Processes de-identified data, in South Korea

Act No. 10465 (as amended by Act No. 21445, 2026), Arts. 28-2 to 28-5 and 28-7; Arts. 64-2 and 71 (penalties) · Read the law's page

• You may process pseudonymized information of people in Korea without their consent for statistics, scientific research, archiving in the public interest and similar purposes, and when you give it to a third party for those purposes you must not include any information that could be used to identify a specific individual (Article 28-2).
• Have pseudonymized information held by different controllers combined, for those purposes, only by a specialized institution designated by the Protection Commission or the head of the relevant central administrative agency, and obtain the approval of that institution's head before taking the combined information out of it, after processing it into pseudonymized information or the form Article 58-2 covers (Article 28-3).
• Store the additional information needed to restore pseudonymized information to its original state separately, take the technical, managerial and physical safety measures the Enforcement Decree sets, and keep records of the purpose of processing, any recipient and any separately set processing period, for at least three years from the date of destruction where the information is destroyed (Article 28-4).
• Never process pseudonymized information for the purpose of identifying a specific individual, and if information that can identify an individual is generated in processing, stop processing it at once and retrieve and destroy it without delay (Article 28-5).