Adequacy Decision with South Korea
Adequacy Decision with South Korea
In 2021, the UK government had announced plans to expand the list of countries that it deems provide adequate data protection, so that UK organisations are able to share personal data freely to those countries without the need for additional safeguards.
After reaching agreement in principle on data adequacy early last year, the UK has now finalised the adequacy decision with South Korea in November 2022. This is the first-ever adequacy regulation agreed by the UK following its exit from the EU.
Why is this significant and what does it mean for me?
The UK’s decision means that the Republic of Korea has privacy laws that ensure the protection of the rights and freedoms of UK data subjects.
The UK-based organisations who transfer, or intend to transfer, personal data to South Korea will now be able to do so freely, without the need to put in place a transfer tool under Article 46 of the UK GDPR.
The UK government has emphasised that this decision is broader than the EU's equivalent, as it extends to credit-related data. In practice, UK organisations will also be able to share personal data related to credit information with South Korea to help identify customers and verify payments.
This should help UK businesses with a presence in South Korea to boost credit, lending, investment and insurance operations in the country.
The other countries that UK has prioritised for data adequacy agreements are Australia, Brazil, Colombia, Dubai International Financial Centre, India, Indonesia, Kenya and Singapore.
The adequacy regime is expected to reduce administrative and financial costs for UK businesses by £11 million per year as well as boosting exports to South Korea.
If you have any queries or would like further information, please visit our data protection services section or Christopher Beveridge.