The framework
South Korea regulates personal data through the Personal Information Protection Act (PIPA), dating from 2011 and supervised by the Personal Information Protection Commission.
For advertisers the consent posture matters most, and South Korea sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Personal Information Protection Act (PIPA), overhauled 2023
Korea's PIPA is one of Asia's strictest and most actively enforced regimes, and 2026 raised the stakes twice. In June the PIPC imposed a record KRW 624.7B on Coupang, including KRW 201.1B for collecting 11.17 million members' activity on third-party sites through its Coupang Partners affiliate program. In September an amendment took effect allowing fines of up to 10% of total revenue for the worst cases. Marketing consent must be separate, specific and unbundled from service consent, a line the PIPC drew with its 2022 fines on Google (KRW 69.2B) and Meta (KRW 30.8B).
Marketing and advertising
Consent-centric with tightly drawn alternatives; separate opt-in consent for marketing use and for sensitive data. The 2023 amendment eased contract-necessity processing but marketing still runs on consent. Most channel decisions here follow from that consent rule.
Cross-border transfers
Consent, contract necessity, certification, or destination adequacy recognized by the PIPC. Korea holds EU adequacy.
Enforcement and penalties
Up to 3% of total revenue, excluding revenue shown to be unrelated; from September 2026, up to 10% for repeat intentional violations, incidents affecting 10 million or more people, and breaches after an ignored corrective order.