Activity Tracker
The DPA Activity Tracker provides our latest information on developments in legislatures, judiciaries and the executive branches of G20, EU member states and Switzerland.
22 events advancing 17 policy or regulatory changes:
Graph
Table
Bill amending Personal Information Protection Act (Bill No. 2216765/Act No. 21445)
Mandatory personal information protection certification provisions of Personal Information Protection Act (Act No. 21445) entered into force
On 1 July 2027, the amended Article 32-2(1) proviso and Article 75(2) item 15 of Act No. 21445, amending the Personal Information Protection Act, entered into force. Under the amended Article 32-2(1) proviso, personal information processors meeting …
Bill amending Network Act including incident response obligations and enforcement measures (Bill No. 2214896/Law No. 21500)
Information Security Level Evaluation obligations in Act on Promotion of Information and Communications Network Utilization and Information Protection (Law No. 21500) enter into force
On 1 April 2027, the Information Security Level Evaluation obligations in the Act on Promotion of Information and Communications Network Utilization and Information Protection (Law No. 21500) enter into force. The Korea Ministry of Science and ICT m…
Consumer protection authority governance in Partial Amendment to Act on Consumer Protection in Electronic Commerce (Act No. 21312)
Partial Amendment to the Act on Consumer Protection in Electronic Commerce (Law No. 21312) including consumer protection authority governance enters into force
On 7 February 2027, the amendment to Article 39(3) of the Act on Consumer Protection in Electronic Commerce (Law No. 21312) enters into force. The Act applies to businesses under investigation or review by the Korea Fair Trade Commission (KFTC) for …
Local operations requirement in amendments to Enforcement Decree of Act on Consumer Protection in E-Commerce
Enforcement Decree of Act on Consumer Protection in E-Commerce including local operations requirement enters into force
On 21 January 2027, the amendment to the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, including local operations requirement, enters into force. Article 25-4 of the Decree includes provisions on foreign businesses wit…
Local operations requirement in Partial Amendment to the Act on Consumer Protection in Electronic Commerce (Act No. 21312)
Partial Amendment to the Act on Consumer Protection in Electronic Commerce (Act No. 21312) including local operations requirement enters into force
On 20 January 2027, the local operations requirement from the Act on Consumer Protection in Electronic Commerce (Law No. 21312) enter into force, 1 year after promulgation on 20 January 2026. The Act applies to overseas mail-order businesses and onl…
Content moderation regulation in Amended Enforcement Decree of Network Act (Decree No. 36502)
Amended Enforcement Decree of Network Act including content moderation regulation for large scale information and communications service providers enters into force
On 1 January 2027, the provisions under the Amended Enforcement Decree of the Network Act regarding content moderation requirements for large-scale information and communications service providers enter into force. The amended Decree establishes tha…
Personal Information Protection Commission revised Standards for Measures to Ensure the Safety of Personal Information
Articles 4, 5, 6, and 8 of Personal Information Protection Commission amendment to Standards for Measures to Ensure the Safety of Personal Information enter into force
On 31 October 2026, Articles 4, 5, 6, and 8 of the Personal Information Protection Commission amendment to the Standards for Measures to Ensure the Safety of Personal Information enter into force. Article 4 requires organisations to create and imple…
Consumer review disclosure in amendments to Enforcement Decree of Act on Consumer Protection in E-Commerce
Grace period for compliance with the review disclosure requirements under Enforcement Decree of Act on Consumer Protection in E-Commerce ends
On 21 October 2026, the 3-month grace period for compliance with the review-disclosure requirements under Article 27-3 of the amended Enforcement Decree of the Act on Consumer Protection in Electronic Commerce ends. From this date, e-commerce operat…
EU-South Korea equivalence recognition system enabling mutual data transfer framework
European Union-Korea mutual data equivalence recognition agreement for personal data transfers entered into force
On 16 September 2025, the Personal Information Protection Commission of Korea (PIPC) recognised the European Union's (EU) personal data framework as equivalent. The arrangement covers both public authorities and private companies transferring data b…
Amendment to enforcement decree of the Personal Information Protection Act including provisions on restructuring data portability framework
Amendments to enforcement decree of Personal Information Protection Act including provisions on restructuring data portability framework enters into force
On 20 August 2026, the amendments to the enforcement decree of the Personal Information Protection Act, including provisions on restructuring the data portability framework enters into force. The amendments split the previously unified category of i…