On April 4, 2024, the Personal Information Protection Commission (PIPC) published guidelines for overseas businesses on the application standards and requirements for compliance with the Personal Information Protection Act (PIPA). The PIPC stated that the guidelines include case-based advice on the application of PIPA and focus on matters that overseas businesses must adhere to for the protection of the personal information of South Korean citizens. The PIPC mentioned that the guidelines clarify easily missed legal obligations in addition to advice from experts. The PIPC highlighted that the guidelines divide the type of businesses subject to the guidelines to include overseas businesses that either provide goods and services to South Korean data subjects, conduct personal information processing activities that affect South Korean data subjects, or have a place of business within the South Korean territory. 

The PIPC highlighted that the guidelines cover legal obligations to include: 

• requirements for legal representatives for children under 14 years of age;

• overseas transfers of data;

• disclosure methods of processing policy; 

• leak notification and report; 

• correction or deletion of data; and 

• processing guarantee of data subject rights (including suspension). 

The PIPC's announcement also mentioned specific requirements to include notification to the PIPC within 72 hours after becoming aware of a personal information leak and must also provide notification to the data subject. Also, when processing the information of a South Korean data subject, the PIPC stated that facts about the processing must be included in the policy presented to data subjects. 

You can read the press release and access the guidelines here, both only available in Korean.