South KoreaPersonal Information Protection Act, comprehensive regime and lawful bases
Act No. 10465 (), as amended by Act No. 19234 (), Art. 15
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of individuals in South Korea must establish one of PIPA's lawful processing grounds, most commonly consent or a documented legitimate interest justification, before processing, and must confine use to the stated purpose of collection.
These lines are LexLint's reading of the law's text. Also read by: Personal Information Protection Commission (PIPC), Republic of Korea (guidance, recorded ); Supreme Court of Korea, judgment of , Case No. 2014Da235080 (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pipc.go.kr/np/cmm/fms/FileDown.do?atchFileId=FILE_000000000559860&fileSn=1&fileExtsn=pdf
- Case citation
- Supreme Court of Korea, judgment of , Case No. 2014Da235080
- Guidance body
- Personal Information Protection Commission (PIPC), Republic of Korea
- Open questions
- When is a personal information controller’s interest "manifestly superior to the rights of the data subject" under Article 15(1)6 of the Personal Information Protection Act, so that it may collect personal information without consent?
What it makes you log
Logging duty
Article 15 lists the lawful bases for collecting and using personal information and the notice owed when consent is the basis. It asks the controller for no log or record. Article 16(1), which puts the burden of proving that only the minimum information was collected on the controller, and Article 29, which names preserving access records among the safety measures, sit outside the section this row cites, so this row leaves both out. The section carries no territorial clause, so the row carries no jurisdiction hook.
- Kind
- None
- As of
What this law does
PIPA is Korea's single omnibus personal-data statute, reaching public institutions and private businesses alike. Art. 15 sets several lawful bases for collecting and using personal information, most commonly consent or the controller's justifiable interest where it is manifestly superior to the data subject's rights, and confines processing to the stated purpose of collection.
There is no separate controller and processor split as sharp as General Data Protection Regulation (GDPR)'s; PIPA instead regulates the broadly defined personal information controller.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .