South KoreaPersonal Information Protection Act, cross-border transfer restrictions
Act No. 10465 (as amended by Act No. 19234, 2023), Art. 28-8(1), Arts. 28-8 to 28-11
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a Korean data subject to a recipient outside South Korea must obtain the data subject's separate consent, or rely on a qualifying treaty, PIPC certification, or PIPC adequacy recognition instead.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PIPC), Republic of Korea (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000556898&fileSn=0&fileExtsn=pdf
- Guidance body
- Personal Information Protection Commission (PIPC), Republic of Korea
- Open questions
- Which foreign restrictions on outbound data flows make a country one that "restricts cross-border transfers of personal information" under Article 28-10 of the Personal Information Protection Act, so that a controller there may be subject to equivalent restrictions?
What it makes you log
Logging duty
Articles 28-8 to 28-11 bar cross-border transfer unless a listed ground applies, require the controller to tell the data subject certain matters before relying on consent, and let the Protection Commission order a transfer suspended. They name no log or record. Article 28-8(4) requires protective measures "prescribed by Presidential Decree"; the Decree (Article 29-10) points to the Article 30 safety measures, which include access records, but that duty sits in a text the row does not cite and this row leaves it out. The sections carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
Art. 28-8 prohibits cross-border transfer of personal information unless a lawful basis applies, separate consent from the data subject first among them (Art. 17(3), the rule's pre-2023 home, was deleted by Act No. 19234), and bars a transfer contract that would violate the Act.
The 2023 amendment's Arts. 28-8 to 28-11 add alternative grounds: a treaty or international agreement, PIPC certification of the recipient's safeguards, or PIPC recognition that the destination country affords adequate protection, and arm the PIPC to order a transfer suspended for a serious or repeated violation. There is no data localization mandate.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .