Data Privacy and Information Security
What this domain tests
The Personal Information Protection Act (개인정보보호법), the Credit Information Act (신용정보법), electronic financial transaction security rules including 망분리, and the cross-border transfer of policyholder data - a live issue for every foreign branch.
Core rules
- Consent must be specific, separate and granular; bundling consent for marketing with consent for processing is invalid, and sensitive information (health data in underwriting) needs separate consent or a statutory basis.
- Cross-border transfer under PIPA Article 28-8 requires a lawful basis: separate consent after notification of the recipient, purpose, items, retention and the method of refusal; or an adequacy decision, contractual safeguards or certification.
- 가명정보 (pseudonymised data) may be used for statistics, research and public interest without consent, but re-identification is prohibited and combination requires a review process.
- Security duties include access control, encryption of unique identifiers, 망분리 for electronic financial transactions, and ISMS-P certification where thresholds are met.
- Breaches must be notified to affected individuals and the regulator promptly, with shorter deadlines for large-scale or telecommunications-related incidents.
Worked example
Group headquarters asks for the full claims dataset of Korean policyholders to build a pricing model. Before transfer: confirm whether the data can be pseudonymised; if identifiable data must move, obtain separate cross-border consent or rely on a recognised safeguard; notify the specific items and retention period; and document the transfer. Sending the file under a group data-processing agreement alone is not a valid basis under Korean law.
Traps that cost marks
- Treating an intra-group data transfer as internal processing.
- Assuming pseudonymised data is equivalent to anonymous data.
- Relying on the parent's global privacy notice to satisfy Korean consent requirements.