Personal Information Protection Act
South Korea's comprehensive data protection law, enforced by an independent regulator with strong investigative and penalty powers. A 2026 amendment significantly raises maximum penalties and formalises board-level accountability for privacy.
Who it applies to
- Any personal information controller processing data in South Korea
- Online and offline businesses, following the 2023 unification of previously separate rules
- Organisations transferring personal data outside South Korea
Key requirements
- Lawful basis and purpose-specific consent for processing
- Board-approved appointment of a Chief Privacy Officer at qualifying organisations
- Breach notification covering loss, theft, leakage, forgery or damage
- Rules governing automated decision-making and profiling
- Restrictions and safeguards on cross-border data transfers
Maximum penaltyAdministrative penalties of up to 10% of relevant revenue in aggravated cases (raised from 3% under the 2026 amendment)
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
PIPA applies to: Any personal information controller processing data in South Korea; Online and offline businesses, following the 2023 unification of previously separate rules; Organisations transferring personal data outside South Korea.
The core obligations are: Lawful basis and purpose-specific consent for processing; Board-approved appointment of a Chief Privacy Officer at qualifying organisations; Breach notification covering loss, theft, leakage, forgery or damage; Rules governing automated decision-making and profiling; Restrictions and safeguards on cross-border data transfers. Each is summarised in plain English above, with a link to the official text.
Effective: 2011, with major amendments taking effect September 2023 and September 2026. Regulator: Personal Information Protection Commission (PIPC).
Administrative penalties of up to 10% of relevant revenue in aggravated cases (raised from 3% under the 2026 amendment).
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under PIPA, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, rights requests and consent records sit in Consents Manager.
See how Praeferre automates PIPA compliance
Continuous monitoring, evidence and reporting for PIPA — alongside every other framework you need to satisfy.