Personal Information Protection Commission

Press Release

The PIPC Improves Practices for Processing Resident Registration Numbers in the Financial Sector 

- The PIPC conducted fact-finding reviews of 220 companies across six financial sectors, including banks, insurance companies, credit card companies, savings banks, and securities firms 

- Fact-finding reviews led financial companies to eliminate unnecessary processing of resident registration numbers (RRNs) in general service operations, such as account management unrelated to financial transactions

August 27, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) conducted fact-finding reviews of financial companies to identify and address noncompliance, particularly for the processing of resident registration numbers (RRNs) without a legal basis under the Personal Information Protection Act (PIPA).

Under Article 63-2 of the PIPA, where a data controller fails to comply with the PIPA, the PIPC may have its public officials enter the relevant premises and inspect the status of business operations, ledgers, and relevant documents. Where violations are identified during such inspections, the PIPC issues recommendations for correction. The PIPC may also issue recommendations for improvement in areas where it identifies practices that should be improved.

Following sanctions imposed on credit card companies on March 11, 2026, for violating the restriction on processing RRNs under Article 24-2 of the PIPA, the PIPC began conducting fact-finding reviews of 220 companies across six financial sectors, including banks, life insurance companies, property and casualty insurance companies, credit card companies, savings bank, and securities firms, on April 1, 2026.

Unlike the processing of RRNs for financial transactions under relevant laws and regulations, financial companies processed RRNs as part of their general business operations. Accordingly, the PIPC focused its fact-finding reviews on the processing of RRNs for general business purposes that are not directly associated with financial transactions, including membership and account management.

RRNs uniquely identify individuals and are difficult to change. If leaked, misused or abused, they can cause long-term harm to data subjects and require a high level of protection. Accordingly, Article 24-2 of the PIPA prohibits the processing of RRNs, except where prescribed by law or regulation as necessary.

The financial sector is often required to process RRNs in the course of financial transactions under the Act on Real Name Financial Transactions and Confidentiality and other relevant laws. However, using RRNs as a general means of self-authentication have become common practice in the industry. As a result, such practices have persisted even when there is no legal basis for processing RRNs.

Examples of Processing RRNs without a Legal Basis 

● Asking for RRNs when signing up for an online service that does not involve financial transactions 

● Asking for RRNs for account management purposes, such as finding a user ID or resetting password, etc. 

● Asking for RRNs when registering and linking a private certificate

*The registration or linking of a private certificate does not necessarily require the collection of RRNs, as the process can be carried out using connecting information (CI)

In response, the PIPC called on the financial sector to review whether the processing of RRNs is necessary in their service operations and to eliminate unnecessary processing practices.

The PIPC’s fact-finding reviews were intended to encourage financial companies, whose services are closely connected to people’s daily lives, to proactively identify and improve unnecessary RRN processing practices. This approach reflects the PIPC’s policy direction of shifting from an ex-post enforcement approach toward a prevention-focused privacy framework. The PIPC’s fact-finding reviews of financial companies serve as a signal for the financial sector to voluntarily review RRN processing practices that are not directly associated with financial transactions.

The PIPC will not impose administrative sanctions on businesses that take necessary measures to comply with the PIPA during fact-finding reviews. Going forward, the PIPC will use fact-finding reviews as a policy tool to preemptively identify and address potential privacy risks in areas closely connected to people’s day-to-day lives.

* A PDF file, formatted for better readability, is attached.