April 6, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) will conduct preliminary fact-finding reviews of 

personal data protection practices across five sectors that outsource customer service operations. 

This initiative follows a recent incident in which call center staff working for a delivery service accessed 

customers’ personal information without authorization and misused them in connection with “revenge-for-hire” crimes. 

The five sectors include:

 ㅇ Delivery services

 ㅇ Home shopping businesses

 ㅇ Online shopping businesses

 ㅇ Rental businesses

 ㅇ Telecommunications providers

The PIPC plans to review the data protection practices of both personal data processors and 

their subcontractors entrusted with handling personal data. The review will a focus on:

Whether they put appropriate safeguards in place required under the Personal Information Protection Act (PIPA), 

such as granting access authorization to personal information;

Whether they properly manage and supervise data protection services, such as conducting privacy training 

for subcontractors

A legal basis for a fact-finding review is Article 63-2 of the PIPA. Where a personal data processor fails to 

comply with the PIPA, the PIPC may require its public officials to enter the premises of the relevant entity to inspect 

the status of business operations, ledgers, documents, etc.