What must be included in a privacy policy?

What the Law Says

South Korea’s Personal Information Protection Act (PIPA) sets strict requirements for privacy policies to ensure transparency and accountability in personal data handling.

Under PIPA, operators of personal information processing systems must publicly disclose a privacy policy that clearly explains how personal information is collected, used, stored, and shared.

The policy must specify the purpose of collection, categories of personal information processed, retention periods, recipients of shared data (including third parties), and procedures for exercising data subject rights such as access, correction, deletion, and consent withdrawal.

If personal information is transferred overseas, the policy must state the destination country, recipient’s name, purpose of transfer, and safeguards applied — and obtain separate consent unless an exception applies.

Operators must notify data subjects of any material changes to the privacy policy at least seven days before implementation, unless urgent circumstances require immediate updates.

Statutory Text

The personal information controller shall notify the data subject of the items prescribed by Presidential Decree, including the purpose of collecting and using personal information, the items of personal information to be collected, the retention and use period of personal information, and matters concerning the provision of personal information to a third party.

— Personal Information Protection Act, Art. 15 — Obligation to Notify Data Subjects

Statutory Text

Where the personal information controller intends to change the matters notified pursuant to Article 15, it shall notify the data subject thereof at least seven days prior to such change.

— Personal Information Protection Act, Art. 16 — Notification of Changes to Notified Matters

What to Do

Sources