South KoreaPersonal Information Protection Act, data subject rights
Act No. 10465 (as amended by Act No. 19234, 2023), Arts. 4, 35, 36, 37
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must let a Korean data subject confirm whether their personal information is being processed, and give them a way to access, correct, or delete it, or to demand that its processing be suspended.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PIPC), Republic of Korea (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000560337&fileSn=0&fileExtsn=pdf
- Guidance body
- Personal Information Protection Commission (PIPC), Republic of Korea
- Open questions
- Does the bar on erasure where personal information "shall be collected by other statutes or regulations" in Article 36(1) of the Personal Information Protection Act block erasure of the whole record or only of the items a statute requires the controller to collect?
What it makes you log
Logging duty
Articles 35 to 37 oblige the controller to grant access, correct or erase, and suspend processing on request, and to notify the data subject of its decision and of any refusal. None of them asks for a log, register or kept record, and the sections name no reader of one. The sections carry no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
PIPA Arts. 4 and 35 through 37 grant a data subject the right to confirm whether their data is processed, to access it, to demand correction and deletion, and to suspend processing, exercisable against the personal information controller. The same 2023 amendment added Art. 35-2, a data portability right whose commencement the amendment left to a date set by Presidential Decree. The Enforcement Decree sets that date at .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .