Since 15 March 2024, Korea's Personal Information Protection Act gives data subjects a right to refuse fully automated decisions and to request an explanation. Below: a disclosure notice and an automated-decision register.
Download the templateWhere a controller makes a decision solely by automated processing (including profiling) that significantly affects a data subject's rights or obligations, the amended Act gives the data subject two things:
The controller must, in turn, disclose in advance the criteria and the procedure of the automated decision — typically in the privacy notice — so the right can be exercised. "Solely automated" is the trigger: meaningful human involvement in the decision takes it outside Article 37-2.
| Provision | Subject | What it means in practice |
|---|---|---|
| PIPA Art. 37-2(1) | Right to refuse | Individual may decline a solely-automated decision that significantly affects them |
| PIPA Art. 37-2(2) | Explanation | The individual may request an explanation of the decision |
| PIPA Art. 37-2(3) | Controller's response | On refusal or request, absent a justifiable reason, do not apply the decision, or take measures such as human re-processing and explanation |
| PIPA Art. 37-2(4) | Advance disclosure | Publish the criteria, the procedure and how personal data is processed, so they are easy to check |
| Consent / law / contract | Limit on refusal | Where based on consent, a statutory provision or legal obligation, or necessary for a contract (Art. 15(1) items 1, 2 and 4), refusal may not apply — explanation still does |
| PIPA Art. 4 | Data-subject rights | The above sit alongside access, correction and deletion |
| PIPA (privacy notice) | Transparency | The criteria/procedure typically live in the privacy policy |
PIPC has issued guidance on the scope of "solely automated"; confirm the current text before relying on it.
Copy the text below or download it as markdown. No sign-up.
# KOREA PIPA — AUTOMATED-DECISION DISCLOSURE & REGISTER Document code: KR-PIPA-01 · Version 1.0 · Classification: Internal Organisation: [NAME] Prepared by: [NAME/ROLE] Date: ……/……/20…… Reference: PIPA Art. 37-2 (automated decisions; in force 15 March 2024) PART A — REGISTER OF AUTOMATED DECISIONS (one row per decision) Decision: [NAME] · Purpose: [……] Solely automated? [ ] Y [ ] N · Significant effect on rights/obligations? [ ] Y [ ] N Legal basis: [ ] consent [ ] law / legal obligation [ ] contract [ ] other: …… Criteria (main factors): [……] Procedure (how the decision is produced): [……] Human-review contact / channel: [……] PART B — ADVANCE DISCLOSURE NOTICE (for the privacy policy) "We make the following decisions using solely automated processing: [LIST]. The main criteria are [……] and the procedure is [……]. You may (i) refuse to be subject to a solely automated decision, except where it is based on your consent, on a statutory provision or legal obligation, or is necessary for a contract; and (ii) request an explanation of the decision and review by a person. To exercise these rights, contact: [CHANNEL]." PART C — REQUEST-HANDLING WORKFLOW [ ] Intake channel for refusal / explanation / review requests [ ] Identity verification [ ] Human reviewer assigned (independent of the automated step) [ ] Response within [PERIOD]; outcome and reasoning recorded [ ] Log kept: request, decision reviewed, reviewer, outcome, date PART D — RECORDS Retain the register, disclosure versions, and request/response logs. Owner: [ROLE] Review cycle: [PERIOD] Next review: ……/……/20…… This template is general and does not constitute legal advice.
The relevant PIPA provisions (Art. 37-2) apply from 15 March 2024. The Personal Information Protection Commission (PIPC) has issued implementing guidance.
A decision made by automated processing without meaningful human involvement. If a person genuinely reviews and can change the outcome, it usually falls outside the refusal right — though explanation duties may still apply.
Where the decision is based on the data subject's consent, on a statutory provision or legal obligation, or is necessary for a contract, the right to refuse may not apply. The rights to an explanation and to disclosure of the criteria still operate.
The criteria and the procedure of the automated decision, typically in the privacy notice, in enough detail for the data subject to understand and exercise their rights.