What Is Personal Information Protection Act (Republic of Korea)?

The Personal Information Protection Act (PIPA) is South Korea's general privacy statute. The effective text identified for the 7 September 2026 review is Act No. 20897, amended on 1 April 2025 and effective on 2 October 2025. The Korean Law Information Center also lists Enforcement Decree No. 36121 as effective on 20 August 2026 and Act No. 21445 as enacted for 11 September 2026, so date-specific advice should distinguish current law from future changes.

PIPA provides access, correction, erasure, and processing-stop rights subject to statutory limits. For a private controller, the reviewed rules provide 10 days for access and for notifying the result of a correction/deletion or processing-stop request; the underlying correction, deletion, and processing-stop duties operate without delay. The current Enforcement Decree also provides a 72-hour breach-notice rule when its conditions apply.

You can ask the current controller to correct or erase personal information when the Act's conditions apply, but no Korea-specific data-broker complaint or deletion channel was established in the reviewed primary sources. Submit the applicable request directly to the controller, and use the general KISA/PIPC infringement-report route or dispute mediation where appropriate. The Financial Supervisory Service 1332 channel is a separate financial-sector route, not the general broker route.

The PIPC publishes an infringement-report system operated by KISA. Its official page lists the Privacy Call Center at 118, the reporting website at privacy.kisa.or.kr, and 118@kisa.or.kr. Check the official page immediately before filing because channels and instructions can change.

The PIPC describes a Personal Information Dispute Mediation Committee that can handle disputes about processing, access, correction, deletion, suspension, and compensation-related requests. If both parties accept an established mediation, the PIPC explains that it can have the effect of a settlement before the court; a rejected mediation may lead to other remedies such as a civil suit.

For a private controller, the reviewed PIPA framework provides 10 days for access and for notifying the result of a correction/deletion or processing-stop request; correction, deletion, and processing-stop action itself is due without delay. This is not an unconditional 10-day deletion-completion guarantee, and the request type, exceptions, controller, statutory text, and implementing rules must be checked separately.

Use the English material as a research aid, not as the controlling text. PIPC states that its documents are produced in Korean in principle and that English translations are provided for convenience; the current Korean statute and regulations should control a legal conclusion.

No. Access, correction, erasure, and suspension rights have statutory conditions and exceptions. A broker's source, role, purpose, retention duty, sector rules, and the accuracy or legality of the processing all matter; OfflistMe can help draft a request for review and sending but cannot guarantee a result.

That is not established. The reviewed sources cover overseas transfers and qualifying foreign controllers with domestic-representative duties, but did not establish a standalone GDPR-style targeting or monitoring test. Korean residence or mere possession of Korean data alone does not prove that every non-Korean broker is in scope; the controller, processing, statutory scope, and applicable thresholds must be assessed.