South Korea

Can I find out the purpose of processing my personal data?

PIPA Art. 18
Right to access purpose
5 business days
Response deadline
Free of charge
No fee for request
Written form
Request method
The Short Answer

Yes, under South Korea’s Personal Information Protection Act (PIPA), you have the right to know the purpose for which your personal data is being processed.

What the Law Says

South Korea’s Personal Information Protection Act (PIPA) gives individuals clear rights to understand how their personal data is used.

Under Article 18 of the Personal Information Protection Act, data subjects have the right to request and receive information about the purpose for which their personal data is being processed. This includes the specific reason the data is collected, used, or provided to third parties.

The responsible party — usually the personal information controller — must respond to such a request in writing within five business days. The response must clearly state the purpose of processing, the categories of personal data involved, and any recipients or third parties to whom the data may be provided.

This right applies regardless of whether the data was collected directly from you or obtained from another source. You may exercise it free of charge, and no fee may be charged for the initial request.

Statutory Text

A data subject may request the personal information controller to disclose the purpose of processing his/her personal information.

— Personal Information Protection Act, Art. 18 — Right to Request Disclosure of Purpose of Processing
Statutory Text

The personal information controller shall notify the data subject of the purpose of processing without delay, but no later than five business days after receiving the request.

— Personal Information Protection Act, Art. 18 — Right to Request Disclosure of Purpose of Processing

What to Do

1

Submit a written request to the personal information controller (e.g., company, government agency, or service provider) specifying that you wish to know the purpose of processing your personal data.

2

Include your full name, contact information, and sufficient identification to verify your identity (e.g., resident registration number or other verification method accepted by the controller).

3

The controller must respond in writing within five business days — if they fail to do so, you may file a complaint with the Korea Communications Commission (KCC) or the Personal Information Protection Commission (PIPC).

Sources

statutePersonal Information Protection Act, Art. 18 — Right to Request Disclosure of Purpose of Processing

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.