Medical data privacy in South Korea: what the law says

What the law says

How South Korea treats your health data.

The law: Personal Information Protection Act (PIPA)[S84]
The regulator: Personal Information Protection Commission (PIPC)[S84]
Health data: Health information is sensitive information under Article 23. A clinic needs your separate consent to process it, given apart from any other consent you sign.[S84]
Sending it abroad: Article 28-8 lets personal information leave Korea on five bases: your separate consent, a law or treaty, outsourcing or storage needed for a contract with you, a certification recognised by the PIPC, or a PIPC adequacy decision.[S84]
EU adequacy: Yes. The EU adopted an adequacy decision for Korea in December 2021 and confirmed it in July 2026, so data can flow from the EU to Korea as it would within Europe.[S85][S77]
If there is a breach: Within 72 hours to the people affected, and to the PIPC or the Korea Internet and Security Agency for serious incidents, such as those involving sensitive data or 1,000 people or more.[S87]
Fines: Penalty surcharges of up to 3% of total revenue. Amendments passed in February 2026 allow up to 10% for the most serious breaches: repeated, grossly negligent, or affecting 10 million people or more.[S87][S86]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in South Korea and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Try the free privacy check

Questions

South Korea: common questions.

Is it safe to email medical records to a clinic in South Korea?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in South Korea, local law applies: health information is sensitive information under Article 23. A clinic needs your separate consent to process it, given apart from any other consent you sign. For a full history, use a channel where you hold the key, such as a link that expires by itself.

How does South Korea protect health data?

Health information is sensitive information under Article 23. A clinic needs your separate consent to process it, given apart from any other consent you sign. Breaches must be reported within 72 hours to the people affected, and to the PIPC or the Korea Internet and Security Agency for serious incidents, such as those involving sensitive data or 1,000 people or more. The regulator is the Personal Information Protection Commission (PIPC).

Can a clinic in South Korea send my medical records abroad?

Article 28-8 lets personal information leave Korea on five bases: your separate consent, a law or treaty, outsourcing or storage needed for a contract with you, a certification recognised by the PIPC, or a PIPC adequacy decision.

Keep reading

More on South Korea, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.

Medical data privacy in South Korea.