Personal Information Protection Commission

Press Release

The PIPC Conducts Fact-finding Reviews Across Five Sectors Outsourcing Customer Service Operations

- The PIPC will examine data processing practices in customer service centers, such as access control management, storage, and review of access logs, and safeguards in place

April 6, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) will conduct preliminary fact-finding reviews of personal data protection practices across five sectors that outsource customer service operations. This initiative follows a recent incident in which call center staff working for a delivery service accessed customers’ personal information without authorization and misused them in connection with “revenge-for-hire” crimes. The five sectors include:

● Delivery services 

● Home shopping businesses 

● Online shopping businesses 

● Rental businesses 

● Telecommunications providers

The PIPC plans to review the data protection practices of both personal data processors and their subcontractors entrusted with handling personal data. The review will a focus on:

● Whether they put appropriate safeguards in place required under the Personal Information Protection Act (PIPA), such as granting access authorization to personal information; 

● Whether they properly manage and supervise data protection services, such as conducting privacy training for subcontractors

A legal basis for a fact-finding review is Article 63-2 of the PIPA. Where a personal data processor fails to comply with the PIPA, the PIPC may require its public officials to enter the premises of the relevant entity to inspect the status of business operations, ledgers, documents, etc.

The PIPC’s fact-finding reviews will be centered on:

● The implementation of role-based access controls (RBAC) for personal data handlers (subcontracted personnel in customer service centers); 

● The status of updating access authority (change or termination) due to roles and responsibilities; 

● The status of storage and management of access logs; and 

● The status of oversight of subcontractors, including privacy training

Through the fact-finding reviews, the PIPC will assess the data processing practices of outsourced customer service centers. Building on the review results, the PIPC will take necessary measures, including issuing recommendations, to preemptively identify areas for improvement. Thereby, it will contribute to creating a more reliable service environment for Korean people.

* A PDF file, formatted for better readability, is attached.