Act on the Protection of Personal Information — provision of personal data to a third party in a foreign country

The default under Art. 28(1) is the data subject's prior consent — and since the 2020 amendment took effect, that consent is only valid if it was informed in a specific way: the business must first give the individual reference information about the destination country's data protection regime and the measures the recipient takes. Consent is not needed where the destination is a country the Personal Information Protection Commission has designated as having an equivalent standard (the EU and the UK are designated), or where the recipient has established a system meeting APPI-equivalent standards, in which case the exporter takes on ongoing duties to check the recipient's continued compliance and to make that information available to the data subject on request. APEC CBPR certification is recognised as one route to the equivalent-system test.