language: en · source language: ko · status: in-force · last checked: 2026-09-20

South Korea — Personal Information Protection Act (개인정보 보호법)

Korea's omnibus privacy law, heavily amended in 2020 (absorbing the Network Act's privacy chapter) and 2023. It applies to public institutions (schools included) and private processors alike. Curated here: the lawful-basis catalogue, the children's provision, and the Enforcement Decree (대통령령) that makes both operational.

Statute text is Korean (the authentic language); this README is curation.

Applicability to EdTech

• Child consent age is 14 (제22조의2): processing a child under 만 14세 requires legal-representative consent, and the processor must verify it (제1항); minimal data may be collected from the child solely to obtain that consent (제2항); notices to under-14s must use plain, easily understood language (제3항).
• The Decree says how to verify guardian consent, and that is the part a product has to build (시행령 제17조의2 제1항). Seven permitted methods, each requiring a positive act by the legal representative: an on-site consent indication confirmed by SMS to the representative's mobile; the same plus card details; the same plus mobile identity verification; a signed paper form delivered by hand, post or fax; an exchange of email; a two-call telephone process; or an equivalent method that both informs the representative and confirms the expression of consent. There is no "tick a box saying you are over 14" option in the list.
• Processor terms are prescribed by the Decree, not left to contract (시행령 제28조) — the outsourcing document must state the purpose and scope, restrictions on processing, technical and managerial safeguards, and the supervisory arrangements. Read it before drafting a Korean data-processing addendum.
• The security standard is itemised (시행령 제30조): an internal management plan established, operated and audited; access-rights limitation; access control; secure storage and transmission; retention of access logs with forgery/alteration prevention for incident response; anti-malware capable of continuous checking and remediation; and physical measures such as a secure store or lock. This is the list a Korean school's security questionnaire is derived from.
• Lawful bases (제15조): consent, statute, public-institution duties, contract necessity, vital interests, and a legitimate-interest ground that applies only where the controller's interest clearly overrides the data subject's rights ("명백하게 정보주체의 권리보다 우선하는 경우") — narrower than GDPR Art. 6(1)(f).
• Korea holds an EU adequacy decision (2021), so EEA→KR transfers within a school group are covered; the reverse (KR student data processed by us) sits under PIPA's own cross-border rules (제28조의8, not extracted — add on demand).
• Fines: PIPA's 2023 amendment moved to turnover-based penalty surcharges (과징금, up to 3% of related turnover) — README-level note; extract 제64조의2 on demand.

Contents

Enforcement

개인정보보호위원회 (Personal Information Protection Commission, PIPC, pipc.go.kr).

Licence

The corpus reproduces selected articles of the 개인정보 보호법 and its 시행령 (an enforcement decree, a 명령 within 제7조) in Korean from the 국가법령정보센터, the Ministry of Government Legislation's official database.

Korean copyright law places statutes and decrees outside its protection. 저작권법 제7조 (국가법령정보센터 — 저작권법, read 2026-10-01 through the 국가법령정보센터 DRF API) provides: "다음 각 호의 어느 하나에 해당하는 것은 이 법에 의한 보호를 받지 못한다. 1. 헌법ㆍ법률ㆍ조약ㆍ명령ㆍ조례 및 규칙 2. 국가 또는 지방자치단체의 고시ㆍ공고ㆍ훈령 그 밖에 이와 유사한 것 [...] 4. 국가 또는 지방자치단체가 작성한 것으로서 제1호부터 제3호까지에 규정된 것의 편집물 또는 번역물"

Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (the 국가법령정보센터). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.

Related

• KR 초·중등교육법 — student records & NEIS
• KR 교육기본법 — student-information principles
• KR Network Act — commercial-message opt-in

Sources

• 국가법령정보센터 — 개인정보 보호법
• PIPC