Personal Information Protection Act, sensitive information and biometric data

Act No. 10465 (as amended by Act No. 19234, 2023) Art. 23; Enforcement Decree of the Personal Information Protection Act (Presidential Decree No. 34309, Mar. 12, 2024), Art. 18

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 September 2023.

A sensitive categories rule binding public and private bodies.

As of 23 August 2026.

What it requires

An app that derives a faceprint, voiceprint, or other unique biometric identifier from a Korean data subject, including one derived from a photo, video, or audio recording, must treat it as sensitive information under PIPA Art. 23 and obtain separate, specific consent before processing it.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Art. 23 bars processing sensitive information without separate consent or statutory authorization, listing ideology, belief, health, sex life, and trade union or political affiliation directly and delegating further categories to the Enforcement Decree.

Decree Art. 18 adds DNA information, criminal history records, information revealing racial or ethnic origin, and biometric information, defined technology neutrally as data from specific technical processing of physical, physiological, or behavioral characteristics used to uniquely identify a person. That definition covers a faceprint and a voiceprint alike without naming either, and does not exclude an identifier derived from a photo, video, or audio recording.

When LexLint raises it

processes_biometrics
processes_voice
trains_models
crawls_web

Read the law

official statute and Enforcement Decree text, KLRI English translation

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app