South Korea’s Personal Information Protection Act (PIPA) comes into force today, replacing a patchwork of sector-specific rules with a single comprehensive data protection law covering both the public and private sectors.
Key points
- Applies broadly to organisations that process personal information.
- Prescribes detailed security measures for personal information.
- Requires designation of a chief privacy officer.
- Introduces strict consent requirements and significant penalties.
UK organisations with Korean customers, employees or operations should assess whether they fall within scope. PIPA’s prescriptive requirements, including detailed consent and security rules, go further than many other regimes, so a GDPR-based programme may not be enough on its own.
Source: Personal Information Protection Act (Personal Information Protection Commission, Korea)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
