included for comparison, and this note does not interpret the GDPR provisions.

1. The Korean entity's own collection and use

This is the purpose for which the headquarters LIA is most useful. Article 15(1)(6) of PIPA reads, in our unofficial rendering, as follows.

"Where it is necessary to achieve the legitimate interests of the personal information processor and those interests manifestly prevail over the rights of the data subject. In this case, it is limited to where it is substantially related to the legitimate interests of the personal information processor and does not exceed a reasonable scope."

The first sentence resembles article 6(1)(f), but two points differ.

The first is the word "manifestly". Article 6(1)(f) is drafted as a basis that applies unless the data subject's interests or fundamental rights override those of the controller. The Korean provision instead requires the processor's interest to prevail clearly. When the balance is close, the two texts point in different directions.

The second is the second sentence. It adds a condition of substantial relation and reasonable scope that operates after the balancing. Passing the balancing test does not end the analysis. The processor also has to show that the processing stays closely tied to the interest it relies on and does not go further than that interest requires.

An LIA that already addresses both layers can largely be reused in Korea. If the group document records only the GDPR balancing test, the Korean entity may have no written assessment that answers the second sentence. In that case the Korean entity can supplement the group document for Korea.

2. Sharing data collected on legitimate interest with an affiliate or partner

Here the question moves from article 15 to article 17. Article 17(1) permits provision to a third party in two cases only:

  1. where the data subject has consented; and
  2. where personal data collected under article 15(1)(2), (3) or (5) to (7) is provided within the purpose for which it was collected.

Read out in full, the cross-reference in item 2 covers article 15(1)(2), on statutory provisions and legal obligations; (3), on the duties of public institutions; (5), on urgent interests in life, body or property; (6), legitimate interest; and (7), on public safety such as public health.

Legitimate interest is therefore on the provision list. A Korean entity that collected data on article 15(1)(6) may provide it within the purpose of that collection without separate consent. The limit is the phrase "within the purpose for which it was collected". A transfer to a partner for the partner's own, different purpose falls outside it, and the analysis moves to article 18 (see section 4).

3. Disclosures that headquarters treats as contract necessity

This is where a design built for GDPR most easily parts company with Korean law. Some GDPR designs rely on article 6(1)(b) to cover disclosures to third parties as well as the company's own processing. Passing card details to a payment provider, or a delivery address to a courier, is explained as necessary to perform the contract with the customer.

Article 17(1)(2) of PIPA does not cross-refer to article 15(1)(4), which is the basis for performing a contract with the data subject or taking steps at the data subject's request before entering into one. The Korean provision list has no contract route.

A company that has been explaining such a disclosure as contract necessity has three things to consider:

  • whether the arrangement is in fact entrustment under article 26 rather than provision. Where a cloud provider or a payment agent processes the data for the company's purposes, the arrangement may fall on the entrustment track, which has its own requirements. Whether it is entrustment or provision should be decided before a basis is chosen. Your group DPA calls us a processor explains how that line is drawn;
  • the data subject's consent under article 17(1)(1); and
  • the exceptions in article 18(2).

Whether the disclosure stays within the purpose of collection decides whether the company works from article 17(1) or from article 18, and so which of these options it reviews first.

4. Reusing data for analytics or a new service

Under GDPR, purpose limitation is a principle in article 5(1)(b), and article 6(4) supplies a compatibility assessment for further processing. PIPA fills the same position with a prohibition and a closed list of exceptions, which leaves less room for judgement.

Article 18(1) prohibits use beyond the scope of article 15(1), and provision beyond the scope of articles 17(1) and 28-8(1). Article 18(2) then lists exceptions. For a private company four are relevant:

  • separate consent from the data subject (item 1);
  • a special provision in another statute (item 2);
  • a case clearly recognised as necessary for an urgent interest in the life, body or property of the data subject or a third party (item 3); and
  • an urgent need for public safety and welfare, such as public health (item 10).

Items 5 to 9 are limited to public institutions by the text of the provision. Even where an exception applies, it is not available if the use or provision is likely to unfairly infringe the interests of the data subject or a third party.

There is one narrower route that does not require consent. Article 15(3) allows additional use within a scope reasonably related to the original purpose of collection, taking into account whether the data subject suffers a disadvantage and whether security measures such as encryption are in place. Article 17(4) sets up the same structure for provision. Article 14-2(1) of the Enforcement Decree lists four factors:

  1. whether the use is related to the original purpose of collection;
  2. whether the additional use or provision was foreseeable, given the circumstances of collection and the processing practice;
  3. whether it unfairly infringes the data subject's interests; and
  4. whether necessary security measures, such as pseudonymisation or encryption, have been taken.

A group that documented an article 6(4) compatibility assessment has useful material here, because the factors overlap in part. The fourth factor is the point to watch. Korea treats the safeguards actually applied as part of the basis itself, so the record has to show which measures were taken, not only that the reuse was compatible.

If a reuse such as marketing analysis or new service development is distant from the original purpose, the Korean entity has to decide whether it fits the article 15(3) route or needs separate consent, and the decision should be recorded. The same structure, applied to workplace CCTV footage, is discussed at When is watching CCTV footage "use"?. For AI training on user input specifically, the DeepSeek decision sets out how the Commission dealt with arguments based on contract necessity and legitimate interest.

Before the group LIA is reused in Korea

  • Split the data flow by activity. Separate collection and use, provision to a third party, entrustment and cross-border transfer, and find a Korean basis for each. Cross-border transfer has its own list in article 28-8(1); the certification note covers one of its grounds.
  • Look for disclosures justified as contract necessity. Because article 17(1)(2) does not cross-refer to article 15(1)(4), each such disclosure needs consent, an entrustment structure or an article 18(2) exception.
  • Add the second sentence of article 15(1)(6) to the LIA. If the group assessment does not address substantial relation and reasonable scope, prepare a Korean supplement that does.
  • Identify reuse that has become routine. Where data is used for a purpose some distance from the original one, record whether the article 15(3) route applies or separate consent is needed, and which safeguards were in place. Where additional use or provision under articles 15(3) or 17(4) occurs on a continuing basis, article 14-2(2) of the Enforcement Decree also requires the criteria for the four factors to be published in the privacy policy and the chief privacy officer to check that the company follows them.
  • Check older interpretive answers against the current text. Many published interpretive answers on article 15 predate the 2023 overhaul. For article 17, the cross-reference in article 17(1)(2) was changed by the amendment of 14 March 2023, and answers given before that change assumed the old cross-reference. An older answer is only as good as the wording it assumed.

Frequently asked questions

Q. Does Korean law have a basis that corresponds to GDPR legitimate interest?

It appears to. Article 15(1)(6) of the Personal Information Protection Act allows collection and use where it is necessary to achieve the processor's legitimate interests and those interests manifestly prevail over the rights of the data subject. The second sentence of the same subparagraph confines this to cases that are substantially related to those interests and do not go beyond a reasonable scope. Both parts have to be satisfied, so a GDPR article 6(1)(f) balancing record carried over unchanged may lead to a different conclusion in Korea. More than half of the 125 interpretive materials on article 15 counted as of 28 September 2026 are dated before the 2023 overhaul of the Act, so an older answer should be checked against the current wording of the subparagraphs of article 15(1) before it is relied on.

Q. Can personal data collected on legitimate interest be given to an affiliate or a partner?

Provision to a third party is governed by a separate list. Article 17(1) allows it in two cases: with the data subject's consent, or where data collected under article 15(1)(2), (3) or (5) to (7) is provided within the purpose for which it was collected. Legitimate interest, article 15(1)(6), falls inside that cross-reference, so data collected on that basis may be provided within the purpose of collection. Once the provision goes beyond that purpose, the question becomes one of use or provision outside the purpose under article 18.

Q. Can data collected to perform a contract be passed to a third party in Korea?

In our view the contract basis alone is unlikely to be enough. The cross-reference in article 17(1)(2) covers article 15(1)(2), (3) and (5) to (7), and article 15(1)(4), the contract basis, is not among them. A company in that position would usually look at the data subject's consent or at the exceptions in article 18(2), and which comes first depends on whether the provision is within or outside the purpose of collection. Where the recipient is in fact processing on the company's behalf, the arrangement may be entrustment under article 26 rather than provision. The cross-reference in article 17(1)(2) was changed by the amendment of 14 March 2023, and more than half of the 51 interpretive materials on article 17 counted as of 28 September 2026 predate the entry into force of that overhaul, so older answers need to be read against the current text.

Only through a narrow route. Article 18(1) prohibits use and provision beyond the scope of articles 15(1) and 17(1), and the exceptions in article 18(2) that a private company can use are limited. Articles 15(3) and 17(4) allow additional use or provision without consent within a scope reasonably related to the original purpose, and article 14-2(1) of the Enforcement Decree sets out four factors to consider. If the reuse does not fit that route, separate consent is the usual alternative, and the decision either way is worth recording.

Sources

  • Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 15, 17, 18 and 26: Korean text. The wording of articles 15, 17 and 18 was not changed by the amendment in force on 11 September 2026.
  • Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671), article 14-2: Korean text
  • GDPR articles 5(1)(b), 6(1)(b), 6(1)(f) and 6(4), cited for comparison only

This note is a general summary of Korean law for readers outside Korea and is not legal advice; which basis applies turns on the facts of a particular data flow and requires individual review. All English renderings of Korean statutes on this page are unofficial and carry no legal effect; the Korean text governs.

Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Questions about this page can be sent through the contact page, and other English summaries are collected at English summaries.