Korea's privacy watchdog says Google, Naver survey tools do not create new data-handling duty

The Personal Information Protection Commission said Friday that public and private organizations using outside survey tools such as Google Forms and Naver Form remain responsible for the personal data they collect, and that no fresh data-processing relationship is created between those organizations and the platform operators.

The ruling addresses a question that has followed the spread of free online survey tools into government and public-sector work: whether an organization that runs a survey through Google or Naver is re-entrusting personal data to the platform. Under the Personal Information Protection Act, the commission said, such a relationship does not arise. Whether an outsourcing arrangement exists at all turns on how far the service provider is involved in processing the data and how much control it exercises over it, judged against the specific way the service is used.

What survives that judgment is the user institution's own duty. Organizations must keep the data under their management and control, collect only the minimum needed, refrain from setting survey responses or links to public, and destroy the data once the purpose of collection is met.

The commission has spent several years on the problem. It has imposed fines on data controllers who misconfigured the public settings on Google Forms, in December 2021, April 2022 and December 2022 among other cases, and in December 2024 issued a privacy protection guide setting out the principles and safety measures institutions must follow when running online prize events and similar campaigns. In April 2026 it circulated an official notice to government and public institutions on precautions for online surveys conducted through such platforms.

The commission said it will supplement its guidance so that public institutions collecting and using personal data through external survey tools can see more clearly what the law requires of them, working through concrete cases and publicizing the result.