PIPA Articles 28-9 and 28-10: the regulator can suspend a transfer, and reciprocity can restrict transfers to restricting countries (Personal Information Protection Act (Korea), Act No. 20897, 1 Apr. 2025 (English translation by the Korea Legislation Research Institute), Arts. 28-9(1) and 28-10)

Korea has no general ban on sending data abroad, but the Protection Commission can order a transfer suspended where the Act was breached or the recipient does not protect the data. Controllers in a country that restricts transfers can be restricted to the same degree.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text

In the source's own words

“The Protection Commission may order a personal information controller to suspend cross-border transfers of personal information in any of the following cases where the cross-border transfer of personal information is ongoing or where any further cross-border transfer is expected: ... personal information controllers in a country that restricts cross-border transfers of personal information may be subject to restrictions at a level equivalent to those imposed by the country”

Where it was read

PIPA Articles 28-9 and 28-10: the regulator can suspend a transfer, and reciprocity can restrict transfers to restricting countries, South Korea, checked 18 Oct 2026
Everything read from this source (5)