Personal Information Protection Act, data subject rights and automated decisions

Act No. 10465 (as amended by Act No. 19234, 2023), Arts. 4, 35, 36, 37, 37-2

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 15 March 2024.

A data subject rights rule binding public and private bodies.

As of 23 August 2026.

What it requires

An app must give a Korean data subject a way to access, correct, or delete their personal information, and must let a person demand an explanation of, or refuse, a fully automated decision that materially affects their rights, unless a limited statutory exception applies.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

PIPA Arts. 4 and 35 through 37 grant a data subject the right to confirm whether their data is processed, to access it, to demand correction and deletion, and to suspend processing, exercisable against the personal information controller. Art. 37-2, added by the 2023 amendment, adds the right to demand an explanation of, or refuse, a fully automated decision that significantly affects the subject's rights or obligations, subject to a controller's justifiable reason defense.

The same amendment added Art. 35-2, a data portability right, reported by secondary sources to have taken effect separately on 13 March 2025; that date is not confirmed against primary text.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions

Read the law

official English translation, KLRI, supplemented by convergent secondary legal reporting on Art. 37-2's specific effective date

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app