Personal Information Protection Act — cross-border transfer of personal information

Korea's default remained separate, specific consent to overseas transfer for years, which made it one of the harder regimes to operationalise. The 2023 amendment opened alternatives: transfer without separate consent is permitted where the overseas recipient holds a personal information protection certification recognised by the PIPC, where the PIPC has recognised the destination country as offering an equivalent level of protection, where a statute or treaty provides for the transfer, or where the transfer is necessary to outsource or store personal information for performance of a contract with the data subject and the data subject is notified through the privacy policy or another prescribed method. The PIPC can also order a transfer suspended. Note the practical asymmetry: the consent-free routes depend on recognitions the PIPC grants, so their availability changes over time and should be checked rather than assumed.