European Commission 23 July 2026, REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the first review of the functioning of the adequacy decision for the Republic of Korea

Also known as

The European Commission's first periodic review of the adequacy decision for the Republic of Korea (adopted 17 December 2021 pursuant to Article 45 GDPR) concludes that Korea continues to ensure an adequate level of protection for personal data transferred from the EU, as governed by the Personal Information Protection Act (PIPA) and the Supplementary Rules in Annex I to the adequacy decision. The review finds that the 2023 and 2025 PIPA amendments have further converged the Korean framework with EU standards, resulting in the revocation of Supplementary Rules 2, 4, and the first part of 5, which have been absorbed into the PIPA itself. In light of these findings, the Commission considers it appropriate to extend the review cycle from three to four years pursuant to Article 45(3) GDPR, while issuing recommendations to the Personal Information Protection Commission (PIPC) on compliance checks, updated transfer guidelines, and website transparency.AI