EDPB Statement 2/2026 on the first review of the adequacy decision for the Republic of Korea

What it is about

On 23 July 2026 the European Commission published its report on the first review of the adequacy decision for the Republic of Korea (Implementing Decision (EU) 2022/254). According to the Commission, Korea continues to ensure an adequate level of protection. The EDPB responded with a statement on 10 November 2026. It welcomes amendments to the Korean data protection law (PIPA): a right to refuse an automated decision, including one by an AI system, or to request an explanation when the decision significantly affects a person's rights or obligations, a general right to withdraw consent, clearer rules on transfers to other countries and stronger enforcement powers for the Korean authority (PIPC). The EDPB asks the Commission to monitor how the new rules are applied, in particular for onward transfers to third countries. It agrees to a four-year review cycle and asks that this term be strictly observed.

What this means in practice

Anyone transferring personal data to the Republic of Korea, to a recipient subject to the Korean data protection law, can continue to rely on the adequacy decision. Pay attention to onward transfers from Korea to other countries: there the EDPB asks for closer monitoring. The statement is advice to the Commission and does not change the decision itself.

The GDPR articles concerned

• Article 44: General principle for transfers
• Article 45: Transfers on the basis of an adequacy decision