Brussels, 11 November – During its latest plenary, the EDPB has adopted a statement on the first review of the functioning of the adequacy decision of the Republic of Korea and the final version of the recommendations on the application for approval and on the elements and principles to be found in Processor Binding Corporate Rules (BCR-P). In addition, the Board selected the topic for its sixth coordinated enforcement action (CEF).

The EDPB statement on the first review of the Republic of Korea adequacy decision focuses mainly on the assessment of amendments to the Korean data protection legal framework, both on the commercial aspects and concerning access and use of personal data by Korean public authorities*.

“The mutual recognition of equivalent data protection standards between the EU and the Republic of Korea in 2025 represented a major step confirming the growing alignment between both regulatory frameworks.

We welcome amendments in the Korean data protection legislation that have increased the level of protection of individuals and facilitated the processing of data by controllers while maintaining a level of protection essentially equivalent to that of the GDPR."

EDPB Chair, Anu Talus

For example, the Personal Information Protection Act (PIPA) was amended to introduce a new general right to withdraw consent, a right to request the suspension of processing of personal data, as well as a right to refuse an automated decision (incl. by AI systems) or request an explanation if the decision significantly impacts the data subjects’ rights or obligations.

Furthermore, regarding onward transfers, the EDPB welcomes the changes to the PIPA on the legal regime applicable to international transfers of personal data. The changes clarify the need for cross-border transfers of personal information to rely on specific transfer tools (Art. 28-8 PIPA), offering therefore alternative solutions to consent.

The EDPB also welcomes the strengthening of enforcement and sanctions powers of the Korean DPA (PIPC).

The EDPB agrees with the Commission’s proposal to consult the Committee established under Art. 93(1) of the GDPR to conduct a review of the adequacy decision every four years.

Final version recommendations Processor BCR adopted

Following public consultation, the EDPB has adopted the final version of the recommendations on the application for approval and on the elements and principles to be found in BCR-P. BCR-P are a transfer tool that can be used by a group of undertakings or enterprises to transfer personal data outside Europe to processors within the same group. BCRs create enforceable rights and set out commitments to establish a level of data protection essentially equivalent to the one provided by the GDPR.

The recommendations are now applicable to all BCR-P holders. All BCR-P holders, as well as all new and ongoing BCR-P applicants should bring their BCR-P in line with the recommendations, either during the application process or as part of their 2028 annual update, depending on their specific situation.

In line with the Helsinki statement’s objective to strengthen the dialogue with stakeholders, the Board has also released a report on the outcome of the dedicated public consultation, as well as a track changes version of the recommendations.

Coordinated Enforcement Framework: topic selected for 2027

The EDPB picked the topic for its sixth coordinated enforcement action, which will concern automated decision-making (ADM), including AI-driven ADM, in recruitment. More specifically, the coordinated action will focus on the enforcement of the right not to be subject to decisions based solely on automated processing and the related right of access, in the context of the use of automated candidate screening tools, including AI-driven ones. DPAs will join this action on a voluntary basis in the coming weeks, and the action itself will be launched in the course of 2027.

You can find more information about the CEF, as well as the reports on the previous CEF actions, here.

Note to editors:

* On 17 December 2021, the European Commission adopted an adequacy decision recognising that the data protection framework of the Republic of Korea offers an adequate level of data protection. The adoption of an adequacy decision involves:

• a proposal from the European Commission;
• an opinion of the European Data Protection Board;
• an approval from representatives of EU countries;
• the adoption of the decision by the European Commission.

The Commission is required to periodically review the adequacy decisions, and to report its findings to the European Parliament and the Council. Regular reviews ensure that the essential equivalence standard is preserved.

The process for the first review of the functioning of the adequacy decision took place in 2025 and, in particular, consisted of an online review meeting on 17 October 2025. The Commission invited the EDPB to take part in the review meeting in line with Recital 221 of the Korean adequacy decision.

On 23 July 2026, the European Commission issued the Report to the European Parliament and the Council on the first review of the functioning of the adequacy decision for the Republic of Korea, along with a Commission Staff Working Document (SWD(2026) 231 final). The Commission concluded that the Republic of Korea continues to ensure an adequate level of protection for personal data from the European Union to entities in the Republic of Korea subject to its amended data protection framework.

In light of the outcome of the review, the EDPB agrees to the European Commission’s proposal to move to a four-year review cycle of this adequacy decision.