📚 Korea Data Privacy Series - Part 1 of 5
Data Privacy in Korea: Understanding PIPA for Foreign Companies
By Attorney NOH UJIN | HANBYOL LAW LLC, Seoul
Introduction
As foreign companies increasingly establish operations in South Korea or handle data of Korean residents, compliance with Korea's Personal Information Protection Act (PIPA) has become critical. PIPA is Korea's comprehensive data protection law, comparable to the European Union's GDPR, with stringent requirements and substantial penalties for non-compliance.
This article is the first in our five-part series on data privacy and PIPA compliance. We'll explore the fundamentals of Korea's data protection regime, key obligations for foreign companies, and practical steps to ensure compliance.
📚 Series Roadmap:
• Part 1: Understanding PIPA Basics (this article)
• Part 2: Cross-Border Data Transfer Requirements
• Part 3: Data Breach Notification and Response
• Part 4: Penalties, Enforcement and Recent Updates
• Part 5: Industry-Specific Compliance (FinTech, E-commerce, Healthcare)
What is PIPA?
Legislative Overview
The Personal Information Protection Act (개인정보 보호법) was enacted in 2011 and has been amended multiple times, most significantly in 2020 and 2023. It is administered primarily by the Personal Information Protection Commission (PIPC), an independent regulatory body.
Scope and Applicability
PIPA applies to:
- All entities: Businesses, government agencies, and non-profits that collect, use, or process personal information
- Territoriality: Any entity processing personal information of Korean residents, regardless of physical presence in Korea
- Data types: All personal information, including sensitive data and pseudonymized data
Key Takeaway for Foreign Companies: If your business processes data of Korean customers, users, or residents—even from outside Korea—PIPA likely applies to you.
Key Definitions Under PIPA
1. Personal Information (개인정보)
Any information relating to an identified or identifiable living individual, including:
- Name, resident registration number (주민등록번호)
- Image, voice, fingerprints, DNA
- Email address, phone number, location data
- IP addresses, cookies, device identifiers
- Any information that can identify an individual when combined with other data
2. Sensitive Personal Information (민감정보)
Data requiring special protection, such as:
- Ideology, beliefs, trade union membership, political opinions
- Health, genetic information, sex life
- Criminal history, biometric data
Processing sensitive data requires explicit separate consent.
3. Unique Identification Information (고유식별정보)
Government-issued identifiers that can uniquely identify individuals:
- Resident registration number (주민등록번호)
- Passport number
- Driver's license number
- Foreign resident registration number (외국인등록번호)
Use of unique identifiers is heavily restricted and requires explicit legal basis or separate consent.
4. Pseudonymized Information (가명정보)
Data processed to prevent identification without additional information, introduced in the 2020 amendment to facilitate big data analysis and research.
Seven Core Principles of PIPA
1. Purpose Limitation
Personal information must be collected and used only for specified, explicit, and legitimate purposes. Any processing beyond the original purpose requires new consent or a legal basis.
2. Data Minimization
Only collect personal information necessary for the intended purpose. Excessive or irrelevant data collection is prohibited.
3. Consent-Based Processing
As a general rule, personal information processing requires the data subject's informed consent, unless exempted by law.
4. Transparency
Data subjects must be clearly informed about how their personal information will be collected, used, and shared.
5. Right of Access and Control
Individuals have rights to access, correct, delete, and suspend processing of their personal information.
6. Data Security
Implement appropriate technical, physical, and administrative safeguards to protect personal information.
7. Accountability
Data controllers are responsible for ensuring PIPA compliance and must be able to demonstrate compliance.
Legal Bases for Processing Personal Information
Under PIPA, personal information can be processed based on:
1. Consent (Article 15)
The data subject's freely given, specific, informed consent. Consent must be:
- Clear and unambiguous
- Separate from other terms (unbundled)
- Easily withdrawable
- Documented and verifiable
2. Contractual Necessity (Article 15.1)
Processing is necessary for performance of a contract to which the data subject is a party, or to take steps at their request before entering into a contract.
3. Legal Obligation (Article 15.2)
Processing is necessary for compliance with a legal obligation.
4. Vital Interests (Article 15.3)
Processing is necessary to protect the vital interests of the data subject or another individual.
5. Public Task (Article 15.4)
Processing is necessary for performing a task carried out in the public interest or in the exercise of official authority.
6. Legitimate Interests (Article 15.5)
Processing is necessary for legitimate interests pursued by the controller or a third party, except where such interests are overridden by the data subject's rights and freedoms.
Practical Note: Relying solely on legitimate interests is risky in Korea. Consent remains the safest legal basis for most commercial processing.
Consent Requirements: Getting It Right
Elements of Valid Consent
PIPA requires that consent notices include:
- Purpose of collection and use
- Items of personal information to be collected
- Period of retention and use
- Right to refuse consent and any disadvantages resulting from refusal
Separate Consent for Special Categories
Additional explicit consent is required for:
- Processing sensitive personal information
- Processing unique identification information
- Providing personal information to third parties
- Entrusting personal information processing to third parties
- Transferring personal information outside Korea
Consent Withdrawal
Data subjects must be able to withdraw consent as easily as they gave it. Companies must:
- Provide simple withdrawal mechanisms
- Process withdrawal requests without delay
- Not request more information for withdrawal than for consent
Data Subject Rights Under PIPA
1. Right to Access (열람권)
Individuals can request to see what personal information a company holds about them. Companies must respond within 10 days.
2. Right to Rectification (정정권)
Data subjects can request correction of inaccurate or incomplete personal information.
3. Right to Erasure (삭제권)
Also known as the "right to be forgotten," individuals can request deletion of their personal information when:
- The purpose of collection has been achieved
- Consent has been withdrawn
- The retention period has expired
- The processing was unlawful
4. Right to Suspend Processing (처리정지권)
Individuals can request temporary suspension of processing their personal information.
5. Right to Data Portability (정보이동권, introduced 2020)
Data subjects can request their personal information in a commonly used, machine-readable format and transmit it to another controller.
Response Timeline: Companies must respond to rights requests within 10 days, extendable by an additional 10 days with notice and justification.
Key Obligations for Data Controllers
1. Designate a Data Protection Officer (DPO)
Companies meeting certain thresholds must appoint a Chief Privacy Officer (개인정보 보호책임자):
- Public institutions
- Companies with 5,000+ data subjects in the preceding year
- Information and communications service providers with 1 million+ users
- Companies processing sensitive information of 1,000+ individuals
2. Maintain Records of Processing Activities
Document all personal information processing activities, including:
- Types of personal information collected
- Purposes of collection and use
- Retention periods
- Third-party disclosures and transfers
- Security measures implemented
3. Conduct Privacy Impact Assessments (PIA)
PIAs are required when:
- Processing sensitive personal information of 100,000+ individuals
- Processing unique identification information of 100,000+ individuals
- Providing personal information to third parties for commercial gain
- Processing pseudonymized information for new purposes
- Installing video surveillance in sensitive areas
4. Implement Data Security Measures
Technical and organizational measures required include:
- Access controls: Limit access to personal information to authorized personnel only
- Encryption: Encrypt personal information during storage and transmission
- Access logs: Maintain records of access to personal information systems
- Firewalls and anti-malware: Protect systems from external threats
- Physical security: Secure facilities where personal information is stored
- Destruction procedures: Permanently delete or destroy personal information after retention period
5. Draft Privacy Policies
Publish clear, accessible privacy policies that include:
- Categories of personal information collected
- Purposes of collection and use
- Retention periods
- Third-party sharing and disclosure practices
- Data subject rights and how to exercise them
- Security measures
- Contact information for privacy inquiries
Third-Party Processing and Outsourcing
Entrustment (위탁)
When outsourcing personal information processing to third parties (processors), companies must:
- Notify data subjects or disclose in privacy policy
- Enter into written contracts specifying processing scope, purpose, security obligations
- Supervise and audit processors regularly
- Ensure processors destroy or return data after contract termination
Provision to Third Parties (제3자 제공)
Sharing personal information with third parties (controllers) requires:
- Separate explicit consent
- Disclosure of the recipient's identity, purpose, and data items
- Documentation and record-keeping
What Foreign Companies Often Get Wrong
1. Treating PIPA Like GDPR
While similar in spirit, PIPA has unique requirements:
- Consent standards: PIPA requires more granular, specific consent than GDPR
- Unique identifiers: Government ID numbers have special restrictions not present in GDPR
- Resident registration numbers: Collecting Korean RRNs is heavily restricted and generally prohibited for private companies
2. Insufficient Korean-Language Documentation
Privacy policies, consent forms, and notices must be in Korean for Korean users. English-only documentation is non-compliant.
3. Overlooking Local Hosting Requirements
While not explicitly required by PIPA, certain sectors (e.g., telecommunications, healthcare) may require data localization or local server hosting.
4. Inadequate Security Measures
Korea's enforcement authority places heavy emphasis on data security. Foreign companies sometimes underestimate the technical safeguards expected.
5. Ignoring Cross-Border Transfer Rules
Transferring personal information outside Korea requires separate consent and additional safeguards (covered in detail in Part 2).
Enforcement and Penalties
Administrative Fines
The Personal Information Protection Commission (PIPC) can impose fines up to:
- 3% of revenue or 50 million won (whichever is greater) for serious violations
- 2% of revenue or 30 million won for moderate violations
- Additional fines for each separate violation
Criminal Penalties
Serious violations can result in criminal prosecution:
- Up to 5 years imprisonment or 50 million won fine: For stealing or leaking personal information for profit
- Up to 3 years imprisonment or 30 million won fine: For processing personal information beyond authorized scope with intent to harm
- Up to 2 years imprisonment or 20 million won fine: For failure to implement security measures resulting in data breach
Civil Liability
Data subjects can seek compensation for damages resulting from PIPA violations. Companies may be liable for:
- Actual damages (economic and non-economic)
- Punitive damages (up to 3x actual damages for willful or grossly negligent violations)
- Injunctive relief
Recent Enforcement Examples
Case Study 1: Global Social Media Platform (2023)
A major social media company was fined 30 billion won for:
- Processing user data without proper consent
- Failing to implement adequate security measures
- Not responding to user rights requests within required timeframes
Case Study 2: E-Commerce Marketplace (2024)
An online marketplace received a 15 billion won fine for:
- Sharing customer data with third-party sellers without proper consent
- Retaining payment information beyond necessary periods
- Inadequate encryption of customer data
Case Study 3: FinTech Startup (2024)
A financial technology company faced criminal charges and a 5 billion won fine for:
- Collecting resident registration numbers without legal basis
- Transferring personal information abroad without consent
- Failing to conduct required Privacy Impact Assessment
Practical Compliance Checklist for Foreign Companies
Phase 1: Assessment (Months 1-2)
- Conduct data inventory and mapping
- Identify legal bases for all processing activities
- Review existing privacy policies and consent mechanisms
- Assess cross-border data transfer practices
- Evaluate current security measures
Phase 2: Gap Analysis and Remediation (Months 3-4)
- Identify gaps between current practices and PIPA requirements
- Draft compliant Korean-language privacy policy
- Redesign consent collection processes
- Implement data subject rights request procedures
- Appoint Chief Privacy Officer if required
Phase 3: Implementation (Months 5-6)
- Update website and app with new privacy notices
- Obtain fresh consent from existing users if necessary
- Implement enhanced security measures
- Train employees on PIPA compliance
- Establish ongoing monitoring and audit procedures
Phase 4: Maintenance (Ongoing)
- Conduct annual compliance audits
- Update policies as business practices change
- Monitor regulatory developments and guidance
- Test data breach response procedures
- Document all processing activities
Looking Ahead: What's Coming in Parts 2-5
In our upcoming articles, we'll explore:
- Part 2: Cross-border data transfers—consent requirements, standard contractual clauses, and adequacy decisions
- Part 3: Data breach notification obligations, response protocols, and crisis management
- Part 4: Understanding the penalty calculation methodology and recent enforcement trends
- Part 5: Industry-specific compliance considerations for FinTech, e-commerce, healthcare, and gaming companies
Conclusion
PIPA compliance is not optional for companies processing personal information of Korean residents. The law's extraterritorial reach, combined with increasingly aggressive enforcement and substantial penalties, means foreign companies can no longer afford to ignore Korean data protection requirements.
The good news: many foreign companies that have implemented GDPR compliance programs will find that they have already addressed many PIPA requirements. However, Korea-specific nuances—particularly around consent, unique identifiers, and cross-border transfers—require targeted attention.
📌 Key Takeaway: Treat PIPA compliance as a business imperative, not a legal formality. The cost of non-compliance—in fines, reputational damage, and operational disruption—far exceeds the investment required for proper implementation.
Need help achieving PIPA compliance? HANBYOL LAW LLC specializes in Korean data protection law, providing comprehensive compliance audits, policy drafting, and regulatory guidance for international companies.
📧 Contact: ujin95@hanbl.co.kr
🌐 Blog: Korean Law Explained
Initial consultations are complimentary. We provide services in Korean, English, Chinese, Japanese, and Spanish.
Related Articles:
📚 韩国数据隐私系列 - 第1部分（共5部分）
韩国数据隐私：外国公司理解PIPA
作者：卢宥镇律师 | 韩别律师事务所，首尔
引言
随着外国公司越来越多地在韩国建立业务或处理韩国居民的数据，遵守韩国的《个人信息保护法》（PIPA）已变得至关重要。PIPA是韩国的综合性数据保护法，可与欧盟的GDPR相媲美，对不合规行为有严格的要求和重大处罚。
本文是我们关于数据隐私和PIPA合规五部曲系列的第一部分。我们将探讨韩国数据保护制度的基础知识、外国公司的关键义务以及确保合规的实际步骤。
📚 系列路线图：
• 第1部分：理解PIPA基础知识（本文）
• 第2部分：跨境数据传输要求
• 第3部分：数据泄露通知和响应
• 第4部分：处罚、执法和最新更新
• 第5部分：行业特定合规（金融科技、电子商务、医疗）
[完整的中文内容将遵循英文版本的相同结构和深度...]
需要PIPA合规方面的帮助？韩别律师事务所专门从事韩国数据保护法，为国际公司提供全面的合规审计、政策起草和监管指导。
📧 联系方式：ujin95@hanbl.co.kr
🌐 博客：韩国法律解读
初步咨询免费。我们提供韩语、英语、中文、日语和西班牙语服务。
📚 韓国データプライバシーシリーズ - 第1部（全5部）
韓国のデータプライバシー：外国企業のためのPIPA理解ガイド
著者：盧宥鎮弁護士 | 韓別法律事務所、ソウル
はじめに
外国企業が韓国で業務を確立したり、韓国居住者のデータを扱ったりする機会が増えるにつれ、韓国の個人情報保護法（PIPA）の遵守が重要になっています。PIPAは韓国の包括的なデータ保護法であり、EUのGDPRに匹敵する厳格な要件と不遵守に対する重大な罰則があります。
本記事は、データプライバシーとPIPA遵守に関する5部構成シリーズの第1部です。韓国のデータ保護制度の基礎、外国企業の主要義務、および遵守を確実にするための実践的手順を探ります。
📚 シリーズロードマップ：
• 第1部：PIPA基礎の理解（本記事）
• 第2部：越境データ転送要件
• 第3部：データ侵害通知と対応
• 第4部：罰則、執行、最新の更新
• 第5部：業界別遵守（FinTech、Eコマース、ヘルスケア）
[完全な日本語コンテンツは英語版と同じ構造と深さに従います...]
PIPA遵守に関するサポートが必要ですか？韓別法律事務所は韓国のデータ保護法を専門とし、国際企業向けに包括的な遵守監査、ポリシー作成、規制ガイダンスを提供しています。
📧 連絡先：ujin95@hanbl.co.kr
🌐 ブログ：韓国法律解説
初回相談は無料です。韓国語、英語、中国語、日本語、スペイン語でサービスを提供しています。
📚 Serie de Privacidad de Datos de Corea - Parte 1 de 5
Privacidad de Datos en Corea: Comprendiendo PIPA para Empresas Extranjeras
Por el Abogado NOH UJIN | HANBYOL LAW LLC, Seúl
Introducción
A medida que las empresas extranjeras establecen cada vez más operaciones en Corea del Sur o manejan datos de residentes coreanos, el cumplimiento de la Ley de Protección de Información Personal (PIPA) de Corea se ha vuelto crítico. PIPA es la ley integral de protección de datos de Corea, comparable al GDPR de la Unión Europea, con requisitos estrictos y sanciones sustanciales por incumplimiento.
Este artículo es el primero de nuestra serie de cinco partes sobre privacidad de datos y cumplimiento de PIPA. Exploraremos los fundamentos del régimen de protección de datos de Corea, las obligaciones clave para las empresas extranjeras y los pasos prácticos para garantizar el cumplimiento.
📚 Hoja de Ruta de la Serie:
• Parte 1: Comprendiendo los Fundamentos de PIPA (este artículo)
• Parte 2: Requisitos de Transferencia de Datos Transfronteriza
• Parte 3: Notificación de Violación de Datos y Respuesta
• Parte 4: Sanciones, Cumplimiento y Actualizaciones Recientes
• Parte 5: Cumplimiento Específico por Industria (FinTech, Comercio Electrónico, Atención Médica)
[El contenido completo en español seguirá la misma estructura y profundidad que la versión en inglés...]
¿Necesita ayuda para lograr el cumplimiento de PIPA? HANBYOL LAW LLC se especializa en la ley de protección de datos de Corea, proporcionando auditorías de cumplimiento integrales, redacción de políticas y orientación regulatoria para empresas internacionales.
📧 Contacto: ujin95@hanbl.co.kr
🌐 Blog: Korean Law Explained
Las consultas iniciales son gratuitas. Proporcionamos servicios en coreano, inglés, chino, japonés y español.
Comments
Post a Comment