Employee data in Korea: a legal basis for each use and strict CCTV limits

This guide is for employers and HR staff handling employees' personal data in Korea. Under the Personal Information Protection Act (개인정보 보호법, PIPA), each use of employee data needs a legal basis, and you may collect only what you need. It follows PIPA as in force since September 11, 2026 and the December 2024 HR guide (분야별 개인정보 보호 안내서, 인사·노무 편) of the Personal Information Protection Commission (개인정보보호위원회, PIPC).

Four stages, one rule

The PIPC guide splits HR data handling into four stages: hiring preparation, hiring decision, employment and after employment. At every stage you need one of the legal bases in PIPA Article 15(1). In HR the main ones are:

• a law requires the data or a legal duty makes it unavoidable;
• it is needed to make or perform the employment contract;
• a legitimate interest clearly outweighs the employee's rights, is closely related to the data and stays within a reasonable scope;
• the employee consents.

Collect the minimum; the employer bears the burden of proving it did (Article 16(1)).

Data you can use without consent

• Legal duties. The worker register and the wage ledger, including the facts behind family allowances (Labor Standards Act, 근로기준법, Article 48), and resident registration numbers needed under the four social insurance laws.
• The employment contract. Transfers, secondments, leave, performance reviews and benefits.
• Family data for allowances and benefits. Neither the employee nor the family member needs to consent, but a family member's sensitive data or unique identifiers need that person's separate consent, and resident registration numbers need a specific legal basis. Ask for family certificates with the back digits of resident registration numbers removed.

Two kinds of data always need more:

• Sensitive data (민감정보): beliefs, union or party membership, political views, health, sex life, genetic data, criminal records, biometric data used to identify a person, and race or ethnicity (Article 23; Enforcement Decree, Article 18). The PIPC guide says an employee's plans to have a child may count as sensitive data.
• Unique identifiers (고유식별정보): resident registration, passport, driver's license and alien registration numbers (Article 24; Enforcement Decree, Article 19).

Both need a legal basis or the employee's separate consent. Resident registration numbers need a specific legal basis; consent alone is not enough (Article 24-2).

Publishing transfers or promotions outside the company needs the employee's consent, and disciplinary measures and dismissals should in principle stay confidential.

CCTV, location trackers and fingerprint readers

Before installing a digital device where employees regularly work, such as attendance CCTV in a restricted area, a driver location tracker or an entrance fingerprint reader, hear the employees' views. Workplaces with 30 or more regular workers must have a labor-management council (노사협의회) (Act on the Promotion of Workers' Participation and Cooperation, Article 4), which must discuss the installation of worker monitoring equipment (Article 20(1)). Explain the device's purpose, specifications and range, the data it records and how long you keep it.

Rules for these devices:

• Rely on the legal bases above; where the basis is unclear, ask for consent, bearing in mind that employees find it hard to refuse.
• Biometric data used for identification is sensitive and needs separate consent. Offer an alternative, such as an ID card instead of a fingerprint reader, and encrypt biometric data when stored or sent (Standards for Personal Information Security Measures, Article 7(1)).
• No CCTV may be set up to view inside bathrooms, toilets, sweat rooms or changing rooms used by many people (PIPA Article 25(2)), and CCTV may not record sound (Article 25(5)). Put up a notice sign for any CCTV.
• Limit camera angles to the purpose and switch devices off when not needed. Work apps and mobile device management (MDM) tools, including those for remote work, should collect only what the work requires.
• Do not use a device for attendance checks or discipline beyond its lawful purpose.
• Recording others' conversations (Protection of Communications Secrets Act, 통신비밀보호법, Article 3) and infringing others' secrets on information networks (Network Act, 정보통신망법, Article 49) are banned.

Employees' rights

Employees can ask to see, correct or delete their data, or to stop its processing (PIPA Articles 35 to 37). Reply within 10 days (Enforcement Decree, Articles 41, 43 and 44).

• Show objective performance results unless there is a special reason. Appraisal grades and salary calculations may be withheld if disclosure would unfairly harm the company or other staff (Article 35(4)).
• When showing CCTV footage, mask other people in it.
• For data obtained from someone other than the employee, tell the employee on request its source, the purpose and their right to stop the processing (Article 20(1)).

How long to keep records

Destroy data without delay once it is no longer needed, in a way that prevents recovery (Article 21). The PIPC's Standard Personal Information Protection Guidelines (표준 개인정보 보호지침) set 5 days unless there is a justifiable reason and require a record of each destruction (Article 10). Data that another law requires you to keep must be stored separately (PIPA Article 21(3)).

Leaks and remedies

Your privacy policy must name your privacy officer or complaints department and give a contact number (Article 30(1)).

If employee data leaks:

• Tell affected employees within 72 hours, by letter, email, phone or text message, what leaked, when and how, and what they can do (Article 34(1); Enforcement Decree, Article 39). Since September 11, 2026, you must also tell people when you learn of a possible leak of a kind set by decree.
• Report to the PIPC or the Korea Internet & Security Agency (한국인터넷진흥원, KISA) within 72 hours if data of 1,000 or more people leaked, if sensitive data or unique identifiers leaked, or if the leak came from unlawful outside access (Enforcement Decree, Article 40).

Employees have these remedies:

• report a privacy violation to the Privacy Infringement Report Center (개인정보침해 신고센터), phone 118;
• report unfair labor practices by the employer to the regional employment and labor office (Ministry call center: 1350);
• apply online or in writing to the Personal Information Dispute Mediation Committee (개인정보 분쟁조정위원회) at www.kopico.go.kr, phone 1833-6972 (weekdays 9:00~18:00);
• claim damages. The employer is liable unless it proves it was not at fault (Article 39(1)). For leaks caused intentionally or by gross negligence, a court may award up to 5 times the damage (Article 39(3)), and statutory damages of up to ₩3,000,000 are available when the loss is hard to prove (Article 39-2).

For the breach steps in detail, see Personal data breach: notice and report are separate, both within 72 hours.