korea-pipa

Guides compliance with South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법). Covers pseudonymisation framework, notification requirements, PIPC enforcement, consent standards, and cross-border transfer rules under the 2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation, consent, cross-border transfers.

跳到安装

仓库: ThomasMoreAI/legal-skills-open
最近来源活动: 2026年6月1日 17:27
检测到的 SKILL.md 语言: 英语
星标: 40
分支: 4

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/ThomasMoreAI/legal-skills-open --skill korea-pipa

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

name	korea-pipa
title	South Korea PIPA Compliance
description	Guides compliance with South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법). Covers pseudonymisation framework, notification requirements, PIPC enforcement, consent standards, and cross-border transfer rules under the 2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation, consent, cross-border transfers.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/korea-pipa
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	kr
practice	data-protection
language	en

Requirement	PIPA Provision	Detail
Informed consent	Art. 15(2)	Must disclose: purpose, items collected, retention period, right to refuse and consequences
Separate consent	Art. 22(1)	Consent for processing beyond the purpose must be separated from other consent items
Clear distinction	Art. 22(1)	Important content must be clearly displayed (larger font, colour, bold)
Opt-in for marketing	Art. 22(2)	Marketing purpose collection requires separate opt-in consent

name	korea-pipa
title	South Korea PIPA Compliance
description	Guides compliance with South Korea's Personal Information Protection Act (PIPA, 개인정보 보호법). Covers pseudonymisation framework, notification requirements, PIPC enforcement, consent standards, and cross-border transfer rules under the 2023 amendments. Keywords: PIPA, Korea data protection, PIPC, pseudonymisation, consent, cross-border transfers.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/korea-pipa
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	kr
practice	data-protection
language	en

Requirement	PIPA Provision	Detail
Informed consent	Art. 15(2)	Must disclose: purpose, items collected, retention period, right to refuse and consequences
Separate consent	Art. 22(1)	Consent for processing beyond the purpose must be separated from other consent items
Clear distinction	Art. 22(1)	Important content must be clearly displayed (larger font, colour, bold)
Opt-in for marketing	Art. 22(2)	Marketing purpose collection requires separate opt-in consent

Basis	Article	Description
Consent	Art. 15(1)(1)	Data subject's consent obtained per Art. 22
Legal obligation	Art. 15(1)(2)	Special provisions in laws or compliance with legal obligations
Public institution duty	Art. 15(1)(3)	Necessary for public institutions to perform statutory duties
Contract performance	Art. 15(1)(4)	Necessary for contract with data subject
Legitimate interest	Art. 15(1)(6)	Necessary for legitimate interest of the data handler, where substantially related to the purpose and within the data subject's reasonable expectations (added 2023)
Urgent necessity	Art. 15(1)(5)	Urgently necessary for life, body, or property of the data subject or third party

korea-pipa

安装方式

检查来源文件

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

Consent for Sensitive Information (Art. 23)

2023 Amendment: Consent Alternatives (Art. 15(1))

Pseudonymisation Framework (Arts. 28-2 to 28-7)

Permitted Uses of Pseudonymised Information (Art. 28-2)

Combination of Pseudonymised Information (Art. 28-3)

Safety Measures for Pseudonymised Information (Art. 28-4)

Zenith Global Enterprises Pseudonymisation Register

Cross-Border Transfer Rules

Transfer Mechanisms (Art. 28-8, as amended 2023)

PIPC Adequacy Recognitions

Notification Requirements for Cross-Border Transfer (Art. 28-8(3))

PIPC Enforcement

Administrative Penalties

Notable PIPC Enforcement Actions

Data Subject Rights

Breach Notification (Art. 34)

Compliance Programme

Measure	Requirement
Separation of additional information	Additional information enabling re-identification must be stored and managed separately
Technical safeguards	Encryption or equivalent protection for additional information
Access restrictions	Designation of authorised personnel; access logging
Prohibition on re-identification	Prohibited from using pseudonymised information to re-identify individuals; if re-identification occurs accidentally, immediate destruction or cessation of processing required

Data Set	Purpose	Pseudonymisation Method	Additional Information Storage	PIPC Compliance
Customer shipping patterns	Statistical analysis of route optimisation	k-anonymity (k=5) with generalisation of location data	Key mapping table stored in HSM, separate from analytics environment	Compliant
Employee performance metrics	Industrial research on workforce productivity	Tokenisation of employee identifiers	Token-identifier mapping in isolated database with MFA access	Compliant
Logistics volume trends	Public interest statistical reporting	Aggregation to postal code level with suppression of groups < 10	No additional information retained (anonymised output)	Not applicable (anonymised)

Mechanism	Article	Detail
Consent	Art. 28-8(1)(1)	Data subject's consent with disclosure of: recipient, destination country, transfer purpose, PI items, right to refuse and consequences
Contract necessity	Art. 28-8(1)(2)	Transfer necessary for contract with data subject
Adequacy recognition	Art. 28-8(1)(3)	Transfer to a country or international organisation recognised by the PIPC as having adequate protection
Standard contractual clauses	Art. 28-8(1)(4)	PIPC-approved standard contractual clauses between the parties
BCR equivalent	Art. 28-8(1)(4)	PIPC-approved data protection rules within a corporate group
PIPC certification	Art. 28-8(1)(5)	Recipient certified by a PIPC-designated certification body

Transfer ID	Flow	Destination	Mechanism	Notification	Status
CBT-KR-001	Customer data → EU HQ	Germany (EU)	Adequacy recognition	Privacy notice updated	Active
CBT-KR-002	Employee data → Regional HR	Singapore	Standard contractual clauses	Employee notice provided	Active
CBT-KR-003	Logistics data → APAC ops	Japan	Consent (Art. 28-8(1)(1))	Consent collected	Active
CBT-KR-004	Payment data → Treasury	United Kingdom	Adequacy recognition	Privacy notice updated	Active

Sanction Type	PIPA Provision	Detail
Corrective orders	Art. 64	Orders to cease violations, take corrective measures, or implement safeguards
Administrative fines (과태료)	Art. 75	Up to KRW 50 million for procedural violations
Penalty surcharges (과징금)	Art. 64-2	Up to 3% of related revenue (increased from prior cap by 2023 amendments)
Criminal penalties	Art. 71-73	Imprisonment up to 5 years or fine up to KRW 50 million for serious violations
Public naming	Art. 64(4)	Public disclosure of violators

Right	Article	Response Deadline	Implementation
Right to access	Art. 35	10 days	Self-service portal in Korean
Right to correction/deletion	Art. 36	10 days	Correction through customer portal; deletion workflow with legal hold check
Right to suspension	Art. 37	10 days	Processing suspension within 10 days of request
Right to notification	Art. 34	Without delay	Breach notification to affected individuals
Right to data portability	Art. 35-2 (2023)	Per PIPC regulation	Structured export (implementation timeline per PIPC guidance)
Right regarding automated decisions	Art. 37-2 (2023)	Per PIPC regulation	Right to explanation and refusal of automated decisions

Element	Requirement
Individual notification	Without delay upon discovery of breach
PIPC notification	Within 72 hours of discovery for breaches affecting 1,000+ individuals
Content	Facts of breach, items of PI leaked, countermeasures, grievance procedures
Large-scale breach	10,000+ individuals: additional reporting to PIPC and public notification through the website
Investigation cooperation	Cooperate fully with PIPC investigation

Component	Detail
Internal management plan	Documented plan per Art. 29 and Enforcement Decree Art. 30
Chief Privacy Officer (CPO)	Designated officer meeting PIPA qualifications (Art. 31)
Annual training	PIPA compliance training for all Korean employees
Technical safeguards	Encryption of resident registration numbers and sensitive data (Art. 24-2)
Data destruction	Destruction within 5 days of retention period expiry (Art. 21)
Privacy impact assessment	Required for public institutions; recommended for private sector for large-scale processing

korea-pipa

来源信息

安装方式

检查来源文件

同仓库更多 Skills

同仓库更多 Skills

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

South Korea PIPA Compliance

Overview

Scope and Definitions

Personal Information (Art. 2(1))

Pseudonymised Information (Art. 2(1-2), introduced 2020)

Sensitive Information (Art. 23)

Consent Framework

General Consent Requirements

Consent for Sensitive Information (Art. 23)

2023 Amendment: Consent Alternatives (Art. 15(1))

Pseudonymisation Framework (Arts. 28-2 to 28-7)

Permitted Uses of Pseudonymised Information (Art. 28-2)

Combination of Pseudonymised Information (Art. 28-3)

Safety Measures for Pseudonymised Information (Art. 28-4)

Zenith Global Enterprises Pseudonymisation Register

Cross-Border Transfer Rules

Transfer Mechanisms (Art. 28-8, as amended 2023)

PIPC Adequacy Recognitions

Notification Requirements for Cross-Border Transfer (Art. 28-8(3))

PIPC Enforcement

Administrative Penalties

Notable PIPC Enforcement Actions

Data Subject Rights

Breach Notification (Art. 34)

Compliance Programme