Last review date: 1 January 2025
☒ omnibus – all personal data
The Personal Information Protection Act (PIPA) governs the processing and protection of personal information as an omnibus rule, except where other laws contain special provisions. When enacting or amending other laws relating to personal information processing and protection, they must align with PIPA's purpose and principles (PIPA, Article 6).
☒ sector-specific
Where special provisions exist in other sector-specific laws, those provisions take precedence. For example:
- The Credit Information Use and Protection Act ("Credit Information Act") primarily governs the use and protection of personal credit information in the financial sector (Credit Information Act, Article 3-2).
- The Act on the Protection and Use of Location Information ("Location Information Act") primarily governs the collection, storage, protection and use of location information (Location Information Act, Article 4).
In both cases, PIPA applies supplementarily.
☒ constitutional
Data privacy is a constitutional right in South Korea. All citizens have the right to decide for themselves when, to whom, and to what extent their personal information is communicated and used (Constitution of the Republic of Korea, Article 17).
Last review date: 1 January 2025
- Personal Information Protection Act (PIPA) and its Enforcement Decree
- Credit Information Act and its Enforcement Decree
- Location Information Act and its Enforcement Decree
Last review date: 1 January 2025
- Act on Promotion of Information and Communications Network Utilization and Information Protection ("Network Act") and its Enforcement Decree
- Electronic Financial Transactions Act and its Enforcement Decree
- Act on the Protection of Information and Communications Infrastructure ("Infrastructure Act") and its iEnforcement Decree
Last review date: 1 January 2025
- Act on Promotion of the Provision and Use of Public Data ("Public Data Act") and its Enforcement Decree
- Framework Act on Promotion of Data Industry and Data Utilization ("Data Industry Act") and its Enforcement Decree
Last review date: 1 January 2025
No material changes are anticipated in the near future. Major amendments to PIPA and relevant updates to key cybersecurity laws, such as the Network Act, came into force in September 2023. Since then, more detailed subordinate rules have also been gradually revised to implement these legislative changes, with the latest amendments coming into force in September 2024. No further significant revisions are expected in the foreseeable future.