European Commission 17 December 2021, Commission Implementing Decision (EU) 2022/254 of 17 December 2021 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate protection of personal data by the Republic of Korea under the Personal Information Protection Act (notified under document C(2021) 9316) (Text with EEA relevance)

Also known as

The Commission Implementing Decision (EU) 2022/254 establishes that the Republic of Korea provides an adequate level of protection for personal data under its Personal Information Protection Act (PIPA), allowing for data transfers from the EU without further authorization. Key provisions include the definition of personal data, broad processing definitions, and the responsibilities of personal information controllers and processors. The decision is enforceable under both PIPA and its Enforcement Decree, with additional safeguards outlined in regulatory notifications by the Personal Information Protection Commission (PIPC).AI