SOUTH KOREA Law and Practice Contributed by: Brian Tae-Hyun Chung, Haewon Han, Jung-Chull Lee and Ari Yoon, Kim & Chang
Restrictions on third-party provision and delegation If the transfer in question constitutes a third-party provision within the original purpose of collection, the PIPA requires the data controller to meet at least one of the following grounds: • where the data controller obtains consent from the data subject; • where there are special provisions in law allow - ing third-party provision, or third-party provision is inevitable to comply with statutory obligations; • where third-party provision is evidently deemed necessary for urgent protection of life, body or property of a data subject or a third party; • where third-party provision is necessary to achieve the legitimate interests of a data controller, and such necessity clearly supersedes the rights of the data subject – in such cases, third-party provision is limited to where the legitimate interests of the data controller are substantially related and do not go beyond the reasonable scope; or • where third-party provision is urgently required for public safety and security. If the transfer in question constitutes a delegation, consent from the data subject is not required. How - ever, the data controller must disclose details of del - egation and enter into a written agreement with the entity that is delegated with the processing of person - al information. Such agreement must include matters that are statutorily required under the PIPA. 5.2 Government Notifications and Approvals Apart from the regulations mentioned in 5.1 Restric- tions on International Data Transfers and 5.3 Data Localisation Requirements , data controllers are not required to provide notification to government agen - cies or to obtain approvals. 5.3 Data Localisation Requirements While there is no general data localisation rule under the PIPA, there are individual laws that prohibit over - seas transfer of specific types of data, such as the following: • the Medical Services Act prohibits storing electron - ic medical records (EMR) outside Korea;
• the Act on the Establishment and Management of Spatial Data requires a licence to transfer certain map data outside Korea; • the Industrial Technology Protection Act requires a company to obtain approval from or file a prior report with the Ministry of Trade, Industry and Energy in order to export national core technology; • the Electronic Financial Transactions Act stipulates that financial companies or electronic financial business operators’ systems for processing unique identification information or personal credit infor - mation cannot be located outside Korea in the course of using cloud computing services; and • the Cloud Computing Act stipulates that data pro - cessed by Korean government organisations and public institutions must be located in Korea. 5.4 Blocking Statutes There are no “blocking” statutes that protect Korean companies from the effect of extraterritorial sanctions. 5.5 Recent Developments As outlined in 5.1 Restrictions on International Data Transfers , one of the legal bases for transferring per - sonal information internationally is when the PIPC acknowledges that the destination country provides an adequate level of privacy protection. In September 2025, the PIPC announced its first adequacy deci - sion for the EU as well as its plans to expand this to countries such as the UK and Japan through future adequacy review. For countries such as the USA, where privacy frameworks differ significantly despite high data transfer needs, the PIPC plans to develop customised overseas transfer mechanisms. Moreover, the PIPC plans to broaden the available mechanisms for the secure and seamless overseas transfer of personal information by amending the PIPA in the first half of 2026. These mechanisms may include the Standard Contractual Clauses prepared by the PIPC or Binding Corporate Rules of multina - tional companies approved by the PIPC. The PIPC also plans to introduce the Overseas Transfer Impact Assessment System for self-evaluating risks in large- scale overseas transfers of highly sensitive data, alongside an Overseas Transfer Pre-Review System tailored for M&A activities.
445 CHAMBERS.COM
Powered by FlippingBook