No. 21445
Promulgation Date 2026-03-10
Personal Information Protection Commission
ALL
CHAPTER I GENERAL PROVISIONS
Article 1 (Purpose)
Article 2 (Definitions)
Article 3 (Principles of information protection)
Article 4 (Rights of data subjects)
Article 5 (Responsibilities of the State)
Article 6 (Relationship to other statutes)
CHAPTER II ESTABLISHMENT OF PERSONAL INFORMATION PROTECTION POLICIES
Article 7 (Personal Information Protection Commission)
Article 7-2 (Composition of the Protection Commission)
Article 7-3 (Chairperson)
Article 7-4 (Term of office of Commissioners)
Article 7-5 (Status guarantee for Commissioners)
Article 7-6 (Prohibition on dual office holding)
Article 7-7 (Grounds for disqualification)
Article 7-8 (Business affairs under jurisdiction of Protection Commission)
Article 7-9 (Matters to be deliberated and resolved on by Protection Commission)
Article 7-10 (Meetings)
Article 7-11 (Exclusion of, challenge to, or recusal of, Commissioner)
Article 7-12 (Sub-commission)
Article 7-13 (Secretariat)
Article 7-14 (Operation)
Article 8 Deleted.
Article 8-2 (Assessment of personal information breach incident factors)
Article 9 (Master plan)
Article 10 (Implementation plan)
Article 11 (Request for materials)
Article 11-2 (Assessment of level of personal information protection)
Article 12 (Personal information protection guidelines)
Article 13 (Promotion and support of self-regulation)
Article 13-2 (Personal Information Protection Day)
Article 14 (International cooperation)
CHAPTER III PROCESSING OF PERSONAL INFORMATION
SECTION 1 Collection, Use, and Provision of Personal Information
Article 15 (Collection and use of personal information)
Article 16 (Restriction on collection of personal information)
Article 17 (Provision of personal information)
Article 18 (Restriction on repurposing personal information and provision thereof)
Article 19 (Restriction on use and provision of personal information on part of its recipients)
Article 20 (Notification of sources of personal information collected from other than data subjects)
Article 20-2 (Notification of details of use and provision of personal information)
Article 21 (Destruction of personal information)
Article 22 (Methods of obtaining consent)
Article 22-2 (Protection of children's personal information)
SECTION 2 Restriction on Processing of Personal Information
Article 23 (Restriction on processing of sensitive information)
Article 24 (Restriction on processing of personally identifiable information)
Article 24-2 (Restriction on processing of resident registration numbers)
Article 25 (Restriction on installation and operation of fixed visual data processing devices)
Article 25-2 (Restriction on operation of mobile visual data processing devices)
Article 26 (Restriction on personal information processing subsequent to entrustment of work)
Article 27 (Restriction on transfer of personal information following business transfer)
Article 28 (Supervision of personal information handlers)
SECTION 3 Special Cases concerning Pseudonymized Information
Article 28-2 (Processing of pseudonymized information)
Article 28-3 (Restriction on combination of pseudonymized information)
Article 28-4 (Obligation to take safety measures for pseudonymized information)
Article 28-5 (Prohibited acts in processing pseudonymized information)
Article 28-6 Deleted.
Article 28-7 (Scope of application)
SECTION 4 Cross-Border Transfer of Personal Information
Article 28-8 (Cross-border transfer of personal information)
Article 28-9 (Orders to suspend cross-border transfers of personal information)
Article 28-10 (Reciprocity)
Article 28-11 (Provisions applicable mutatis mutandis)
CHAPTER IV SAFEGUARD OF PERSONAL INFORMATION
Article 29 (Duty of safeguards)
Article 30 (Establishment and disclosure of Privacy Policy)
Article 30-2 (Evaluation of Privacy Policy and recommendations for improvements)
Article 30-3 (Responsibilities of business owners or representatives)
Article 31 (Designation of privacy officers)
Article 31-2 (Designation of domestic agents)
Article 32 (Registration and disclosure of personal information files)
Article 32-2 (Certification of personal information protection)
Article 33 (Privacy impact assessment)
Article 34 (Notification and reporting of divulgence of personal information)
Article 34-2 (Erasure and blocking of exposed personal information)
CHAPTER V GUARANTEE OF RIGHTS OF DATA SUBJECTS
Article 35 (Access to personal information)
Article 35-2 (Request for transmission of personal information)
Article 35-3 (Institutions specializing in managing personal information)
Article 35-4 (Management of transmitting personal information and support therefor)
Article 36 (Correction or erasure of personal information)
Article 37 (Suspension of processing of personal information)
Article 37-2 (Rights of data subjects for automated decision)
Article 38 (Methods and procedures for exercise of rights)
Article 39 (Liability for damages)
Article 39-2 (Claims for statutory compensation)
CHAPTER VI Deleted
Article 39-3 (Submission of data)
Article 39-4 (Confidentiality order)
Article 39-5 (Revocation of confidentiality order)
Article 39-6 (Notification of request for perusal of litigation records)
Article 39-7 (Coverage of liabilities for damages)
CHAPTER VII PERSONAL INFORMATION DISPUTE MEDIATION COMMITTEE
Article 40 (Establishment and composition)
Article 41 (Guarantee of members’ status)
Article 42 (Exclusion of, challenge to, or recusal, of members)
Article 43 (Application for mediation)
Article 44 (Time limitation of mediation proceedings)
Article 45 (Requests for materials and fact-finding investigation)
Article 45-2 (Restriction on invoking statements)
Article 46 (Settlement advice before mediation)
Article 47 (Dispute mediation)
Article 48 (Rejection and suspension of mediation)
Article 49 (Collective dispute mediation)
Article 50 (Mediation procedures)
Article 50-2 (Notification of opinion for improvement)
CHAPTER VIII CLASS-ACTION LAWSUIT OVER DATA INFRINGEMENT
Article 51 (Parties to class action lawsuit)
Article 52 (Exclusive jurisdictions)
Article 53 (Retention of litigation attorney)
Article 54 (Application for permission of lawsuit)
Article 55 (Requirements for permission of lawsuit)
Article 56 (Effect of conclusive judgment)
Article 57 (Application of Civil Procedure Act)
CHAPTER IX SUPPLEMENTARY PROVISIONS
Article 58 (Partial exclusion from application)
Article 58-2 (Exemption from application)
Article 59 (Prohibited activities)
Article 60 (Confidentiality)
Article 61 (Presentation of opinions and recommendations for improvement)
Article 62 (Reporting on infringements)
Article 63 (Requests for materials and inspections)
Article 63-2 (Preliminary fact-finding inspections)
Article 64 (Corrective measures)
Article 64-2 (Imposition of penalty surcharges)
Article 65 (Accusation and recommendation for disciplinary action)
Article 66 (Publication of results)
Article 67 (Annual reports)
Article 68 (Delegation and entrustment of authority)
Article 69 (Persons deemed to be public officials for purposes of applying penalty provisions)
CHAPTER X PENALTY PROVISIONS
Article 70 (Penalty provisions)
Article 71 (Penalty provisions)
Article 72 (Penalty provisions)
Article 73 (Penalty provisions)
Article 74 (Joint penalty provisions)
Article 74-2 (Confiscation and collection)
Article 75 (Administrative fines)
Article 76 (Special exemption to application of provisions on administrative fines)
ADDENDA <Act No. 10465, Mar. 29, 2011>
ADDENDA <Act No. 11690, Mar. 23, 2013>
ADDENDA <Act No. 11990, Aug. 6, 2013>
ADDENDUM <Act No. 12504, Mar. 24, 2014>
ADDENDUM <Act No. 12844, Nov. 19, 2014>
ADDENDA <Act No. 13423, Jul. 24, 2015>
ADDENDA <Act No. 14107, Mar. 29, 2016>
ADDENDUM <Act No. 14765, Apr. 18, 2017>
ADDENDA <Act No. 14839, Jul. 26, 2017>
ADDENDA <Act No. 16930, Feb. 4, 2020>
ADDENDA <Act No. 19234, Mar. 14, 2023>
ADDENDA <Act No. 20897, Apr. 1, 2025>
ADDENDA <Act No. 21445, Mar. 10, 2026>