Korea opens review of UK data protection as adequate

The Personal Information Protection Commission said Thursday it has begun a formal review of whether Britain's data protection regime is equivalent to South Korea's, a step that would let companies and public institutions move personal data there without additional safeguards.

The review, which the commission said it started this month, covers Britain's privacy legislation, its supervisory and enforcement system, protections for data subjects and its procedures for redress. It will assess whether those amount to a level of protection substantially equivalent to Korea's.

If equivalence is granted, Korean companies and public bodies could transfer personal data to Britain without the extra requirements that currently apply to overseas transfers.

The commission said it chose Britain as its next candidate after two rounds of review by an expert committee on overseas transfers, in August and September, weighing cooperation in economic and digital fields, the similarity of data protection legislation, Britain's willingness to cooperate and the principle of reciprocity.

The review follows the commission's first equivalence decision, in September 2025, covering the 27 member states of the European Union and three countries in the European Economic Area. The European Union, in turn, decided in July 2026 to keep its own adequacy decision for Korea after a review.

The commission said completing a mutual equivalence decision with Britain would serve as a "safe support" for expanding trade and international joint research between the two countries and for revitalizing the data economy.

"Having stably established and maintained a mutual personal data transfer framework with the European Union, we plan to closely examine the level of personal data protection in Britain as well and prepare a smooth data transfer framework," said Song Kyung-hee, chair of the Personal Information Protection Commission.

"Through this, we expect to expand trust-based global data cooperation so that companies, public institutions and research organizations can use data with confidence while people's personal information is safely protected," she said.