REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the first review of the functioning of the adequacy decision for the Republic of Korea
Date: 2026-07-23
Institutions: Directorate-General for Justice and Consumers, European Commission
Subjects: South Korea, cross-frontier data flow, data protection, data-processing law, exchange of information, personal data, protection of privacy

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 23.7.2026  COM(2026) 384 final  REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the first review of the functioning of the adequacy decision for the Republic of Korea {SWD(2026) 231 final}  
 
 
REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE 
COUNCIL  

on the first review of the functioning of the adequacy decision for the Republic of Korea 

1.  THE FIRST REVIEW – BACKGROUND, PREPARATION AND PROCESS 

On 17 December 2021 the European Commission  adopted a decision pursuant to Article 45  of 
Regulation  (EU)  2016/679  (GDPR)1 in  which  it  found  that  the  Republic  of  Korea  ensures  an 
adequate  level  of  protection  for  personal  data  transferred  from  the  European  Union 2  (“the 
adequacy decision”). As a result, data transfers from the EU to the Republic of Korea can take 
place without additional requirements.  

The Commission’s adequacy decision covers the Personal Information Protection Act (“PIPA”3) 
as  complemented  by  the  additional  safeguards  set  out  in  Annex  I  to  the  adequacy  decision 
(“Supplementary  Rules” 4).  These  safeguards  clarify  the  application  of  the  purpose  limitation 
principle  in  the  context  of  data  transferred  from  the  EU  to  a  Korean  data  controller,  introduce 
notification  obligations  when  personal  data  is  not  obtained  directly  from  the  data  subject 
concerned, and clarify the conditions for when the Personal Information Protection Commission 
(PIPC) can impose corrective measures and how the PIPA applies to the processing of personal 
data  for  national  security  purposes.  The  Supplementary  Rules  are  legally  binding  on  personal 
information controllers in the Republic of Korea and enforceable by both the PIPC and courts5. 

The  Korean  government  furthermore  provided  official  representations,  assurances  and 
commitments to the Commission on the limitations and safeguards with respect to access to, and 
use  of,  personal  data  by  Korean  public  authorities  for  criminal  law  enforcement  and  national 
security purposes, clarifying that any such processing  is limited to what is strictly necessary to 
achieve the legitimate objective, and that effective legal protection against any interference exists6. 

Since the adoption of the adequacy decision, the Republic of Korea and the EU, as like-minded 
partners, have further intensified their cooperation on digital matters in general and on data flows 
more specifically.  

At bilateral level, this is in particular reflected in the adoption of an equivalence recognition for 
the  European  Union  by  the  Republic  of  Korea,  which  recognises,  under  the  Korean  legal 
framework, that the EU ensures a level of protection for personal data that is equivalent to the one 

1 OJ L 119, 4.5.2016, p. 1 (GDPR) 
2 OJ L 44, 24.2.2022, pp. 1–90  
3 The PIPA provides the general legal framework for data protection in the Republic of Korea. 
4 Specific rules put in place by Korea to bridge certain relevant differences between the PIPA and the GDPR specified 
in Annex I to the adequacy decision (Notification No 2021-5). 
5 See recital 12 of the adequacy decision.  
6 Recitals 144 – 208 and Annex II of the decision. 

1 

 
 
 
 
provided in the Republic of Korea, and thus allows the free flow of personal data from the Republic 
of Korea to the EU. This is the first equivalence recognition adopted by the Republic of Korea. It 
entered into force on 16 September 2025 and was jointly announced in Seoul by EU Commissioner 
McGrath and the former Chairperson of the PIPC, Mr Haksoo Ko. The equivalence recognition 
covers both the public and the private sectors and extends to the entire EEA7.  

The  mutual  adequacy  arrangement  between  the  EU  and  Korea  complements  and  amplifies  the 
benefits  of  the  EU-Republic  of  Korea  Free  Trade  Agreement  of  2011  and  the  Digital  Trade 
Agreement  of  10  March  2025 8  for  companies  in  the  EU  and  in  the  Republic  of  Korea.  The 
unrestricted  flow  of  personal  data  between  both  jurisdictions  further  facilitates  commercial 
exchanges and generates business prospects through privileged market access. Furthermore, it also 
serves as an important precedent, demonstrating that robust data protection standards and global 
trade facilitation are not only compatible but essential in today’s digital economy.  

At  multilateral  level,  the  Republic  of  Korea  and  the  EU  have  successfully  cooperated  in 
international fora, for instance at the Organisation for Economic Co-operation and Development 
(OECD),  where  this  close  cooperation  was  essential  for  the  adoption,  for  the  first  time  ever  at 
international  level,  of  common  principles  on  government  access  to  personal  data  held  by  the 
private  sector9.  This  work  relied  on  the  shared  values  and  requirements  underpinning  the  EU-
Korea mutual adequacy arrangement. Moreover, this strong collaboration is also reflected in the 
PIPC’s active participation in  the  European  Commission’s  Adequacy Network,  of which it has 
been part since its establishment on 4 March 202410.  

To regularly verify that the findings in the adequacy decision continue to be factually and legally 
justified, the Commission is required to carry out a periodic review and report on the outcome to 
the European Parliament and the Council. This report, which covers all aspects of the functioning 
of the adequacy decision, concludes the first periodic review. On the Korean side, representatives 
from the Korean data protection authority, the PIPC, and the Korea Internet and Security Agency 
(KISA)  were involved in  the review.  The  PIPC was also  in  regular contact  with  other relevant 
Korean institutions to prepare the review and gather their input. The EU delegation included four 

into 

force  of 

the  entry 

7 See Joint Press Statement of 16 September 2025 by Commissioner Michael McGrath and Chairperson Haksoo Ko 
on 
the  EU  –  available  under: 
the  Korean  adequacy  decision  on 
https://commission.europa.eu/news-and-media/news/joint-press-statement-commissioner-michael-mcgrath-and-
chairperson-haksoo-ko-entry-force-korean-2025-09-16_en 
8 https://ec.europa.eu/commission/presscorner/detail/en/ip_25_732 
9 OECD Declaration on Government Access to Personal Data Held by Private Sector Entities of 14 December 2022: 
https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0487 
10 On 4 March 2024, the Commission hosted the first ever high-level meeting on safe data flows, uniting ministers 
and heads from the data protection authorities of the then 15 EU-adequate countries and territories as well as the Chair 
of the European Data Protection Board to strengthen cooperation on data protection enforcement and maximise safe 
and free cross-border data flows. Subsequent meetings at technical level have taken place in the interim. 

2 

 
 
 
 
representatives from the European Data Protection Board (EDPB), alongside with representatives 
from the European Commission. 

A review meeting between the two delegations took place on 17 October 2025 that was preceded 
and  followed-up  by  numerous  exchanges.  To  prepare  the  review,  the  Commission  gathered 
information  from  the  Korean  authorities  on  the  functioning  of  the  decision,  in  particular  the 
implementation  of  the  Supplementary  Rules.  The  Commission  also  sought  information  from 
relevant stakeholders and public sources. Further to the review meeting, the Commission and the 
PIPC had several exchanges to follow-up in more detail on matters that were discussed during the 
review  meeting,  in  particular  questions  related  to  the  recent  amendments  of  the  PIPA  and  the 
interplay with the Supplementary Rules.  

2.  MAIN FINDINGS 

The  detailed  findings  concerning  the  functioning  of  all  aspects  of  the  adequacy  decision  are 
presented in the Commission Staff Working Document (SWD(2026) 231) which accompanies the 
present report. 

In particular, the first review has demonstrated that the EU and Korean data protection frameworks 
have further converged since the adoption of the adequacy decision. Since then, the Republic of 
Korea has amended the PIPA in two occasions: in March 2023 and in April 202511. The PIPC, in 
close  consultation  with  the  Commission,  has  adapted  the  Supplementary  Rules  to  reflect  these 
amendments.  

The 2023 amendments  to  Korea's PIPA have  further  strengthened the country's data protection 
framework by expanding its scope, clarifying key principles, and introducing new safeguards. Key 
areas of improvement include the principle of lawfulness, with revised legal bases for processing 
and  clearer  provisions  regarding  situations  requiring  separate  consent.  Transparency  has  been 
improved in two key ways: first, by introducing new requirements for data controllers to warn data 
subjects about potential data protection risks; second, by imposing strengthened obligations for 
the State and local governments to take measures to protect the personal data of children under the 
age of 14 and ensure that they can clearly understand the impact of personal data processing and 
their  rights  as  data  subjects.  Accountability  has  also  been  strengthened  by  introducing  a 
requirement  for  foreign  controllers  to  appoint  a  domestic  agent  in  Korea.  Moreover,  the 
amendments  have  tightened  restrictions  on  processing  pseudonymised  data,  introduced  new 
obligations to destroy such data once it is no longer necessary, and ensured further transparency 
about pseudonymised data processing.  

Since  the  adoption  of  the  adequacy  decision,  data  subject  rights  have  also  been  further 
strengthened.  The  2023  PIPA  reform  introduced  new  protections  and  reinforced  existing  ones, 
including the right to withdraw consent, safeguards against automated decision-making, and the 

11 Respective entry into force in September 2023 and October 2025. 

3 

 
 
 
right to data portability, ultimately empowering individuals to exercise greater control over their 
personal data.  

The amendments to PIPA since the adequacy decision have also further strengthened its rules on 
international data transfers, introducing a more robust framework that provides stronger safeguards 
for the protection of personal data transferred outside the Republic of Korea. 

As regards oversight and enforcement, the Commission notes that the PIPC has actively enforced 
PIPA since the adoption of the adequacy decision, with enforcement action including imposing 
fines on Google and Meta for illegal data collection, investigating cross-border data transfers by 
companies  such  as  DeepSeek  and  AliExpress,  and  enforcing  rules  on  cybersecurity  and  data 
breaches. The PIPC has also been providing regulatory guidance, conducting sectoral checks, and 
engaging  in  awareness-raising  activities  and  international  cooperation  with  EU  data  protection 
authorities, including the French Commission nationale de l’informatique et des libertés (CNIL) 
and the EDPB, to further strengthen data protection in the Republic of Korea. 

It is particularly noteworthy that some of the existing Supplementary Rules contained in Annex I 
to the adequacy decision are now reflected in the PIPA, thus making them generally applicable to 
all  personal  data,  irrespective  of  their  origin  or  point  of  collection.  As  a  result,  the  relevant 
Supplementary Rules will be revoked. Specifically, this will be the case for Supplementary Rule 
2, which  established a  limitation  for  onward transfers of personal  data, Supplementary Rule 4, 
which  related  to  the  scope  of  application  of  a  special  exemption  for  the  processing  of 
pseudonymised  information,  and  the  first  part  of  Supplementary  Rule  5,  which  concerned  the 
possibility of the PIPC to adopt corrective measures. The other Supplementary Rules will remain 
in force.  

The revocation of these specific Supplementary Rules is an important positive development, as it 
reflects the increased convergence between the EU and Korea's data protection frameworks. The 
new  provisions  in  the  PIPA  establishing  stricter  requirements  for  cross-border  transfers  and 
clarifying  the  exceptions  on  transparency  and  individual  rights  for  pseudonymised  data 
demonstrate  Korea's  commitment  to  further  strengthening  its  data  protection  framework.  The 
Commission  welcomes  that  the  PIPC  has  also  taken  an  active  stance  in  enforcing  the  new 
provisions, adopting decisions and sanctions to ensure compliance with the rules on international 
data transfers and pseudonymisation. 

Regarding the access and use of personal data by the authorities of the Republic of Korea, since 
the  adoption  of  the  adequacy  decision,  Korea  has  amended  some  key  laws  to  enhance  the 
protection  of  personal  data,  including  the  Telecommunications  Business  Act  and  the 
Communications  Privacy  Protection  Act.  In  particular, 
introduced  new  notification 
requirements,  oversight  measures,  and  procedural  safeguards.  In  addition,  the  PIPC  has 
strengthened its oversight and promoted data protection principles through guidelines for public 
authorities. These developments demonstrate Korea's ongoing efforts to strengthen the safeguards 

it 

4 

 
 
for personal data, including when it is processed for purposes of criminal law enforcement and 
national security. 

3.  CONCLUSION 

Based on the overall findings made as part of this first review, the Commission concludes that the 
Republic of Korea continues to ensure an adequate level of protection for personal data from the 
European Union to entities in the Republic of Korea subject to the PIPA, as complemented by the 
additional safeguards set out in the Supplementary Rules, together with the official representations, 
assurances and commitments contained in Annex II to the adequacy decision. In this context, the 
Commission acknowledges and highly appreciates the excellent cooperation, in the conduct of the 
review, with the Korean authorities, and in particular the PIPC. 

In light of this outcome of the review and in line with recitals 219 and 220 of the adequacy decision, 
the Commission considers that there is no need to maintain the three years-cycle for future reviews 
and therefore considers that it is appropriate to move to a four years-cycle pursuant to Article 45(3) 
of the GDPR. It will consult the Committee established under Article 93(1) of the GDPR on this 
point12. 

At the same time, the strengthening of certain aspects of the Korean data protection framework 
could contribute to further enhancing the safeguards set out in the PIPA and the Supplementary 
Rules. To this end, the Commission makes the following recommendations:  

1.  The Commission encourages the PIPC to carry out random checks to ensure compliance 
with  the  Supplementary  Rules.  In  the  Commission’s  view,  random  checks  of  this  kind 
would be important to ensure that (potential) violations of the Supplementary Rules are 
detected and addressed, thereby ensuring effective compliance with these rules. 

2.  The Commission welcomes the fact that the PIPC plans to publish updated guidelines on 
international transfers, as they will increase the accessibility of the PIPA rules on this topic 
and make these rules more user-friendly. The Commission invites the PIPC to clarify that 
the APEC CBPR and CBPR (Cross-Border Privacy Rules) certification schemes are not 
recognised as a mechanism for transfers of personal data under PIPA rules. 

3.  As  mentioned  in  the  Staff  Working  Document  accompanying  this  report,  it  is  also 
important that the PIPC’s website clearly displays the tools that are valid for international 
data transfers, in both English and Korean, to ensure clarity with respect to the applicable 
rules.  

The review also made it possible to identify areas for possible future cooperation. For instance, 
given  the  growing  importance  of  model  clauses  and  their  potential  as  a  global  tool  for  data 

12 See Recital 220 of the decision. 

5 

 
 
 
 
 
transfers, as recognised for example by the G7 and the OECD, the Commission has indicated its 
interest in future cooperation with the PIPC in developing clauses of this kind.  

The Commission will continue to closely monitor the Korea data protection framework and actual 
practice.  In  this  regard,  it  looks  forward  to  future  exchanges  with  the  Korean  authorities  on 
developments  relevant  to  the  decision,  as  well  as  to  further  strengthening  cooperation  at 
international level at a time where there is an increasing demand for global standards on privacy 
and data flows. 

6