korea-pipa

Guides compliance with South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법). Covers pseudonymisation framework, notification requirements, PIPC enforcement, consent standards, and cross-border transfer rules under the 2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation, consent, cross-border transfers.

الانتقال إلى التثبيت

المستودع: ThomasMoreAI/legal-skills-open
آخر نشاط في المصدر: ١ يونيو ٢٠٢٦ في ١٧:٢٧
لغة SKILL.md المكتشفة: الإنجليزية
النجوم: ٤٠
التفرعات: ٤

خيارات التثبيت

يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.

التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.

يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.

npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill korea-pipa

يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.

تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.

مراجعة ملفات المصدر

اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.

SKILL.md

تعليمات المصدر · معاينة للقراءة فقط

العودة إلى البحث العودة إلى التثبيت

fetching-arbitration-rules

Use when retrieving arbitration institutional rules (ICC, LCIA, SCC, SIAC, HKIAC, VIAC, МКАС/МАК при ТПП України, UNCITRAL) — fetching current version, verifying redaction applicable to the date of arbitration agreement, constructing URLs for official rule texts

2026-06-12

determining-pl-request-regime

Use when choosing the Polish legal regime for letters, requests, applications, complaints, petitions, public-information requests, KPA filings, PPSA complaints, RODO access requests, registry extracts, court-file access, tax/ZUS/cudzoziemcy/USC procedures, or professional lawyer letters. Prevents mixing UDIP, KPA, PPSA, RODO, registry, special-procedure, and advocate/radca letter regimes.

2026-06-12

applying-new-york-convention

Use when preparing applications for recognition and enforcement of foreign arbitral awards in Poland, applications for setting aside arbitral awards under KPC art. 1205–1211, or opposing such applications — mapping Article V of the 1958 New York Convention to art. 1214–1215 of the Polish KPC, identifying grounds for refusal, structuring public policy arguments

2026-06-12

عرض الكل من هذا المستودع

name	korea-pipa
title	South Korea PIPA Compliance
description	Guides compliance with South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법). Covers pseudonymisation framework, notification requirements, PIPC enforcement, consent standards, and cross-border transfer rules under the 2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation, consent, cross-border transfers.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/korea-pipa
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	kr
practice	data-protection
language	en

Requirement	PIPA Provision	Detail
Informed consent	Art. 15(2)	Must disclose: purpose, items collected, retention period, right to refuse and consequences
Separate consent	Art. 22(1)	Consent for processing beyond the purpose must be separated from other consent items
Clear distinction	Art. 22(1)	Important content must be clearly displayed (larger font, colour, bold)
Opt-in for marketing	Art. 22(2)	Marketing purpose collection requires separate opt-in consent

name	korea-pipa
title	South Korea PIPA Compliance
description	Guides compliance with South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법). Covers pseudonymisation framework, notification requirements, PIPC enforcement, consent standards, and cross-border transfer rules under the 2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation, consent, cross-border transfers.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/korea-pipa
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	kr
practice	data-protection
language	en

Requirement	PIPA Provision	Detail
Informed consent	Art. 15(2)	Must disclose: purpose, items collected, retention period, right to refuse and consequences
Separate consent	Art. 22(1)	Consent for processing beyond the purpose must be separated from other consent items
Clear distinction	Art. 22(1)	Important content must be clearly displayed (larger font, colour, bold)
Opt-in for marketing	Art. 22(2)	Marketing purpose collection requires separate opt-in consent

Basis	Article	Description
Consent	Art. 15(1)(1)	Data subject's consent obtained per Art. 22
Legal obligation	Art. 15(1)(2)	Special provisions in laws or compliance with legal obligations
Public institution duty	Art. 15(1)(3)	Necessary for public institutions to perform statutory duties
Contract performance	Art. 15(1)(4)	Necessary for contract with data subject
Legitimate interest	Art. 15(1)(6)	Necessary for legitimate interest of the data handler, where substantially related to the purpose and within the data subject's reasonable expectations (added 2023)
Urgent necessity	Art. 15(1)(5)	Urgently necessary for life, body, or property of the data subject or third party

korea-pipa

خيارات التثبيت

مراجعة ملفات المصدر

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

Consent for Sensitive Information (Art. 23)

2023 Amendment: Consent Alternatives (Art. 15(1))

Pseudonymisation Framework (Arts. 28-2 to 28-7)

Permitted Uses of Pseudonymised Information (Art. 28-2)

Combination of Pseudonymised Information (Art. 28-3)

Safety Measures for Pseudonymised Information (Art. 28-4)

Zenith Global Enterprises Pseudonymisation Register

Cross-Border Transfer Rules

Transfer Mechanisms (Art. 28-8, as amended 2023)

PIPC Adequacy Recognitions

Notification Requirements for Cross-Border Transfer (Art. 28-8(3))

PIPC Enforcement

Administrative Penalties

Notable PIPC Enforcement Actions

Data Subject Rights

Breach Notification (Art. 34)

Compliance Programme

Measure	Requirement
Separation of additional information	Additional information enabling re-identification must be stored and managed separately
Technical safeguards	Encryption or equivalent protection for additional information
Access restrictions	Designation of authorised personnel; access logging
Prohibition on re-identification	Prohibited from using pseudonymised information to re-identify individuals; if re-identification occurs accidentally, immediate destruction or cessation of processing required

Data Set	Purpose	Pseudonymisation Method	Additional Information Storage	PIPC Compliance
Customer shipping patterns	Statistical analysis of route optimisation	k-anonymity (k=5) with generalisation of location data	Key mapping table stored in HSM, separate from analytics environment	Compliant
Employee performance metrics	Industrial research on workforce productivity	Tokenisation of employee identifiers	Token-identifier mapping in isolated database with MFA access	Compliant
Logistics volume trends	Public interest statistical reporting	Aggregation to postal code level with suppression of groups < 10	No additional information retained (anonymised output)	Not applicable (anonymised)

Mechanism	Article	Detail
Consent	Art. 28-8(1)(1)	Data subject's consent with disclosure of: recipient, destination country, transfer purpose, PI items, right to refuse and consequences
Contract necessity	Art. 28-8(1)(2)	Transfer necessary for contract with data subject
Adequacy recognition	Art. 28-8(1)(3)	Transfer to a country or international organisation recognised by the PIPC as having adequate protection
Standard contractual clauses	Art. 28-8(1)(4)	PIPC-approved standard contractual clauses between the parties
BCR equivalent	Art. 28-8(1)(4)	PIPC-approved data protection rules within a corporate group
PIPC certification	Art. 28-8(1)(5)	Recipient certified by a PIPC-designated certification body

Transfer ID	Flow	Destination	Mechanism	Notification	Status
CBT-KR-001	Customer data → EU HQ	Germany (EU)	Adequacy recognition	Privacy notice updated	Active
CBT-KR-002	Employee data → Regional HR	Singapore	Standard contractual clauses	Employee notice provided	Active
CBT-KR-003	Logistics data → APAC ops	Japan	Consent (Art. 28-8(1)(1))	Consent collected	Active
CBT-KR-004	Payment data → Treasury	United Kingdom	Adequacy recognition	Privacy notice updated	Active

Sanction Type	PIPA Provision	Detail
Corrective orders	Art. 64	Orders to cease violations, take corrective measures, or implement safeguards
Administrative fines (과태료)	Art. 75	Up to KRW 50 million for procedural violations
Penalty surcharges (과징금)	Art. 64-2	Up to 3% of related revenue (increased from prior cap by 2023 amendments)
Criminal penalties	Art. 71-73	Imprisonment up to 5 years or fine up to KRW 50 million for serious violations
Public naming	Art. 64(4)	Public disclosure of violators

Right	Article	Response Deadline	Implementation
Right to access	Art. 35	10 days	Self-service portal in Korean
Right to correction/deletion	Art. 36	10 days	Correction through customer portal; deletion workflow with legal hold check
Right to suspension	Art. 37	10 days	Processing suspension within 10 days of request
Right to notification	Art. 34	Without delay	Breach notification to affected individuals
Right to data portability	Art. 35-2 (2023)	Per PIPC regulation	Structured export (implementation timeline per PIPC guidance)
Right regarding automated decisions	Art. 37-2 (2023)	Per PIPC regulation	Right to explanation and refusal of automated decisions

Element	Requirement
Individual notification	Without delay upon discovery of breach
PIPC notification	Within 72 hours of discovery for breaches affecting 1,000+ individuals
Content	Facts of breach, items of PI leaked, countermeasures, grievance procedures
Large-scale breach	10,000+ individuals: additional reporting to PIPC and public notification through the website
Investigation cooperation	Cooperate fully with PIPC investigation

Component	Detail
Internal management plan	Documented plan per Art. 29 and Enforcement Decree Art. 30
Chief Privacy Officer (CPO)	Designated officer meeting PIPA qualifications (Art. 31)
Annual training	PIPA compliance training for all Korean employees
Technical safeguards	Encryption of resident registration numbers and sensitive data (Art. 24-2)
Data destruction	Destruction within 5 days of retention period expiry (Art. 21)
Privacy impact assessment	Required for public institutions; recommended for private sector for large-scale processing

korea-pipa

معلومات المصدر

خيارات التثبيت

مراجعة ملفات المصدر

المزيد من هذا المستودع

المزيد من هذا المستودع

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

Consent for Sensitive Information (Art. 23)

2023 Amendment: Consent Alternatives (Art. 15(1))

Pseudonymisation Framework (Arts. 28-2 to 28-7)

Permitted Uses of Pseudonymised Information (Art. 28-2)

Combination of Pseudonymised Information (Art. 28-3)

Safety Measures for Pseudonymised Information (Art. 28-4)

Zenith Global Enterprises Pseudonymisation Register

Cross-Border Transfer Rules

Transfer Mechanisms (Art. 28-8, as amended 2023)

PIPC Adequacy Recognitions

Notification Requirements for Cross-Border Transfer (Art. 28-8(3))

PIPC Enforcement

Administrative Penalties

Notable PIPC Enforcement Actions

Data Subject Rights

Breach Notification (Art. 34)

Compliance Programme