Can a service refuse me if I decline optional consent?

No—it may not refuse service because you declined optional items beyond the required data.

What should I do after a breach?

Change passwords, read the notice, and if harmed report to 118 or seek mediation or damages.

Personal Information Protection Act (Korea)

⚖️ Law By CampusDown Wiki Editorial Team Last updated October 26, 2026

The Personal Information Protection Act (PIPA) is Korea's general law governing how information that identifies a person—name, contact details, resident registration number—may be collected and used, protecting the rights of data subjects.

Contents

1. History
2. Core principles
3. Data subject rights
4. FAQ
5. References

History

Korea's 1994 privacy law covered only public bodies, while private firms fell under sectoral laws such as the Network Act. After a string of breaches, the comprehensive PIPA covering both sectors was enacted in 2011. A 2014 leak of more than 100 million records from three card companies tightened rules, and the 2020 amendments known as the "three data laws" introduced pseudonymized data and made the Personal Information Protection Commission an independent central agency. The 2023 amendment, echoing the EU GDPR and privacy rights thinking, raised the fine ceiling to 3% of total revenue and added a data portability right.

Core principles

Collect only the minimum needed for a stated purpose and use it only for that purpose. Lawful bases include consent, legal obligation, performance of a contract, urgent protection of life and legitimate interests; since 2023 the law has moved away from "consent for everything," allowing data needed to perform a contract without separate consent. Resident registration numbers require a statutory basis, and sensitive data such as health, beliefs or sex life needs separate consent. Pseudonymized data may be used without consent for statistics and research.

Data subject rights

Anyone may request access, correction or deletion, and suspension of processing; since 2024 people can also demand an explanation of, or refuse, fully automated decisions such as those made by AI. Companies must notify and report breaches within 72 hours. Sanctions have grown, such as a KRW 15.1 billion fine against Kakao in 2024. Victims can use the privacy-infringement hotline (118) or the dispute mediation committee. Data an employee submits with an employment contract is also protected.

FAQ

Can a service refuse me if I decline optional consent?: No—it may not refuse service because you declined optional items beyond the required data.
What should I do after a breach?: Change passwords, read the notice, and if harmed report to 118 or seek mediation or damages.

Sources reviewed: 2026-10-26

References

개인정보 보호법 (법률 제10465호, 2011. 3. 29. 제정; 2023. 3. 14. 일부개정).
개인정보보호위원회. (2024). 개인정보 보호법 및 시행령 개정사항 안내서.
Greenleaf, G. (2014). Asian Data Privacy Laws: Trade and Human Rights Perspectives. Oxford University Press.

Reports and materials that use this theory (Korean)

There are no materials dedicated to this theory yet, but you can search related reports in the CampusDown library (Korean).

Find more reports · Search '개인정보 보호법' on CampusDown →

The Right to PrivacyIs there a right to privacy in the Constitution? The definition, where it comes from, key cases from Griswold and Katz to Dobbs and Carpenter, and criticism.⚖️ Law Privacy Rights in the U.S.Your privacy rights in the U.S.: Fourth Amendment digital cases, sector laws like HIPAA and COPPA, state laws like the CCPA, and how Korea compares.⚖️ Law Employment contract (Korea)Korean employment contracts under Article 17 of the Labor Standards Act: the 2012 duty to deliver written terms, mandatory items such as wages, hours, holidays, and annual leave, penalties, standard contract forms, and a pre-signing checklist.⚖️ Law The Rule of LawWhat is the rule of law? Its meaning and history from Magna Carta to United States v. Nixon, Dicey and Fuller's principles, and how it differs from rule by law.⚖️ Law

Three Elements of the StateThe three elements of the state explained: territory, people and sovereignty in Georg Jellinek's theory. Covers land, sea and airspace, nationality, internal and external sovereignty, the 1933 Montevideo Convention criteria and recognition.🏛️ Politics & Public Administration Bronfenbrenner's Ecological Systems TheoryBronfenbrenner's ecological systems theory explained: micro-, meso-, exo-, macro- and chronosystems, the bioecological (PPCT) model, ecomaps, criticisms, and report examples.🤝 Social Welfare Consumer Decision-Making and Impulse BuyingThe consumer decision-making process: the five stages from need recognition to post-purchase behaviour, the EKB model, how involvement changes it, post-purchase dissonance, Stern's four types of impulse buying, Rook's definition, and marketing implications.💼 Business Maslow's Hierarchy of NeedsMaslow's hierarchy of needs explained: definition, the five levels, deficiency vs. growth needs, the pyramid myth, empirical criticisms and limitations, report examples for social work, nursing and business, and references.🧠 Psychology

Latest ArticlesView all ›

New guides for college study and assignments (Korean)

This article was last updated on October 26, 2026. It is based on widely recognized original works and textbooks; when citing it in a paper, please check the original sources listed in the references.