Law note · South Korea
Personal Information Protection Act, cross-border transfer restrictions
Art. 28-8 prohibits cross-border transfer of personal information unless a lawful basis applies, separate consent from the data subject first among them (Art. 17(3), the rule's pre-2023 home, was deleted by Act No. 19234), and bars a transfer contract that would violate the Act.
The 2023 amendment's Arts. 28-8 to 28-11 add alternative grounds: a treaty or international agreement, PIPC certification of the recipient's safeguards, or PIPC recognition that the destination country affords adequate protection, and arm the PIPC to order a transfer suspended for a serious or repeated violation. There is no data localization mandate.
What it asks of an app
- An app transferring the personal data of a Korean data subject to a recipient outside South Korea must obtain the data subject's separate consent, or rely on a qualifying treaty, PIPC certification, or PIPC adequacy recognition instead.
When LexLint raises it
Declared activities: crawls_web, trains_models, processes_biometrics, processes_voice
Primary source: official KLRI English translation of the current consolidated PIPA text