Processes personal data, in South Korea

Act No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties) · Read the law's page

• You may process pseudonymized information of people in Korea without their consent for statistics, scientific research, archiving in the public interest and similar purposes, and when you give it to a third party for those purposes you must not include any information that could be used to identify a specific individual (Article 28-2).
• Have pseudonymized information held by different controllers combined, for those purposes, only by a specialized institution designated by the Protection Commission or the head of the relevant central administrative agency, and obtain the approval of that institution's head before taking the combined information out of it, after processing it into pseudonymized information or the form Article 58-2 covers (Article 28-3).
• Store the additional information needed to restore pseudonymized information to its original state separately, take the technical, managerial and physical safety measures the Enforcement Decree sets, and keep records of the purpose of processing, any recipient and any separately set processing period, for at least three years from the date of destruction where the information is destroyed (Article 28-4).
• Never process pseudonymized information for the purpose of identifying a specific individual, and if information that can identify an individual is generated in processing, stop processing it at once and retrieve and destroy it without delay (Article 28-5).

Arts. 48-3 and 48-4 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (Act No. 20069, Jan. 23, 2024) · Read the law's page

• Immediately report a computer security incident to the Minister of Science and ICT or to the Korea Internet and Security Agency upon discovering it; a report already made for the same incident under another statute satisfies this duty and need not be repeated.
• A person who operates an information and communications network, a provider of information and communications services included, must analyze the cause of the incident, respond based on the results of that analysis, and take measures to keep the resulting damage at bay (Article 48-4(1)).
• Preserve data when the Minister of Science and ICT orders it, and submit on the Minister's demand the data needed to analyze the incident's cause; submitting false data or refusing to submit it is separately finable, and failing to preserve data after an order to do so is a criminal offense (Article 73, item 6).
• The reporting and data duties below bind a provider of information and communications services, the Act's own broad term for a person who, for profit, provides information or acts as an intermediary in providing information using a telecommunications business operator's services, with no revenue or user threshold gating these duties; a separate certification duty in this Act binds only a designated information and communications service provider identified by revenue or user count and is not raised here. The cause-analysis duty in Article 48-4(1) reaches any person who operates an information and communications network, a provider included.

Act No. 10465 (Mar. 29, 2011), as amended by Act No. 19234 (Mar. 14, 2023), Art. 15 · Read the law's page

• An app that collects, uses, or discloses the personal data of individuals in South Korea must establish one of PIPA's lawful processing grounds, most commonly consent or a documented legitimate interest justification, before processing, and must confine use to the stated purpose of collection.

Act No. 10465 (as amended by Act No. 19234, 2023), Art. 23; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, Mar. 12, 2024), Art. 18 · Read the law's page

• An app that derives a faceprint, voiceprint, or other unique biometric identifier from a Korean data subject, including one derived from a photo, video, or audio recording, must treat it as sensitive information under PIPA Art. 23 and obtain separate, specific consent before processing it.

Act No. 10465 (as amended by Act No. 19234, 2023), Art. 28-8(1), Arts. 28-8 to 28-11 · Read the law's page

• An app transferring the personal data of a Korean data subject to a recipient outside South Korea must obtain the data subject's separate consent, or rely on a qualifying treaty, PIPC certification, or PIPC adequacy recognition instead.

Act No. 10465 (as amended by Act No. 19234, 2023), Art. 34; Enforcement Decree Arts. 39-40 · Read the law's page

• An app that suffers a leak, theft, loss, forgery, alteration or damage of Korean personal data must notify affected data subjects within 72 hours of becoming aware of it, or without delay once the cause ceases to exist where urgent containment measures are needed or an unavoidable cause such as a natural disaster prevents it (Enforcement Decree Article 39(1)).
• Where unauthorized access to a personal-information system or to a handler's device suggests a breach but the affected data subjects are hard to identify, or where some personal information is found traded unlawfully so that other data subjects' data may also have been breached, notify every data subject who may be affected within 72 hours of learning of it, stating that a further notice follows if the breach is confirmed (Article 34(2); Enforcement Decree Articles 39-2 and 39-3).
• Report the breach to the PIPC or the Korea Internet and Security Agency within 72 hours of becoming aware of it if it affects 1,000 or more data subjects, involves sensitive information or unique identification information, or resulted from unauthorized access from outside, or without delay once the cause ceases to exist where an unavoidable cause prevents it (Enforcement Decree Article 40(1)).

Act No. 10465 (as amended by Act No. 19234, 2023), Arts. 39, 39-2, 51, 64-2 · Read the law's page

• An app processing Korean personal data must be able to answer to the PIPC for its lawful basis and safeguards, and an individual harmed by a security failure may bring a private civil claim for statutory damages, or damages up to five times the actual loss, without needing to prove the controller's negligence.

Act No. 10465 (as amended by Act No. 19234, 2023), Arts. 4, 35, 36, 37 · Read the law's page

• An app must let a Korean data subject confirm whether their personal information is being processed, and give them a way to access, correct, or delete it, or to demand that its processing be suspended.

Act No. 10465 (as amended by Act No. 21445, 2026), Art. 29; Enforcement Decree (Presidential Decree No. 36671, 2026), Art. 30(1); Personal Information Protection Commission Notice No. 2025-9 (Standards for Personal Information Safety Measures), Art. 8 · Read the law's page

• Keep an access record for every person (other than the data subject) who accesses a system that processes the personal information of a person in Korea, showing the identifier, the date and time, the access location, the data subject information handled and the task performed, store it safely against forgery and alteration, and keep it for at least one year, or at least two years where the system holds the data of 50,000 or more data subjects, holds unique identification or sensitive information, or you are a registered or notified basic telecommunications business operator.
• Set in your internal management plan, and carry out, the cycle, method and follow-up procedure for checking access records and download activity.