Cybersecurity Policy Report, South Korean DPA Issues Personal Information Processing Guide, (Jul 14, 2025)

By Tony Foley

An integrated guide to personal information processing issued today by the South Korean Personal Information Protection Commission (PIPC) consolidates several previous guidance documents regarding the processing of personal data and reflects changes ...

By Tony Foley

The integrated guide contains matters with which personal information processors must comply and systematically organizes prior guidance previously announced after the 2023 law revision, primarily to add case law and precedents, the PIPC said in a news release.

Previous guides on consent for processing, personal information protection, and automatic processing of personal information, along with a personal information consignment guide, have been abolished in favor of the integrated guide.

The integrated guide may be downloaded from the news release but is available only in Korean. The news release highlights several items discussed in the guide, as follows:

PIPA does not require processors to request separate consent for personal information to be entered into or perform a service use agreement;
While prior law excluded PIPA’s personal information processing obligation provisions in cases where urgently needed for public safety, a 2023 revision to PIPA allows the use, collection, and provision of personal information without separate consent in such situations, provided that processors comply with safety measures and destruction obligations to ensure safe management;
If personal information is to be additionally used within a scope related to the original purposes of collection, the judgment criteria must be disclosed in advance in the processor’s policy if the use is continuous, but in temporary cases, additional use is possible based on the processor’s own judgment criteria without separate disclosure;
A court case regarding a college entrance exam supervisor using a test taker’s personal information for private purposes is outlined to highlight the fact that the act of using personal information for private purposes was included in 2023 revisions and to avoid any confusion the case, which was decided before the revision, may cause;
A company going out of business or declaring bankruptcy must destroy personal information without delay, and when a contract or service is terminated, it may be considered that the purpose of processing has been achieved, giving rise to an obligation to destroy the data; and
Guidance is provided on implementation methods related to the use of trustees entrusted with personal information processing tasks in fields like cloud, web hosting, and recruitment.

News: InternationalLegislation DataPrivacy

Cybersecurity Policy Report, South Korean DPA Issues Personal Information Processing Guide, (Jul 14, 2025)

By Tony Foley

The integrated guide may be downloaded from the news release but is available only in Korean. The news release highlights several items discussed in the guide, as follows:

PIPA does not require processors to request separate consent for personal information to be entered into or perform a service use agreement;
While prior law excluded PIPA’s personal information processing obligation provisions in cases where urgently needed for public safety, a 2023 revision to PIPA allows the use, collection, and provision of personal information without separate consent in such situations, provided that processors comply with safety measures and destruction obligations to ensure safe management;
If personal information is to be additionally used within a scope related to the original purposes of collection, the judgment criteria must be disclosed in advance in the processor’s policy if the use is continuous, but in temporary cases, additional use is possible based on the processor’s own judgment criteria without separate disclosure;
A court case regarding a college entrance exam supervisor using a test taker’s personal information for private purposes is outlined to highlight the fact that the act of using personal information for private purposes was included in 2023 revisions and to avoid any confusion the case, which was decided before the revision, may cause;
A company going out of business or declaring bankruptcy must destroy personal information without delay, and when a contract or service is terminated, it may be considered that the purpose of processing has been achieved, giving rise to an obligation to destroy the data; and
Guidance is provided on implementation methods related to the use of trustees entrusted with personal information processing tasks in fields like cloud, web hosting, and recruitment.

News: InternationalLegislation DataPrivacy