South Korea PIPA vs GDPR: Criminal Penalties, RRN Rules, and Cross-Border Transfer Powers Compared (2026)

South Korea's Personal Information Protection Act (PIPA) and the EU's General Data Protection Regulation (GDPR) both regulate how organizations collect and use personal data, but they diverge sharply on enforcement. PIPA backs its rules with a four-tier criminal code that can send a compliance officer to prison, layers a near-absolute ban on Resident Registration Number (RRN) processing that GDPR has no counterpart to, and gives Korea's regulator a power the EU has never had: the authority to unilaterally order a company to stop an overseas data transfer already underway.

The two frameworks share a broad family resemblance -- both grant individuals rights over their data, both require a lawful basis for processing, both regulate cross-border transfers -- but the machinery behind PIPA is built differently, and the difference matters most in exactly the places a compliance team is most likely to get wrong: who can go to prison, what a Resident Registration Number is, and how fast a regulator can stop a transfer already in flight.

This article addresses South Korea's Personal Information Protection Act (PIPA), enforced by the Personal Information Protection Commission (PIPC), compared with the EU's General Data Protection Regulation (GDPR). For PIPA's full framework outside the GDPR comparison, see our South Korea data privacy laws guide. This article does not constitute legal advice.

PIPA vs GDPR: At a Glance

Background

PIPA is South Korea's comprehensive personal data protection statute, enforced by the Personal Information Protection Commission (PIPC). It has been amended repeatedly since its original enactment, most consequentially by a 2023 amendment that added the automated-decision rights at Article 37-2 and the cross-border transfer regime at Articles 28-8 and 28-9, and most recently by a 2026 amendment raising the ceiling on the revenue-based penalty surcharge in aggravated cases. Some older English-language mirrors of PIPA, including a widely cited translation stamped to the 2020 version of the law, predate these additions and should not be relied on for current text.

The GDPR, in force since May 25, 2018, is the reference point this comparison uses throughout. Where PIPA borrows GDPR-style structure -- a controller/processor framework, enumerated legal bases, a chapter of individual rights -- the resemblance is real. Where it doesn't, the divergence tends to be sharp rather than incremental, and criminal liability is the clearest example.

Scope and Consent-Centric Design

PIPA applies to any "personal information processor" handling personal information in Korea, and its territorial reach extends to processing that affects data subjects in Korea even when the processor is based abroad, broadly comparable to GDPR's extraterritorial reach under Article 3.

The bigger structural difference sits in how each law lets an organization justify processing in the first place. GDPR's Article 6 offers six co-equal, non-hierarchical lawful bases, and organizations frequently prefer contract necessity or legitimate interests specifically to avoid consent's stricter withdrawal mechanics. PIPA is explicitly consent-centric: consent is the primary and most commonly used basis, and the statutory alternatives function more as narrow substitutes for consent than as equally weighted options.

PIPA's alternative bases include: a statutory obligation or unavoidable duty under another law; work a public institution is statutorily assigned to perform; steps necessary to perform or prepare a contract with the data subject; protecting life, body, or property from imminent danger; and a "legitimate interests" analog available only where the controller's interest is "manifestly superior" to the data subject's rights and the processing stays substantially related and within reasonable scope. That "manifestly superior" bar is a materially stricter formulation than GDPR's balancing test, which requires only that the controller's interest not be overridden by the subject's interests on balance, not that it clearly outweigh them.

Definitions and Sensitive Data

PIPA's sensitive information category covers, under Article 23(1) itself, ideology, belief, trade union or political party membership, political opinions, health, and sex life; the Enforcement Decree adds genetic information, criminal history records, biometric data used to uniquely identify a person, and race or ethnic information. That list is close to a superset of GDPR's special categories under Article 9 (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, and sex life or sexual orientation), with one notable structural exception: PIPA folds criminal records directly into the sensitive-information category that can be processed on separately obtained consent, while GDPR handles criminal-conviction data under a standalone provision, Article 10, that generally reserves processing to official authorities or requires specific member-state legal authorization rather than accepting consent as a basis for most non-authority controllers. This is a genuine, not merely semantic, difference in how the two laws treat a criminal record: PIPA's consent-eligible design is more permissive than GDPR's authority-gated one.

Separately from "sensitive information," PIPA also defines "unique identification information": the Resident Registration Number, driver's license number, passport number, and foreigner registration number. Non-RRN members of that category can be processed on either a statutory basis or consent. The RRN itself cannot -- see below.

The Resident Registration Number regime

South Korea's Resident Registration Number functions similarly to a national ID number, and PIPA treats it as close to untouchable. Article 24-2 provides that a controller shall not process an RRN at all -- and this holds even where the data subject consents -- except where a specific statute, Presidential Decree, or a National Assembly, court, election-commission, or audit-board regulation explicitly requires or permits it; where processing is manifestly necessary to protect life, body, or property from imminent danger; or in narrow PIPC-notified circumstances tracking those two categories. Where an RRN is processed under one of those exceptions, the controller must retain it "in a safe manner by means of encryption," with the specific scope and timing of that duty set by Presidential Decree according to data volume and breach impact, and must offer an alternative sign-up method for online membership registration that does not require the RRN at all.

Nothing in GDPR resembles this. GDPR does not create an EU-wide near-prohibition on processing a national identification number; instead, Article 87 leaves the conditions for processing a "national identification number" to individual member states' domestic law, so the rule (if any) varies by country rather than applying uniformly across the EEA the way PIPA's RRN ban applies uniformly across Korea. "Consent cannot authorize it" is the feature with no GDPR counterpart at all -- under GDPR, consent remains a valid basis for most categories of data, including most member-state ID-number rules; under PIPA, consent is affirmatively excluded as a basis for RRN processing.

This is a critical distinction to get right: RRN violations are enforced administratively, not criminally. Article 24-2 does not appear anywhere in PIPA's criminal chapter (Articles 70-73). Only the broader Article 24(1) provision -- covering "personally identifiable information," i.e., unique identifiers generally, not the RRN-specific rule -- carries criminal exposure under Article 71. An RRN violation instead draws an administrative fine of up to KRW 30 million for each of three separate failures: processing an RRN in violation of Article 24-2(1), failing to encrypt one as required by Article 24-2(2), or failing to offer the RRN-free alternative sign-up method required by Article 24-2(3). Processing an RRN in violation of Article 24-2(1) is also a separate trigger for PIPA's revenue-based penalty surcharge under Article 64-2, meaning the fixed KRW 30 million administrative fine and the percentage-of-revenue surcharge can both apply to the same violation, but neither route involves imprisonment.

Data Subject Rights and Automated Decisions

PIPA grants data subjects rights that broadly parallel GDPR's Chapter 3 catalog: access, correction, erasure, and the right to object to or restrict processing. A data portability right under a 2023 amendment took effect in March 2025.

The area with the most operationally interesting divergence is automated decision-making. PIPA Article 37-2 grants a data subject the right to object to a decision made by a "completely automated system" -- the statute explicitly names AI -- where that decision has a significant effect on the subject's rights or duties, along with a separate right to request an explanation of an automated decision already made. On objection or an explanation request, the controller generally must not apply the automated decision (absent a compelling reason) or must take remedial steps, including re-processing with human involvement. Controllers must also proactively disclose the criteria, procedures, and methods behind their automated decisions.

The structure differs from GDPR's Article 22 in an important way. GDPR frames the right as a default prohibition: a data subject "shall have the right not to be subject to" a solely automated decision with legal or similarly significant effects, subject to exceptions for contract necessity, legal authorization, or explicit consent, and even within those exceptions the controller must implement safeguards such as the right to obtain human intervention and to contest the decision. PIPA's Article 37-2 is structured the other way, as an opt-in objection right: the automated decision happens, and the subject can then object or request an explanation -- except the objection right does not apply where the automated decision was made under a consent, contract-necessity, or legal-obligation basis, precisely the situations where GDPR would still require safeguards. In that narrow sense PIPA's citizen-facing right is narrower than GDPR's default-prohibition model. But PIPA is also more explicit than GDPR's operative text about naming AI systems specifically and about requiring proactive disclosure of decision-making criteria, rather than leaving that detail mostly to guidance and recitals.

Supervisory Structure and Enforcement Posture

The PIPC is Korea's single, centralized data protection authority, with investigative, order, and penalty powers. GDPR enforcement is decentralized across 30-plus national supervisory authorities in the EEA, coordinated through the European Data Protection Board and a one-stop-shop mechanism for cross-border cases. In practice, the PIPC's centralized structure and its willingness to combine large administrative penalties with public disclosure orders and corrective orders gives it a more concentrated, and in the largest recent cases faster-moving, enforcement posture than the EU's multi-authority model, where the largest fines typically move through a single lead DPA (commonly Ireland's) over a longer procedural timeline.

Cross-Border Data Transfers

PIPA Article 28-8 allows a cross-border transfer only where one of five conditions is met:

1. Separate consent from the data subject, distinct from consent to general processing;
2. A specific provision in a statute, a treaty Korea is party to, or another international convention;
3. Necessity to perform a contract with the data subject, with the transfer particulars either disclosed in the privacy policy or separately communicated -- functionally similar to GDPR's Article 49(1)(b) contract-necessity derogation;
4. The recipient has obtained PIPC-designated certification and has implemented safety and rights-guarantee measures, comparable in function to GDPR's Binding Corporate Rules or certification mechanisms; or
5. The PIPC recognizes the destination country's or organization's protection system, scope of data-subject rights, and remedy procedures as "substantially equal" to PIPA's own level -- Korea's version of an adequacy decision.

The EU is the confirmed working example of that fifth mechanism. The European Commission's own adequacy decision covering Korea has been in force since December 2021, and the PIPC's reciprocal recognition of the EU framework as equivalent entered into force on September 16, 2025, per a joint press statement from the European Commission and the PIPC. That mutual arrangement means personal data can move in both directions between the EU and Korea without relying on case-by-case mechanisms such as Standard Contractual Clauses -- see our broader guide to EU adequacy decisions for how that mechanism works generally.

Where a controller relies on the separate-consent route, PIPA Article 28-8(2) requires it to inform the data subject in advance of what data will be transferred, the destination country, date and method of transfer, the recipient's name and contact details, the recipient's purpose and retention period for the data, and how to refuse the transfer and what refusing means for the subject. The contract-necessity route at Article 28-8(1)3 requires the same particulars, but disclosed in the privacy policy or separately communicated rather than as a pre-consent notice. The treaty, certification, and PIPC-equivalence routes carry no equivalent per-transfer notice duty.

The PIPC's power to order suspension of a transfer already underway has no GDPR counterpart. Under Article 28-9, the PIPC may order a controller to suspend an ongoing or imminent cross-border transfer where the transfer violates the Article 28-8 conditions, or where the recipient country or organization fails to properly protect the data compared to PIPA's own standard and the data subject has suffered, or is highly likely to suffer, damage as a result. The controller may object to the PIPC within 7 days of receiving the order. GDPR relies instead on the validity of the transfer mechanism itself -- an adequacy decision, SCCs, or BCRs -- plus after-the-fact enforcement and fines; there is no EU-level power for a regulator to issue a bespoke stop-this-transfer-now order against a specific ongoing transfer the way Article 28-9 allows.

Criminal Penalties: The Structural Differentiator

This is where PIPA and GDPR diverge most sharply, and it is the single most important thing a foreign organization operating under both laws needs to understand: PIPA is a criminal statute as well as a regulatory one. GDPR's entire penalty regime is administrative -- fines against the controller or processor entity, up to EUR 20 million or 4% of global turnover -- and there is no EU-law criminal offense for a GDPR violation itself (individual member states can criminalize related conduct under their own domestic law, but not under the GDPR text). PIPA runs a criminal track in parallel with its administrative one, and the same underlying conduct can trigger both at once.

PIPA's Penal Provisions chapter sets out four tiers of imprisonment:

Who can be held liable -- Article 74's joint penalty provision. If a corporation's representative, agent, employee, or other worker commits an Article 70 offense in connection with the corporation's or individual business owner's business, both the individual offender and the corporation or business owner are punished: the corporation or owner faces a fine up to KRW 70 million for an Article 70 offense, or the fine amount prescribed by the relevant article for an Article 71-73 offense. The one carve-out is a due-care defense -- Article 74 does not apply if the corporation or individual owner was not negligent in exercising due care and supervision to prevent the offense. This is the provision to point to when the question is "can the business itself be fined alongside the employee who actually committed the violation" -- under PIPA, yes, absent a documented compliance program defense. GDPR has no equivalent; its liability model is corporate and administrative only, with no track for personally fining or imprisoning the individual who committed the underlying act.

The dual exposure this creates is real, not theoretical: unauthorized third-party disclosure without consent is a criminal offense under Article 71 (up to 5 years or KRW 50 million) for the individual or responsible officer, and the same disclosure can separately trigger the revenue-based penalty surcharge under Article 64-2 against the company. Prison exposure for the person and a percentage-of-revenue fine for the company, arising from the same act, is the genuine structural rarity that sets PIPA apart from GDPR.

Administrative Penalties and the Ceiling Change

PIPA's administrative track runs on a revenue-based penalty surcharge under Article 64-2, separate from the criminal fines above and from the RRN-specific fixed fines described earlier. As of today, the operative ceiling is 3% of total sales, or up to KRW 2 billion where sales figures do not exist or cannot be calculated. Triggers for the surcharge include unlawful processing under the law's core processing articles, collecting a child under 14's data without parental consent, processing sensitive information without consent, personally-identifiable-information or RRN processing violations, negligent oversight of an entrusted processor that causes it to violate the Act, unlawful re-identification of pseudonymized data, unlawful cross-border transfer or defiance of a transfer-suspension order, and a data breach where the controller did not take all statutorily required safety measures.

A 2026 amendment raises that ceiling to 10% of total revenue, but only in specific aggravated circumstances: repeated violations involving willful misconduct or gross negligence within a 3-year period, violations affecting 10 million or more data subjects, or failure to comply with a PIPC corrective order. The amendment was promulgated around March 10, 2026, but its penalty-ceiling provisions do not take effect until September 11, 2026. Until that date, 3% remains the governing ceiling for every enforcement action, including the record-setting Coupang penalty described below, which was calculated under the current 3% regime. Any statement that Korea's penalty ceiling is already 10% is describing a future rule as though it were current law.

Recent Developments

Coupang, June 11, 2026. The PIPC's resolution imposed on Coupang a penalty surcharge of KRW 624.681 billion -- KRW 423.575 billion for the breach itself and KRW 201.106 billion for the unlawful collection of online behavioral data -- plus a separate administrative fine of KRW 16.8 million for late breach notification and failure to destroy personal information, alongside correction and public-disclosure orders. Coupang Fulfillment Services was separately fined KRW 248 million: KRW 220 million for maintaining an unlawful employment-restriction list and KRW 28 million for using employees' health-check data in court filings without separate consent.

SK Telecom, August 28, 2025. The prior record: approximately KRW 134.7 billion (roughly US$89-97 million) over a USIM/SIM-key breach affecting 23.2-23.5 million subscribers involving unencrypted SIM authentication keys, plus a separate fine for delayed breach notification.

Data portability. A data portability right added by a 2023 amendment took effect in March 2025, giving PIPA a rights catalog closer to full parity with GDPR Chapter 3.

2026 penalty-ceiling amendment. The 3%-to-10% change described above was promulgated around March 10, 2026, with the higher ceiling not taking effect until September 11, 2026.

Dual-Compliance Guidance

Organizations subject to both PIPA and GDPR should treat the following as the areas most likely to require a structural, not just a documentation, response.

Disclaimer

This article presents general legal information about South Korea's Personal Information Protection Act (PIPA) and the EU General Data Protection Regulation (GDPR). It does not constitute legal advice. PIPA continues to change through amendment; the 10% penalty-ceiling provision described above is not yet in force as of this writing. Organizations subject to PIPA or GDPR should consult a lawyer licensed in the relevant jurisdiction for advice specific to their situation.

Authorities Cited

1. PIPA Article 70 (Penal Provisions -- top criminal tier), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
2. PIPA Article 71 (Penal Provisions -- 5-year/KRW 50M tier), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
3. PIPA Article 72 (Penal Provisions -- 3-year/KRW 30M tier), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
4. PIPA Article 73 (Penal Provisions -- 2-year/KRW 20M tier), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
5. PIPA Article 74 (Joint Penalty Provisions -- corporate/individual dual liability, due-care defense), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
6. PIPA Article 24 (Restriction on Processing of Personally Identifiable Information), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
7. PIPA Article 24-2 (Restriction on Processing of Resident Registration Numbers), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
8. PIPA Article 37-2 (Right relating to automated decisions), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
9. PIPA Article 28-8 (Cross-border transfer mechanisms), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
10. PIPA Article 28-9 (PIPC order to suspend cross-border transfer), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
11. PIPA Article 64-2 (Penalty surcharge -- current 3% ceiling and 2026 amendment), Korea Legislation Research Institute official English translation. https://elaw.klri.re.kr/eng_mobile/viewer.do?hseq=62389&type=part&key=1
12. Personal Information Protection Commission (PIPC), Republic of Korea. https://www.pipc.go.kr/eng
13. Personal Information Protection Commission. Press release, The PIPC Sanctions Coupang and CFS for Data Breaches and Infringements on Privacy, June 11, 2026. https://www.pipc.go.kr/eng/user/ltn/new/noticeDetail.do?bbsId=BBSMSTR_000000000001&nttId=3071
14. European Commission. Joint press statement, Commissioner Michael McGrath and PIPC Chairperson Haksoo Ko, entry into force of Korea-EU reciprocal recognition, September 16, 2025. https://commission.europa.eu/news-and-media/news/joint-press-statement-commissioner-michael-mcgrath-and-chairperson-haksoo-ko-entry-force-korean-2025-09-16_en
15. European Commission. Adequacy Decisions. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
16. Regulation (EU) 2016/679 (General Data Protection Regulation). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
17. DLA Piper. Data Protection Laws of the World -- South Korea. https://www.dlapiperdataprotection.com/guide.pdf?c=KR
18. Hunton Andrews Kurth Privacy and Cybersecurity Law Blog. South Korea Amends Privacy Law to Authorize Fines of Up to 10% of Total Revenue. https://www.hunton.com/privacy-and-cybersecurity-law-blog/south-korea-amends-privacy-law-to-authorize-fines-of-up-to-10-of-total-revenue

---

Laws and enforcement figures cited reflect their status as of the article's last review date. PIPA's 10% penalty-ceiling provision is scheduled to take effect September 11, 2026 and is not in force as of this writing.