SOUTH KOREA Trends and Developments Contributed by: Hwan Kyoung Ko, Sunghee Chae, Kyung Min Son and Matt Younghoon Mok, Lee & Ko
fore held that data subjects could request suspension of such pseudonymisation. The Supreme Court accepted the defendant’s position and reversed the lower courts’ decisions. It reasoned that pseudonymisation under Article 28-2, which involves deleting or replacing part of personal data so that individuals cannot be identified without addi - tional information, functions as a protective measure designed to reduce identification risk. In light of its legislative purpose and structure, the Court held that pseudonymisation carried out pursuant to Article 28-2 does not fall within the scope of “processing” subject to the right to request suspension under Arti - cle 37, paragraph 1. On remand, the appellate court subsequently followed the Supreme Court’s reason - ing, thereby confirming the interpretative approach adopted by the Supreme Court. This decision, rendered in proceedings in which the defendant was represented by Lee & Ko, has attracted considerable attention in academic and industry cir - cles. By clarifying that pseudonymised data may be utilised, including for purposes such as AI training, without being subject to suspension requests, the rul - ing is widely regarded as having materially strength - ened the legal foundation for data-driven innovation in Korea. Implications and Outlook The 2026 amendments to the PIPA reflect a clear shift towards strengthening corporate accountability for personal data protection at the governance lev - el. By expressly identifying representative directors as ultimately responsible, expanding the statutory duties and reporting lines of CPOs to the representa - tive director and board of directors, mandating cer - tification for certain data controllers and introducing an aggravated administrative penalty regime of up to 10% of total turnover in specified cases, the Amended PIPA reinforces that personal data protection is a mat - ter of board-level oversight rather than solely opera - tional compliance.
In this environment, establishing or reinforcing an effective internal governance framework for personal data protection will become an urgent priority. This includes ensuring sufficient investment in person - nel, systems and facilities, as well as reviewing inter - nal policies and organisational roles relating to data protection. Given that such measures may require amendments to internal regulations or adjustments to cross-functional responsibilities, prudent preparation aligned with the Amended PIPA is advised. Recent judicial decisions have clarified important boundaries of liability. While the Supreme Court has confirmed that statutory damages are not automati - cally awarded in all leakage cases, civil claims for statutory or compensatory damages are expected to continue following data breach incidents. In respond - ing to such claims, careful legal analysis of the nature of the leaked information, the likelihood of combina - tion with other data, the risk of secondary harm and the adequacy of post-incident remedial measures will be critical. At the same time, legislative discussions concerning AI-related data processing signal an effort to balance data protection with data utilisation. Taken together, these regulatory and judicial developments suggest that organisations operating in Korea should approach personal data protection as an integrated governance, compliance and risk management issue in an evolving regulatory landscape.
452 CHAMBERS.COM
Powered by FlippingBook