Since 15 March 2024, Korea's Personal Information Protection Act gives data subjects a right to refuse fully automated decisions and to request an explanation. Below, free of charge: a disclosure notice and an automated-decision register.
Download the template Reserve your spot for an online callWhere a controller makes a decision solely by automated processing (including profiling) that significantly affects a data subject's rights or obligations, the amended Act gives the data subject two things:
The controller must, in turn, disclose in advance the criteria and the procedure of the automated decision — typically in the privacy notice — so the right can be exercised. "Solely automated" is the trigger: meaningful human involvement in the decision takes it outside Article 37-2.
| Provision | Subject | What it means in practice |
|---|---|---|
| PIPA Art. 37-2(1) | Right to refuse | Individual may decline a solely-automated decision that significantly affects them |
| PIPA Art. 37-2(2) | Explanation / review | On request, explain the decision and allow human review |
| PIPA Art. 37-2(3) | Advance disclosure | Publish the criteria and procedure of the automated decision |
| Consent / contract | Limit on refusal | Where based on consent or necessary for a contract, refusal may not apply — explanation still does |
| PIPA Art. 4 | Data-subject rights | The above sit alongside access, correction and deletion |
| PIPA (privacy notice) | Transparency | The criteria/procedure typically live in the privacy policy |
PIPC has issued guidance on the scope of "solely automated"; confirm the current text before relying on it.
Copy the text below or download it as markdown. No sign-up.
# KOREA PIPA — AUTOMATED-DECISION DISCLOSURE & REGISTER Document code: KR-PIPA-01 · Version 1.0 · Classification: Internal Organisation: [NAME] Prepared by: [NAME/ROLE] Date: ……/……/20…… Reference: PIPA Art. 37-2 (automated decisions; in force 15 March 2024) PART A — REGISTER OF AUTOMATED DECISIONS (one row per decision) Decision: [NAME] · Purpose: [……] Solely automated? [ ] Y [ ] N · Significant effect on rights/obligations? [ ] Y [ ] N Legal basis: [ ] consent [ ] contract [ ] other: …… Criteria (main factors): [……] Procedure (how the decision is produced): [……] Human-review contact / channel: [……] PART B — ADVANCE DISCLOSURE NOTICE (for the privacy policy) "We make the following decisions using solely automated processing: [LIST]. The main criteria are [……] and the procedure is [……]. You may (i) refuse to be subject to a solely automated decision, except where it is based on your consent or necessary for a contract; and (ii) request an explanation of the decision and review by a person. To exercise these rights, contact: [CHANNEL]." PART C — REQUEST-HANDLING WORKFLOW [ ] Intake channel for refusal / explanation / review requests [ ] Identity verification [ ] Human reviewer assigned (independent of the automated step) [ ] Response within [PERIOD]; outcome and reasoning recorded [ ] Log kept: request, decision reviewed, reviewer, outcome, date PART D — RECORDS Retain the register, disclosure versions, and request/response logs. Owner: [ROLE] Review cycle: [PERIOD] Next review: ……/……/20…… This template is general and does not constitute legal advice.
The relevant PIPA provisions (Art. 37-2) apply from 15 March 2024. The Personal Information Protection Commission (PIPC) has issued implementing guidance.
A decision made by automated processing without meaningful human involvement. If a person genuinely reviews and can change the outcome, it usually falls outside the refusal right — though explanation duties may still apply.
Where the decision is based on the data subject's consent or is necessary for a contract, the right to refuse may not apply. The rights to an explanation and to disclosure of the criteria still operate.
The criteria and the procedure of the automated decision, typically in the privacy notice, in enough detail for the data subject to understand and exercise their rights.
In a twenty-minute call we identify which of your decisions are solely automated, and draft the disclosure and the refusal/explanation workflow. If you're out of scope, we say so clearly.
Reserve your spot for an online call The call is online · the template is yours either way