Republic of Korea: Announced PIPC Improvement of the Internet Blocking Measures System for Personal Information Processing Systems

On 12 September 2024, the Korea Personal Information Protection Commission (PIPC) announced the Improvement of the Internet Blocking Measures System for Personal Information Processing Systems. The new Measures aim to make the use of AI, cloud services, and external analysis tools for personal data processing more flexible by adjusting internet blocking requirements based on risk analysis. Previously, systems handling personal information were required to implement mandatory internet blocking against certain computers. With the new changes, internet blocking levels will be differentiated according to the risk level of the systems involved. Low and medium-risk systems may now have limited internet access if appropriate protective measures, such as data pseudonymisation and encryption, are in place. However, high-risk systems, such as those with the ability to set access rights to databases, will continue to be subject to strict internet blocking to prevent large-scale data breaches. Further, the PIPC announced that it would strengthen the responsibility of processors, as well as the support provided to those processors.