Law note · South Korea
Personal Information Protection Act, data subject rights and automated decisions
PIPA Arts. 4 and 35 through 37 grant a data subject the right to confirm whether their data is processed, to access it, to demand correction and deletion, and to suspend processing, exercisable against the personal information controller. Art. 37-2, added by the 2023 amendment, adds the right to demand an explanation of, or refuse, a fully automated decision that significantly affects the subject's rights or obligations, subject to a controller's justifiable reason defense.
The same amendment added Art. 35-2, a data portability right, reported by secondary sources to have taken effect separately on 2025-03-13; that date was not confirmed against directly fetched primary text this session.
What it asks of an app
- An app must give a Korean data subject a way to access, correct, or delete their personal information, and must let a person demand an explanation of, or refuse, a fully automated decision that materially affects their rights, unless a limited statutory exception applies.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official English translation, KLRI, supplemented by convergent secondary legal reporting on Art. 37-2's specific effective date