Key Facts
Overview
South Korea's PIPA was strengthened by a February 2026 amendment introducing the world's highest potential penalty ceiling at 10% of total annual revenue for severe violations. The amendment also designates the CEO as the ultimate responsible person for data protection, creating statutory accountability at the highest level.
What This Means for Your Website
- Explicit opt-in consent is required when cookie data can be combined with other data to identify individuals
- Privacy policies must disclose use of automatic data collection devices (cookies, pixels, SDKs)
- Data portability rights have been effective since March 2025
- Foreign businesses targeting Korean users must appoint a domestic representative from October 2025
- The 10% revenue penalty ceiling applies to repeated violations, intentional conduct affecting 10M+ individuals, or failure to comply with PIPC orders
Key Requirements
The PIPC enforces PIPA alongside KMCC, KISA, FSC, and MSIT. Standard penalties reach 3% of turnover; aggravated penalties reach 10% for severe violations. The SK Telecom fine of KRW 134.7 billion for a 23 million user breach demonstrates enforcement willingness. CEO statutory duty to manage and supervise compliance is unique globally.
How ConsentStack Handles This
ConsentStack detects South Korean visitors and applies opt-in consent for cookie data that can identify individuals, meeting PIPA's requirements including disclosure of automatic data collection devices.
Penalties
Standard: up to 3% of total annual turnover. Aggravated (Feb 2026): up to 10% of total annual turnover for severe violations. SK Telecom fined KRW 134.7B.
Key Requirements
- Explicit opt-in consent for personal information processing including linked cookie data
- Privacy policy must disclose use of automatic data collection devices
- Data portability rights effective March 2025
- Foreign businesses must appoint domestic representative from October 2025
- Mandatory data breach notification
- CEO designated as ultimate responsible person (February 2026)
Notable Provisions
- World's highest potential penalty ceiling (10% of total revenue)
- CEO statutory accountability for data protection
- SK Telecom fined KRW 134.7 billion for 23 million user breach
- AI Framework Act effective January 2026
Data Subject Rights
A controller may not refuse you goods or services because you decline to consent to collection beyond the minimum necessary, to optional processing, to use or provision beyond the original purpose, or to marketing.
If a controller processes personal information about you that it collected from someone other than you, it must on your request immediately tell you the source, the purpose of processing, and your right to suspend processing or withdraw consent.
Raise a grievance about the processing of your personal information with the controller's privacy officer (its owner or representative if none is designated), whose contact details must appear in the privacy policy and whose duties include handling grievances; the Act sets no response period.
Confirm whether a controller processes your personal information and access it, including copies; the controller may postpone access only with good cause it tells you, and may limit or deny access on the statutory grounds after telling you why.
Ask a controller that meets the Enforcement Decree criteria (designated health and medical, telecommunications and energy providers) to transmit data processed with your consent or under a contract to you or a designated recipient, in machine-readable form and without delay.
After accessing your personal information, ask the controller to correct it; the controller must investigate without delay, make the correction unless another law provides otherwise, and tell you the result.
After accessing your personal information, ask the controller to erase it unless another law requires its collection; erased data must not be recoverable, and a refusal must be explained to you without delay.
Ask a controller to suspend processing some or all of your personal information; it must comply without delay and destroy the data concerned unless a statutory exception applies (such as a legal obligation or a contract it cannot otherwise perform), and must tell you why if it refuses.
Withdraw consent you gave to the processing of your personal information; the controller must without delay take measures such as destroying the data so it cannot be recovered, unless a statutory exception applies, and must tell you why if it does not.
Refuse a fully automated decision, including one made with AI, that significantly affects your rights or duties (unless it rests on your consent, a law or a contract), and ask for an explanation or review of any automated decision; the extension may be taken up to twice.
Have your legal representative or a person you delegate file your requests for access, transmission, correction, erasure, suspension, withdrawal of consent and automated-decision refusal or explanation; a legal representative may also file them for a child under 14.
Object to a controller's denial of your request for access, transmission, correction, erasure, suspension, withdrawal of consent or an automated-decision refusal or explanation, through the procedure the controller must provide; the Act sets no deadline for deciding the objection.
Report an infringement of your personal information rights or interests to the Personal Information Protection Commission, which receives reports through the Privacy Call Center operated by the Korea Internet and Security Agency.
Other Asia Pacific Regulations
Frequently Asked Questions
Stay compliant with South Korea PIPA
ConsentStack helps you implement Opt-in consent for South Korea automatically.