PIPA Article 28-8: cross-border transfer needs separate consent, certification, a recognised country or a statute (Personal Information Protection Act (Korea), Act No. 20897, 1 Apr. 2025 (English translation by the Korea Legislation Research Institute), Art. 28-8(1) and (2))

Sending personal information to a buyer in the United States is allowed only on one of the Article 28-8(1) grounds. For a one-off licence the practical ground is separate consent, which must name the data, the country, the recipient and its purpose and retention.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text

In the source's own words

“No cross-border provision (including inquiry), entrusted processing, or storage (hereafter in this Section referred to as "transfer") of personal information shall be allowed by a personal information controller; provided, in any of the following cases, the cross-border transfer of personal information may be allowed: 1. Where separate consent is obtained from the data subject; ... A personal information controller shall inform data subjects of the following matters in advance when obtaining consent under paragraph (1) 1: 1. Particulars of the personal information to be transferred; 2. The country to which the personal information is transferred, transfer date, and method; 3. Name of the recipient of personal information”

Where it was read

PIPA Article 28-8: cross-border transfer needs separate consent, certification, a recognised country or a statute, South Korea, checked 18 Oct 2026
Everything read from this source (5)