Korea's Personal Information Protection Act (개인정보보호법) is one of the stricter privacy regimes in the world, and it applies to any business or individual that collects or processes personal information in Korea — regardless of the data subject's nationality or visa status. Foreign residents are protected under the same law as Korean citizens, but many don't realize how far it reaches until something has already gone wrong: a data breach notice, an old account they can't get deleted, or personal information turning up somewhere it was never supposed to go.
→The Law Can Reach a Company Even If It's Based Outside Korea
An extraterritorial application provision (역외적용 조항) allows Korea's Personal Information Protection Act (개인정보보호법) to apply to foreign companies that process the personal information of people located in Korea, even without a physical office here — a relevant fact for foreign residents who assume an overseas service is beyond the reach of Korean privacy law simply because its servers and headquarters sit elsewhere.
→You Have Enforceable Rights to See, Correct, and Delete Your Own Data
The Personal Information Protection Act (개인정보보호법) gives every data subject a right to request access to the personal information a company holds (열람청구권), request correction of inaccurate information, request deletion, and request that processing be suspended — and a company that ignores or unreasonably delays these requests is itself in violation of the law, separate from whatever triggered the original complaint.
| Right | Korean Term | What It Lets You Do |
|---|---|---|
| Access | 열람청구권 | See exactly what personal information a company holds about you |
| Correction / Deletion | 정정·삭제청구권 | Force correction of wrong data or deletion when there's no valid basis to keep it |
| Processing suspension | 처리정지청구권 | Stop a company from continuing to use your data while a dispute is resolved |
Consent Has to Be Specific — a Buried Checkbox Usually Isn't Enough
Valid consent (동의) under Korean privacy law generally requires the company to clearly state what data is collected, for what purpose, and for how long, separately from unrelated terms of service. A single pre-checked box bundling privacy consent together with marketing consent and terms of use is a common practice that frequently doesn't meet the legal standard, which matters if a company later points to "you agreed to this" as its defense.
A company doesn't get to quietly decide a leak wasn't serious enough to mention. Once certain thresholds are met, telling you is the law — not a courtesy.
1A Data Breach Triggers Mandatory Notification, Not a Judgment Call
When personal information is leaked, stolen, or lost, businesses are generally required to notify affected individuals and, depending on the scale and sensitivity of the breach, report it to the Personal Information Protection Commission (개인정보보호위원회) — Korea's dedicated privacy regulator. A company that discovers a breach and simply patches the vulnerability without notifying anyone is failing a separate legal obligation on top of whatever caused the leak in the first place.
2You Can Claim Damages Without Proving You Lost Money
Korean privacy law includes a statutory damages provision (법정손해배상) that allows a victim to claim compensation up to a set amount without having to prove actual financial loss, in cases where a company's intentional or negligent violation caused the personal information incident. This matters because the real-world harm from a data leak — anxiety, spam, identity misuse risk — is often difficult to price in dollars or won, and this provision exists specifically so that difficulty doesn't leave victims with no remedy.
→What to Do If You Think Your Personal Information Was Misused
- Send a written access or deletion request first — a company's response, or lack of one, becomes part of the record if the dispute escalates.
- Report to the Privacy Violation Report Center (개인정보침해신고센터, dial 118) — this is a free government channel for reporting suspected violations, not a step that requires hiring a lawyer first.
- Consider free mediation before litigation — the Personal Information Dispute Mediation Committee (개인정보 분쟁조정위원회) resolves many disputes without a lawsuit.
- Keep every notice, screenshot, and email — the timeline of when the company knew and when it told you is often the most important fact in the case.