The European Commission has concluded that the Republic of Korea continues to ensure an adequate level of protection for personal data transferred from the EU, following the first review of the adequacy decision adopted on 17 December 2021. The finding, published in a Commission report on 24 July 2026, affects all entities transferring personal data from the EU to entities in Korea subject to the Personal Information Protection Act (PIPA).
The review meeting took place on 17 October 2025, with follow-up exchanges between the Commission and Korea's Personal Information Protection Commission (PIPC). Since the adequacy decision was adopted, Korea has amended the PIPA twice: in March 2023 (entry into force September 2023) and April 2025 (entry into force October 2025). The PIPC adapted its Supplementary Rules to reflect these amendments, revoking Rules 2, 4, and part of Rule 5 as their content is now incorporated into the PIPA. In a parallel development, Korea adopted an equivalence recognition for the EU, entering into force on 16 September 2025, covering the public and private sectors and the entire European Economic Area.
The Commission will now move to a four-year review cycle under Article 45(3) of the GDPR, consulting the Article 93(1) Committee, replacing the previous more frequent review schedule. The report includes several recommendations: the PIPC should carry out random checks on compliance with the Supplementary Rules; clarify that the APEC CBPR and CBPR certification schemes are not recognised under PIPA; and ensure its website displays valid international transfer tools in both English and Korean.
The decision confirms that Korea's data protection framework has further converged with the EU's, providing legal certainty for businesses and organisations transferring personal data from the EU to Korea. The shift to a four-year review cycle reduces administrative burden for both the Commission and Korean authorities, while the recommendations aim to enhance transparency and enforcement. The report does not propose any changes to the adequacy decision itself, which remains valid.