Personal data can continue to flow from the EU to South Korea without additional guarantees.

Companies, public institutions, and other organizations can continue to transfer personal data from the European Union to South Korea without having to introduce additional legal mechanisms for each operation, after the European Commission confirmed that the protection provided by the South Korean system remains comparable to EU standards. The first evaluation of the decision adopted in 2021 identified areas where the authorities in Seoul need to strengthen guarantees, especially when data is forwarded to other countries.

In short, the Commission maintained the conclusion that South Korea provides an adequate level of protection for personal data transferred from the EU. The decision allows the continuation of transfers without individual authorization, standard contractual clauses, or other additional instruments. The assessment shows that European and South Korean rules have come closer after changes to the legislation in Seoul, including by strengthening the rights of individuals whose data is collected and used. The Commission recommends improving protection when organizations in South Korea send data received from the EU to another country and calls for continued efforts for effective enforcement of the rules. South Korea also recognizes the European data protection framework, which allows the flow of personal information in both directions for organizations covered by the two systems. Reciprocal transfers are used in trade relations, digital services, research, and administrative cooperation, in a bilateral economic partnership valued at over 150 billion euros per year.

An adequacy decision allows the sending of personal data to a country outside the European Economic Area under conditions close to those applicable to transfers within the Union. European organizations do not need to obtain authorization for each transfer nor to automatically use standard contractual clauses, mandatory corporate rules, or individual derogations.

The assessment does not mean that South Korean legislation must identically reproduce the General Data Protection Regulation. The Commission checks whether the rights of individuals, the obligations of organizations, independent oversight, access to remedies, and limitations imposed on public authorities provide overall protection comparable to that guaranteed in the EU.

The first periodic evaluation analyzed the changes made after the adoption of the 2021 decision. The Commission found that the changes made to South Korean law on personal data protection have strengthened the rights of data subjects and brought the two legal frameworks closer together.

Data subjects are those to whom the transferred information refers, such as customers, users, employees, or participants in research projects. Their rights may include being informed about the use of data, access to information held about them, correction of inaccurate data, and contesting certain forms of processing.

The Commission has also made recommendations for strengthening the system. One of these concerns onward transfers, which occur when an organization in South Korea receives data from the EU and then sends it to a recipient in another country. The protection recognized by the adequacy decision should not be lost through this successive transmission.

The assessment also calls for the maintenance of effective enforcement of the rules. The existence of rights in legislation must be accompanied by oversight, investigations, and corrective measures when organizations do not comply with obligations regarding the collection, use, retention, or disclosure of data.

The Commission has not suspended or restricted the 2021 decision. Transfers can continue under the same conditions, and the recommendations do not represent additional requirements that each European company must fulfill before sending data to South Korea.

The European regime applies to transfers to South Korean entities covered by the national law on personal data protection and the additional guarantees associated with the decision. Organizations sending data must continue to comply with other European obligations, including the existence of a legal basis for processing, informing individuals, and limiting the use of data to specific purposes.

South Korea has since introduced its own recognition of the European system. This allows transfers from Korea to organizations in the public and private sectors of the EU without additional instruments imposed solely due to the destination of the data.

The Executive Vice-President of the European Commission for technological sovereignty, security, and democracy, Henna Virkkunen, stated: "Korea is an important and reliable digital partner for the EU. Today's report is one of many pieces of evidence in this regard. I am pleased to see that our data protection systems are closer than ever. The mutual adequacy decision benefits both companies and citizens in Europe and the Republic of Korea."

The European Commissioner for democracy, justice, the rule of law, and consumer protection, Michael McGrath, stated: "Trustworthy data flows are the lifeblood of the digital economy. Strong data protection and open international trade are not competing objectives but reinforce each other. When people and companies can trust that their data is protected, economies can connect, innovate, and grow."

The Commission estimates that the reciprocal regime concerns data flows that can benefit a combined population of over 500 million people. This figure refers to the population covered by the two jurisdictions and not to the number of individuals whose data is actually transferred.

The arrangement supports the trade relationship between the EU and South Korea, valued at over 150 billion euros per year. The value describes bilateral trade exchanges, not the economic benefit produced separately from the decision on data protection.

The Commission adopted the decision regarding South Korea in December 2021, based on the General Data Protection Regulation. This covers transfers to entities subject to South Korean law on personal data protection, supplemented by the guarantees and commitments included in the decision.

Adequacy decisions are periodically evaluated to verify whether legal developments and practices in the partner country maintain the level of protection on which the initial recognition was based. The Commission can monitor the system, request information, and, if protection is no longer sufficient, suspend, amend, or withdraw the decision.

South Korea recognized in September 2025 the European framework as equivalent for transfers originating from its territory. The two recognitions form a reciprocal system that covers the public and private sectors and complements trade and digital agreements between the two parties.

Maintaining the European decision allows the continuation of transfers in the current form. European and South Korean authorities must monitor the implementation of recommendations regarding onward transfers and the effective respect of rights before the next evaluation.