Key points. Article 30 of Korea's Personal Information Protection Act ("PIPA") does not name a language, but it lists the items the privacy policy must contain, and article 31(1) of the Enforcement Decree adds four more. The PIPC has said, in guidance and in the 2025 DeepSeek inspection, that a policy for Korean users should be written in Korean and built on the Korean Act, not simply translated from a policy drafted under another country's law. What the law requires is that the policy covers the items in article 30(1) and Decree article 31(1) and matches the company's actual processing. To check whether a translated global notice meets that requirement, this note uses five working tests (they are a review framework, not statutory conditions): coverage of every statutory item, the granularity those items require, a legal frame that speaks to Korean law, Korean facts about the local entity, and consistency with the contract. Where the company relies on article 28-8(1)(3)(a) for a cross-border transfer, the transfer section of the Korean policy is part of the transfer ground itself. Failing to establish or publish the policy carries an administrative fine of up to KRW 10 million (article 75(4)(8)).
The request usually arrives in the same form. Headquarters has a global privacy notice drafted around the GDPR. The Korean entity, or the team localising the website for Korea, is asked to have it translated and posted on the Korean site. The question that follows is whether a Korean translation of that notice satisfies PIPA, or whether the company needs a separate Korean document with its own mandated content.
The short answer is that the Korean entity needs a privacy policy under article 30, and a translation can be that policy only when the source document already contains what article 30 requires. It does not repeat two neighbouring topics: how the Korean entity's position differs from the "processor" label in a group DPA is covered in Your group DPA calls us a processor. Korean law has no such slot, and the grounds for transferring data out of Korea are covered in Our headquarters is certified. Is that a transfer ground under Korean law?.
Does PIPA say the privacy policy must be in Korean?
No provision of the Act names a language. Article 30(1) requires a personal information controller to establish a "personal information processing policy" containing the listed items, and article 30(2) requires the controller to publish the policy, when it is established or changed, so that data subjects can easily check it. Article 31(2) of the Enforcement Decree makes continuous posting on the controller's website the default method of publication.
The language point comes from the PIPC rather than the statute. According to the Korean article on which this note is based, the PIPC's privacy policy drafting guidelines (April 2026) and its guide on applying the Act to overseas businesses (April 2024) both say that an overseas business subject to the Act should write its privacy policy in Korean. The same guide asks such businesses not to simply translate a policy drawn up for another country's law, and to write the policy according to what the Korean Act requires.
The PIPC applied that position in its prior inspection of DeepSeek (Decision No. 2025-009-026). It treated the absence of a Korean-language policy and the omission of some required items together as a breach of article 30(1) and (2), and the measure it took was a corrective recommendation, not an administrative fine. The English note on that decision quotes the PIPC as saying the policy must be drawn up according to the Act "rather than simply translating a privacy policy drawn up on the premise of another country's laws" (DeepSeek before Korea's PIPC).
For a service aimed at Korean users the language question is therefore settled in practice. The harder question is whether the Korean text meets article 30.
What must the Korean privacy policy contain?
Article 30(1) lists ten items and, in item 8, delegates further items to the Enforcement Decree. Article 31(1) of the Decree supplies four. Seven of the fourteen apply only where the company actually carries out that kind of processing. A fifteenth item applies to companies that have appointed a domestic representative: article 31-2(4) requires the representative's details to appear in the privacy policy.
| # | Item | Provision | Applies |
|---|---|---|---|
| 1 | Purposes of processing | Act 30(1)(1) | Always |
| 2 | Processing and retention period | Act 30(1)(2) | Always |
| 3 | Provision to third parties | Act 30(1)(3) | Where applicable |
| 4 | Procedure and method of destruction, including the legal basis and items retained where another law requires retention under article 21(1) proviso | Act 30(1)(3-2) | Always |
| 5 | Possibility that sensitive information is disclosed, and how to choose non-disclosure (article 23(3)) | Act 30(1)(3-3) | Where applicable |
| 6 | Entrustment of processing | Act 30(1)(4) | Where applicable |
| 7 | Processing of pseudonymised information under articles 28-2 and 28-3 | Act 30(1)(4-2) | Where applicable |
| 8 | Rights and obligations of data subjects and legal representatives, and how to exercise them | Act 30(1)(5) | Always |
| 9 | Name of the chief privacy officer (CPO), or the name and telephone number of the department handling privacy work and related grievances | Act 30(1)(6) | Always |
| 10 | Installation and operation of devices that collect personal information automatically, such as cookies, and how to refuse them | Act 30(1)(7) | Where applicable |
| 11 | Items of personal information processed | Decree 31(1)(1) | Always |
| 12 | For a cross-border transfer, its ground and the five matters in article 28-8(2) | Decree 31(1)(2) | Where data is transferred abroad |
| 13 | Measures to ensure the safety of personal information under Decree article 30 | Decree 31(1)(3) | Always |
| 14 | Name of the country where personal information is processed, where data of Korean data subjects is collected directly from abroad | Decree 31(1)(4) | Where applicable |
| 15 | Domestic representative's name (for a corporation, its name and its representative's name), address, telephone number and email address | Act 31-2(4) | Where a domestic representative is appointed |
The five matters under article 28-8(2) are the items transferred; the country, time and method of transfer; the recipient's name (for a corporation, its name and contact details); the recipient's purpose of use and retention period; and the method, procedure and effect of refusing the transfer.
Two duties sit outside this list and are easy to miss. Article 37-2(4) requires a company that makes fully automated decisions to publish their criteria and procedure and the way personal information is processed; it is a separate disclosure, not an article 30 item. Article 26(2) requires the entrusting company to disclose the entrusted work and the entrustees, and Decree article 28(2) makes continuous posting on the company's website the default method.
When is a translation of the global notice enough?
A translation is a faithful rendering of a source text. The privacy policy under article 30 is a statement of what the Korean controller does, organised around a statutory list. The two coincide only when the source text was already written to that list and about those facts. The statutory requirement is the one set out above: every item in article 30(1) and Decree article 31(1) that applies, stated in a way that matches actual processing. The five tests below are this note's framework for checking a translation against that requirement; they are not conditions found in the Act. A translation that fails any one of them will usually need supplementing or rewriting.
1. Coverage: does every statutory item have a home?
For each line of the table, find the section of the global notice that answers it. Notices organised around GDPR transparency headings will usually find counterparts for purposes, retention, rights and transfers. Four items are commonly missing when a Korean version is produced by adapting a headquarters notice: the procedure and method of destruction, entrustment of processing, the CPO's contact details, and the safety measures under Decree article 31(1)(3). The global notice often has no heading for them, so a translator has nothing to translate.
The DeepSeek decision shows the same gap in a published case. According to the English note on that decision, DeepSeek's English policy did not contain several article 30 items, including the destruction procedure and method and the CPO's name and contact details.
2. Granularity: does each item say what the provision asks for?
Some Korean items demand a specific level of detail. The transfer item needs the five article 28-8(2) matters for each flow, including the recipient's name and contact details and how to refuse. The entrustment item has to identify the work entrusted and the entrustees. The CPO item needs a name, or a department with a telephone number. A global notice that says the company "may share data with affiliates and service providers around the world" will translate accurately into Korean and still fall short of these items, because the source never named the recipients.
Retention is a related case. Article 30(1)(2) asks for the processing and retention period, and article 30(1)(3-2) asks, where another law requires the company to keep data after its purpose ends, for the legal basis of that retention and the items kept. A global notice usually does not state the Korean statutes that oblige a Korean entity to keep records, because it is rarely written with Korean retention rules in view. Where it does, this item may need no more than translation.
3. Legal frame: does the document speak to Korean law?
A GDPR notice explains the lawful basis for each purpose, the retention period or the criteria for setting it, the safeguards for transfers outside the EU, the data subject rights, and the right to complain to a supervisory authority. Translated into Korean, those passages tell a Korean reader about a foreign law. The Korean list asks for different things in places: the rights of data subjects and of legal representatives, which reflects the requirement in article 22-2(1) to obtain a legal representative's consent for children under 14, and a CPO or grievance department in place of a supervisory authority.
Terminology adds a second layer. Korean law also separates two kinds of recipient: entrustment of processing under article 26 and provision to a third party under article 17. Those categories correspond to the GDPR's processor and third-party distinction, but not one to one, because the line between them is drawn on different criteria. A privacy policy that copies the processor and third-party labels from the global notice can therefore place a vendor under the wrong Korean heading. How the Korean line is drawn is set out in the processor note.
4. Korean facts: does the notice describe what the Korean entity does?
A global notice describes the group. The Korean policy has to describe the Korean controller: its own vendors in Korea, the cloud region its data actually sits in, the Korean retention obligations it is under, and its own CPO. Where the Korean entity has entrustees that headquarters does not use, a translated group notice will not mention them, and the omission engages article 26(2) as well as article 30.
Most of the exposure sits here, because a privacy policy is the company's own public statement of how it processes personal data. In due diligence it is compared with the data flow, and in an investigation it is compared with filings and system records. A Korean text that accurately renders the group notice can still be an inaccurate account of the Korean entity, and translation quality does nothing to fix that.
5. Contract: does the translated text promise more than the terms deliver?
Article 30(3) provides that where the privacy policy and the contract between the controller and the data subject differ, the term more favourable to the data subject applies. Global notices sometimes describe rights or deletion timelines generously. Once translated and posted as the Korean policy, those statements sit next to the Korean terms of service, and any difference is resolved in the user's favour. The translation therefore has to be read against the Korean terms and against actual operations before it is published.
Translate, supplement or rewrite: a decision table
The five tests usually lead to one of three outcomes. Where a document falls depends on the notice and on actual processing, so the table is a starting point for review.
| Situation | Likely outcome | What to do |
|---|---|---|
| The global notice already follows the article 30 list, names Korean recipients and entrustees, and states Korean retention grounds | Translation can serve as the Korean policy | Translate, then check every line of the item table against the Korean text and the Korean terms |
| The notice covers the common ground (purposes, retention, rights, transfers) but has no section for destruction, entrustment, the CPO or safety measures, or describes recipients only by category | Translation plus Korean sections | Keep the translated core; write the missing items and the per-flow transfer details from Korean facts |
| The notice is organised around another law's legal bases and rights, describes group processing only, or uses processor/third-party labels throughout | Separate Korean policy | Write the Korean policy to the article 30 list; use the global notice as a source of facts, not as a template |
Whichever row applies, one rule from the Korean article on which this note is based remains useful. Build one record of the company's actual data flows (collection, use, entrustment, transfer and destruction) and write each document from that record. When the record is accurate, the Korean policy and the global notice will agree on facts even where their legal frames differ.
Can the transfer section be your transfer ground?
This point turns the Korean policy from a notice into a legal instrument. Article 28-8(1)(3) permits a cross-border transfer where entrustment or storage abroad is necessary to conclude and perform a contract with the data subject, and either the five article 28-8(2) matters have been disclosed in the article 30 privacy policy (item (a)) or they have been notified to the data subject by email or another method set by the Decree (item (b)).
A company relying on item (a) is relying on the Korean privacy policy itself. If the transfer section is a translation of a global paragraph that does not name the recipients, the countries or the method of refusal, the disclosure on which the ground depends may not exist. In the DeepSeek decision, the PIPC found that the item 3 route DeepSeek's draft relied on was not available because the statutory items had been neither disclosed in the policy nor notified individually at the time of the inspection. How the five grounds relate to each other is covered in the transfer-ground note, and what the transfer contract must contain is covered in We signed the group DPA.
If both language versions are published, which one governs?
Two documents often end up on the Korean site: the Korean policy and an English version for foreign users in Korea. For that English version, a translation of the Korean policy is the right document, and it should say that it is a translation and that the Korean text prevails. A separate English privacy notice for users outside Korea is a different document, whose content is set mainly by the law where those users are. Where that processing is carried out by the Korean controller, Korean law may apply to it as well, so the notice cannot be written on the assumption that PIPA drops out. The Korean article explains why translating the Korean policy for that purpose leaves gaps in both directions.
The English version is easier to check against the statute if it uses the terms of the official English translation of the Act. The official translation of Act No. 20897 renders the heading of article 30 as "Establishment and disclosure of Privacy Policy", defines the "personal information processing policy" in the body, and then shortens it to "privacy policy". Other terms in that translation include "personal information controller", "data subject", "privacy officer" (this page uses CPO), "entrustment of work" and "cross-border transfer of personal information". Article 30 was not amended between Act No. 20897 and the current Act No. 21445, so those terms still match the article 30 text in force.
What follows if the Korean policy falls short?
The direct sanctions are administrative fines of up to KRW 10 million each under article 75(4). Item 8 covers failing to establish or publish the privacy policy in breach of article 30(1) or (2). Item 9-2 covers failing to include the domestic representative's name, address, telephone number and email address as article 31-2(4) requires. Item 5 covers failing to disclose entrusted work and entrustees under article 26(2). A breach of article 30 is not a penalty surcharge item, so the penalty surcharge calculator does not apply to it directly.
The PIPC also evaluates privacy policies under article 30-2. It looks at whether the policy properly contains the required items, whether it is written so that it is easy to understand, and whether it is published in a way data subjects can easily find, and it may recommend improvements under article 61(2). Under Decree article 31-2, targets are chosen with regard to factors including the type and revenue of the controller, the types and volume of personal information processed, and the characteristics of the data subjects, and a company selected is notified of the evaluation plan at least 10 days before the evaluation starts. According to the Korean article, the 2026 round covered 52 services in seven sectors, overseas luxury brands among them; the results had not been confirmed as published as of 16 October 2026.
The less visible consequence is evidential. A Korean policy that does not match the Korean entity's actual processing is a document the company published about itself. Correcting it later works only from the date of the correction, and the period during which it was inaccurate remains.
Did the September 2026 amendment change article 30?
The amended Act in force since 11 September 2026 (Act No. 21445) did not change article 30. It added article 30-3, which makes the business owner or representative the person ultimately responsible for the safe processing of personal information. It also reorganised article 31 on the CPO, so cross-references have moved: article 31-2(1)(1) now refers to article 31(4)(5) for grievance handling. A policy that quotes sub-paragraph numbers of article 31 from an earlier text should be checked against the current numbering. The two further amendments scheduled for 9 March 2027 and 1 July 2027 do not change article 30 either, on the text extracted on 29 September 2026.
Checklist before the Korean text goes live
- Decide what is under review: the Korean-language privacy policy itself, which is the document article 30 requires, or a reference translation of that policy in another language.
- Map every line of the item table to a section of the Korean text, and mark the conditional items that do not apply rather than leaving them silent.
- Write the destruction procedure and method, the entrustment list, the CPO's contact details and the safety measures from Korean facts.
- For each cross-border flow, state the transfer ground and the five article 28-8(2) matters, and check whether the company relies on article 28-8(1)(3)(a).
- Add the domestic representative's details if one has been appointed.
- Replace processor/third-party labels with the Korean positions worked out under articles 17 and 26.
- Compare the Korean text with the Korean terms of service and with operations, because article 30(3) resolves differences in the user's favour.
- Post the policy continuously on the Korean website, and put the date of each revision on it.
- If an English version is also posted, state that it is a translation and that the Korean text prevails.
Related
- Your group DPA calls us a processor. Korean law has no such slot: how to sort vendors into entrustment and third-party provision before they go into the privacy policy
- Our headquarters is certified. Is that a transfer ground under Korean law?: the five transfer grounds, including disclosure in the privacy policy
- We signed the group DPA. What does Korean law separately require the transfer contract to contain?: the contract layer behind each transfer
- Appointing a domestic representative: who must appoint one and the details the privacy policy has to carry
- 개인정보처리방침 영어로 만들기 (Korean): the full version of this note, including when an English Privacy Policy for overseas users has to be a separate document
Frequently asked questions
Q. Does Korean law require the privacy policy to be written in Korean?
Q. Can a straight translation of our GDPR-style privacy notice serve as the Korean privacy policy?
Q. What happens if our Korean privacy policy is incomplete?
Q. If we publish a Korean policy and an English version, which one governs?
Sources
- Personal Information Protection Act (Act No. 21445, in force 11 September 2026), articles 3, 21, 22-2, 26, 28-8, 30, 30-2, 30-3, 31-2, 37-2 and 75: Korean text
- Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 36671, in force 11 September 2026), articles 28, 31 and 31-2: Korean text
- Personal Information Protection Act (Act No. 20897), official English translation: Korea Legislation Research Institute
- PIPC, privacy policy drafting guidelines (revised April 2026): Korean text
- PIPC, guide on applying the Personal Information Protection Act to overseas businesses (April 2024)
- PIPC, 2026 privacy policy evaluation plan (press release): Korean text
- PIPC, prior inspection of DeepSeek, Decision No. 2025-009-026: Korean text
This note is a general summary of Korean law for readers outside Korea and is not legal advice; whether a particular translated notice can serve as the Korean privacy policy depends on its content and on the Korean entity's actual processing, and requires individual review. All English renderings of Korean statutes and guidance on this page are unofficial and carry no legal effect; the Korean text governs.
Written by Hyunsub Lee, a Korean-qualified lawyer at SEUM Law in Seoul (firm profile; the page opens in Korean, with an ENG switch at the top right). Questions about this page can be sent through the contact page.