Personal Information Protection Commission

Press Release The EU’s Adequacy Decision on the Republic of Korea Renewed

- The European Commission reaffirms that Korea’s personal data protection framework remains adequate, recognizing legislative amendments made since 2023 

- The renewal ensures the continued safe and free flow of personal data between the two jurisdictions

July 24, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) announced that the European Commission (EC) renewed the adequacy decision on the Republic of Korea adopted under the General Data Protection Regulation (GDPR). It is a result of the first review of the adequacy decision adopted in December 2021 and reaffirms that Korea continues to provide an adequate level of protection for personal data transferred from the European Union (EU) to the country.

Countries and international organizations with an adequacy decision are as follows:

Switzerland, Canada, Argentina, Guernsey, Jersey, Isle of Man, Faroe Islands, Andorra, Israel, New Zealand, Uruguay, Japan, United Kingdom, Republic of Korea, United States, European Patent Organisation, Brazil.

The EU’s adequacy decision recognizes that a country outside the EU offers an adequate level of personal data protection compared to that in the EU. Once an adequacy decision is made, personal data can flow freely from the EU to the country, without being subject to any further conditions. The EC is required to periodically review adequacy decisions, and it conducts reviews of the adoption of the decision at least every four years.

The EC carried out a comprehensive review of Korea’s data protection framework, including its oversight and redress mechanisms, and access by Korean public authorities. The EC’s review concluded that Korea continues to ensure a high level of protection of personal data following the adequacy decision made in 2021. In particular, it says the data protection frameworks between the EU and Korea have further converged due to a few amendments to the PIPA.

The renewed adequacy decision enables personal data transfers to Korean companies, research institutes and public authorities without additional transfer requirements. Together with the renewed adequacy decision, the mutual adequacy arrangement through Korea’s equivalence recognition on the EU made in September 2025 remains effective. It is expected to ensure stable data use between the two jurisdictions.

PIPC Chairperson Kyung Hee Song said, “The successful completion of the first review reaffirms that Korea’s personal data protection framework has maintained a greater level of trust globally.” She also added, “Going forward, the PIPC will continue to safeguard the Korean data subjects’ personal data while proactively supporting the business-side data use globally through close cooperation with the EU and other major economies.”

* A PDF file, formatted for better readability, is attached.