Personal Information Protection Act · PIPA
Personal Information Protection Act
What is the Personal Information Protection Act?
- Covers the full lifecycle of personal data: collection, use, provision, and destruction
- Principles: consent-based, minimum collection within purpose, destruction after the retention period
- Violations bring fines and penalties; breaches must be reported
Once the law applies, the customer lists and employee files a company holds change from “assets” into “records with an expiration date.” If the marketing team is still holding a list of 2,000 seminar attendees from three years ago, it is not a sales opportunity but a liability that can blow up at any time. So the starting point in practice is not revising the consent form. It is building a personal information processing register that records which department holds which items, why, and when they will be deleted. Without one, you cannot even say what leaked when an incident happens.
Consent is not one lump either. You must collect required and optional consent separately, marketing messages need their own consent, and unique identifiers such as passport numbers and sensitive information such as health or union membership must each be collected separately. In particular, resident registration numbers cannot be collected without a legal basis, even with consent, and children under 14 need consent from a legal guardian. The often-confused difference between outsourcing and third-party provision turns on “whose purpose it serves”: handling work on your behalf is outsourcing (disclose it in the privacy policy), while a recipient using the data for its own purposes is third-party provision (separate consent required). When you learn of a breach, you must notify the affected individuals and report to the Personal Information Protection Commission and KISA within 72 hours.
A management system takes more than one document. You must appoint a Chief Privacy Officer (CPO), the person accountable for data protection, and publish their name and contact details in the privacy policy. Access logs for processing systems must be kept for at least one year, or two years if you handle data on 50,000+ data subjects or unique identifiers and sensitive data. Access is granted only as far as each job requires, so slow account removal when people leave or change departments is itself an audit finding. If you use outside vendors, write safeguard obligations into the contract and keep records of a processor review at least once a year.
The most common mistake in practice is assuming that “getting consent is enough.” If you bundle marketing opt-in into mandatory sign-up fields, that consent is invalid. If you reuse an attendee list collected to run a training course as a sales list for a new product, it is use beyond the original purpose, consent or not. Destruction works the same way. Deleting only the original on a shared drive is not destruction if copies remain on a manager’s laptop, in messaging app chats, or as printouts in a filing cabinet. In real audits, the problem is rarely a dramatic hack. More often it is a single Excel file left on a former employee’s laptop.
Jaryong KooMarketing PhD and leading authority on AI, data analytics, and personal branding
Seungtae ParkAX practitioner who builds AI business development and marketing automation tools and teaches from that hands-on experienceKorea’s core personal data law, enacted in 2011 and overseen by the Personal Information Protection Commission. A 2023 amendment strengthened the administrative fine system and established the legal basis for MyData (the right to request data transmission).
Consider a hypothetical case. Company A, an auto parts maker with 480 employees, runs about 40 in-house training programs a year and has kept attendee lists in Excel files on team shared folders. In a security audit by an automaker client, it was cited for having no retention standard for attendee information, and it was given 3 months to fix it.
- Manager Kim on the training planning team audited every shared folder and found 137 Excel files accumulated since 2019, holding 8,200 records including duplicates. Eleven of those files contained resident registration numbers.
- When the HR director asked, “Why do we need a resident number just to issue a certificate?”, the team cut the collected items to four (name, department, employee ID, and email) and removed the resident registration number field from the application form entirely.
- Director Lee of Business Support, who serves as Chief Privacy Officer (CPO), had the application form state the collection purpose, items, and retention period (3 years after completion), and made consent to marketing a separate, optional item, so applicants can submit without ticking it.
- They reopened the contract with the external LMS vendor to add the scope of the outsourced work and a ban on subcontracting, named the vendor in the privacy policy, and moved list transfers out of messaging app attachments into a folder only authorized staff can open.
- Three months later, the records on hand had fallen from 8,200 to 1,900 and the number of people with access had dropped from 12 to 4. In the client’s audit the following year, the personal information section closed with 0 findings.