Republic of Korea: Implemented Bill amending Personal Information Protection Act including cross-border data transfer requirements

On 15 September 2023, Law No. 19234, amending the Personal Information Protection Act (PIPA), was implemented. The Law established the conditions under which data transfers outside the Republic of Korea (ROK) are allowed. In particular, the Law allows data transfers if a country or international organisation has similar levels of data protection as the ROK, if a country has an international agreement in data transfer with the ROK, if the overseas recipient organisation has obtained data protection certification from the ROK Personal Information Protection Committee (PIPC), and if the data transfer is made to fulfil a contract with the data subject where storage details are fully disclosed.