# Statement 2/2026 on the first review of the functioning of the adequacy decision for the Republic of Korea - Type: Guidance - Source: EDPB - Date: 2026-11-10 - Original: https://www.edpb.europa.eu/documents/reports-statements-and-letters/statement-22026-on-the-first-review-of-the-functioning-of_en - Canonical: https://overview.legal/posts/628739 ## Summary 1 | Adopted Statement 2/2026 on the first review of the functioning of the adequacy decision for the Republic of Korea Adopted on 10 November 2026 The European Data Protection Board has adopted the following statement: 1. On 23 July 2026, the European Commission issued the report on the first review of the functioning of the adequacy decision for the Republic of Korea adopted on 17 December 2021, along with a Commission Staff Working Document (SWD(2026) 231 final) 1 . 2. In its Implementing… ## Full text 1 | Adopted Statement 2/2026 on the first review of the functioning of the adequacy decision for the Republic of Korea Adopted on 10 November 2026 The European Data Protection Board has adopted the following statement: 1. On 23 July 2026, the European Commission issued the report on the first review of the functioning of the adequacy decision for the Republic of Korea adopted on 17 December 2021, along with a Commission Staff Working Document (SWD(2026) 231 final) 1 . 2. In its Implementing Decision (EU) 2022/254, the European Commission established, pursuant to Article 45 of Regulation (EU) 2016/679 (‘GDPR’), that the Republic of Korea ensures a level of protection for personal data transferred from the European Union that is essentially equivalent to that guaranteed by Regulation (EU) 2016/679 2 . Pursuant to Article 45(3) GDPR and having regard to the fact that the level of protection afforded by the Korean legal system may be subject to change, the European Commission had planned for a first review to take place after three years from the date of the notification 3 of the Decision to the Member States 4 . 3. To that end, a review meeting between the Korean and the EU delegations took place on 17 October 2025, preceded and followed up by several exchanges between the Korean delegation and the European Commission. Four representatives of the European Data Protection Board (‘EDPB’), designated by the EDPB for the review 5 , participated to the meeting alongside members of the European Commission. The designated EDPB representatives were consulted for the preparation of the meeting and afterwards, on the draft 1 Report from the Commission of 23 July 2026 to the European Parliament and the Council on the first review of the functioning of the adequacy decision for the Republic of Korea, COM (2026) 384 final; and Commission Staff Working Document Accompanying the document ‘Report from the Commission to the European Parliament and the Council on the first review of the functioning of the adequacy decision for the Republic of Korea’, SWD(2026) 231 final. 2 Commission Implementing Decision (EU) 2022/254 of 17 December 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act (notified under document C(2021) 9316), OJ L 44, 24.2.2022, pp. 1–90, Recital 209. 3 The date of the notification of the Decision to the Member States was 17 December 2021. 4 Commission Implementing Decision (EU) 2022/254, Recitals 219-222 and Article 3(4). 5 The EDPB team consisted of representatives of the EDPB members from Finland, France, Germany and Italy SAs. 2 | Adopted Commission Staff Working Document and the Report to the European Parliament and the Council. 4. The EDPB welcomes that its representatives have been involved at all stages of the review and in the meeting and that they were consulted on the draft Commission Staff Working Document to which they have provided input, also taking into account EDPB Opinion 32/2021 regarding the European Commission Draft Implementing Decision on the adequate protection of personal data in the Republic of Korea 6 . The EDPB would like to mention that, during this process, it has not received an official translation into English of all relevant documentation referred to. 5. The EDPB wishes to highlight the fact that the Republic of Korea and the European Union enjoy mutual recognition of equivalent levels of personal data protection since 16 September 2025 7 . Such a mutual recognition testifies to the further alignment of both EU and Korean regulatory frameworks. 6. Overall, the EDPB welcomes several amendments in the Korean data protection legislation that have increased the level of protection of individuals and facilitated the processing of data by controller while maintaining a level of protection essentially equivalent to that of the GDPR and the inclusion of some existing Supplementary Rules contained in Annex I to the adequacy decision in the PIPA, which makes them generally applicable to all personal data and not limited solely to personal data transferred from the EEA 8 . 7. In particular, with regard to data subject rights , recalling the concerns raised in its Opinion 32/2021 regarding the lack of legal provisions on automated decision-making in the PIPA 9 , the EDPB welcomes the changes in PIPA that have introduced the right to refuse an automated decision (incl. by AI systems) or request an explanation on it if the decision significantly impacts the data subjects’ rights or obligations (Article 37-2). The EDPB also appreciates the clarifications provided by the PIPC in relation to the cases excluded by the application of Article 37-2 PIPA, with regard to the existing legal remedies available to the data subjects, including data subjects whose personal data might have been transferred under the adequacy decision. These changes, along with the introduction of a new general right to withdraw consent (Article 37(1) PIPA), and in addition to the existing right to request the suspension of processing of personal data, have led to a noticeable strengthening of data subjects’ rights. In this respect, the EDPB encourages the European Commission to monitor the practical application of these amendments in order to assess their expected positive impact on the level of protection afforded to personal data transferred from the European 6 EDPB Opinion 32/2021 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data in the Republic of Korea, adopted on 24 September 2021. 7 See Joint Press Statement of 16 September 2025 by Commissioner Michael McGrath and former Chairperson Haksoo Ko on the entry into force of the Korean adequacy decision on the EU, available at: https://commission.europa.eu/news-and- media/news/joint-press-statement-commissioner-michael-mcgrath-and-chairperson-haksoo-ko-entry-force-korean-2025-09- 16 en?prefLang=fr 8 As a result of this inclusion, Supplementary Rule 2 (on restrictions on cross-border transfers), Supplementary Rule 4 (relating to the exceptions on transparency and individual rights for pseudonymised data) and the first part of Supplementary Rule 5 (relating to the possibility of the PIPC to adopt corrective measures) can be revoked and the PIPC will publish a new version of the Supplementary Rules on its website. 9 EDPB Opinion 32/2021, section 3.1.13. 3 | Adopted Economic Area (‘EEA’), in particular as regards to any processing of personal data for the purpose of automated individual decision-making, including profiling. 8. The EDPB also acknowledges the amendments to PIPA provisions relating to the legal bases for processing and, in particular, the legal basis for collecting and using personal data in relation to the performance of a contract (Article 15(1)(4) PIPA) and the amendment stipulating that personal data may be collected and used ‘ where it is urgently necessary for the public safety and security, public health, etc. ’ where ‘ etc .’ refers to other situations of a similar nature (Article 15(1)(7) PIPA and explanations in footnote 16 of the Working document). This will offer more flexibility to data controllers. 9. The EDPB acknowledges that these amendments further align the data protection legislation of the Republic of Korea and the GDPR. However, considering their novelty in the Korean legal framework, the EDPB encourages the European Commission to monitor their application and the relevant case law in order to ensure, in particular, that the ‘other situations of a similar nature’ referred to by the term ‘ etc. ’ reflect the ‘essential public interests’ also recognised in the EEA 10 . 10. With regard to onward transfers of personal data, the EDPB welcomes the changes to the PIPA on the legal regime applicable to international transfer of personal data. The changes clarify the need for cross-border transfer of personal information to rely on the specific transfer tools described in Article 28-8 PIPA offering therefore alternative solutions to consent. In light of these amendments, the EDPB takes note that Supplementary Rule 2 of Notification 2021- 5 may be revoked. The EDPB also acknowledges the attention paid by the European Commission to the participation of the Republic of Korea in the CBPR system 11 and PIPC’s explanations according to which the CBPR are not intended to be used as a tool for transfers to third countries. In this regard, the EDPB particularly welcomes the invitation made by the European Commission to the PIPC to provide clarifications on this in the forthcoming updated guidelines on international transfers and, more in general, to clearly display the tools that are valid for international data transfers, in both English and Korean, on its website. 11. Further, the EDPB encourages the European Commission to monitor the future application of the new rules on transfers and recommends that the European Commission continue to closely oversee future developments in this area, to ensure that the level of protection of EU data is maintained when personal data transferred from the EEA to the Republic of Korea is further transferred to third countries. This is particularly significant in the case of onward transfers to third countries that may be the subject of an adequacy decision under the Korean legal framework, where those third countries hav e not already been the subject of an adequacy finding of the EU . 12. On the same topic, as already considered in previous occasions 12 , the EDPB shares the European Commission’s view on the growing importance of model clauses to strengthen the safeguards for EEA transferred personal data when they are onward transferred outside the EEA and their potential as a global tool for data transfers. Against this background, the EDPB 10 See also, for similar consideration, EDPB Opinion 32/2021, paragraph 61. 11 Global Cross-Border Privacy Rules Forum. 12 See EDPB Statement 1/2023 on the first review of the functioning of the adequacy decision for Japan, adopted on 18 July 2023. 4 | Adopted welcomes the idea of possible future cooperation of the European Commission with the Republic of Korea in the development of such clauses and the EDPB will be available to provide any helpful contribution to that end. 13. With regard to the processing of pseudonymised personal data, in light of the considerations contained in its Opinion 32/2021 on the exceptions envisaged in the PIPA at the time of the adoption of the adequacy decision 13 , the EDPB welcomes the 2023 amendments to the PIPA, now stipulating that certain exceptions on transparency and individual rights apply exclusively to pseudonymised data used for statistical, scientific research, or public archiving purposes (new Article 28-7 PIPA) and have strengthened the safeguards relating to such kind of processing, for example, by envisaging further transparency (Article 30(1)4-2 PIPA) and the obligation to destroy personal information once it becomes unnecessary in consideration of the expiry of the retention period (Article 21 PIPA). The EDPB acknowledges that, as a consequence, supplementary Rule 4 relating to the scope of application of the special exemption to the processing of pseudonymised information may also be revoked. 14. Regarding enforcement and sanctions, the EDPB welcomes that the amended PIPA now grants the PIPC the power to adopt corrective measures in the event of a breach of the law. It acknowledges that the previous references to the risk of damage as a condition for the adoption of such measures have been removed, thereby further strengthening the effective application of data protection rules. 15. The EDPB welcomes the key procedural improvements regarding access to personal data by public authorities introduced following the adoption of the adequacy decision in 2021. 16. Article 83-2 of the amended Telecommunications Business Act now requires law enforcement and other authorised agencies that have received subscriber information from telecommunications providers to notify the data subject within 30 days, unless special circumstances apply. The EDPB expresses its appreciation to the Korean authorities for clarifying the scope of the notion of 'special circumstances', which refers to exceptional national security risks. 17. The EDPB acknowledges the positive changes brought to the Communications Privacy Protection Act with regard to the more rigorous oversight of interception measures for emergency communications, under which court approval is now required without exception, even where such measures are revoked within a short period of time (Article 8), and any information collected must be destroyed where court approval is not obtained within 36 hours of the measure being initiated (Article 17). 18. While welcoming the PIPC's numerous initiatives aimed at providing guidance to public authorities when processing personal data for law enforcement or national security purposes, the EDPB encourages the European Commission to monitor the PIPC's enforcement activities towards law enforcement and national security authorities, to ensure the practical effectiveness of the Supplementary Rule 6. 19. In light of the outcome of the review, the EDPB agrees on the proposal of the European Commission to consult the Committee established under Article 93(1) GDPR in order to move to a four-year review cycle of the adequacy decision pursuant to Article 45(3) GDPR but, 13 EDPB Opinion 32/2021, paragraphs 50 et seq. 5 | Adopted having regard to the delay in completing the first review, recommends that this term be strictly observed for future reviews. For the European Data Protection Board The Chair (Anu Talus) --- Generated by overview.legal · https://overview.legal/posts/628739 · 2026-11-14