EU Reaffirms Korea's Personal Information Protection Level... Maintains Adequacy Decision

The European Union (EU) has reaffirmed Korea's personal information protection level as equivalent to the EU's. The Personal Information Protection Commission announced on the 24th that the EU Executive Commission decided to maintain the adequacy decision under the General Data Protection Regulation (GDPR). This is the first regular review since the adequacy decision issued in December 2021. The EU Executive Commission conducted a comprehensive review of Korea's legal framework, oversight system, and access to personal data by public agencies. Korea's protection system was evaluated as maintaining a high level since the adequacy decision, with improved alignment between Korea and EU standards due to recent legal revisions. The adequacy decision allows data transfers without additional measures, enabling domestic companies and research institutions to continue transferring data to the EU without extra steps. Korea's 2025 adequacy recognition is also maintained.