1. Reason for Amendment

- The right to request data transmission to a third party, which allows data subjects to request the transmission of their personal information to a designated third party, is being implemented in phases by expanding the transmission sectors considering public perception, private sector data demand, and national impact. The third-party transmission, which was previously prioritized only in the healthcare, telecommunications, and energy sectors, is now being expanded to the employment and education sectors.
- In addition, following the amendment to the Enforcement Decree of the Personal Information Protection Act in February 2026 regarding the expansion of the right to request transmission to oneself (allowing data subjects to request the transmission of their personal information to themselves), this amendment adjusts the scope of self-transmission and the obligations of data transmitters. It also establishes the basis for the smooth operation of the personal information protection laws and systems by adjusting the duties, designation requirements, and the scope of supervision by the Personal Information Protection Commission regarding specialized personal information management institutions.

2. Main Contents

A. Scope of Personal Information Processors Required to Transmit Personal Information to a Designated Third Party and the Target Personal Information (Amendments to Articles 42-2 and 42-4 of the Enforcement Decree)

- Expand third-party information transmitters and the information subject to transmission requests to the education and employment sectors, considering public perception, private data demand, and national impact.

B. Adjustment of Self-Transmission Scope and Transmitter Obligations as a Follow-up Measure to the Enforcement Decree Amendment Expanding the Right to Request Self-Transmission to All Sectors (Amendments to Articles 42-4, 42-6, and 42-16 of the Enforcement Decree)

- Adjust the scope of personal information that data subjects can request for transmission, establish measures to alleviate burdens on data transmitters, and provide grounds for listing on the personal information transmission support platform.

C. Adjustment of Scope of Duties, Designation Requirements, and Supervision Scope of the Personal Information Protection Commission for Specialized Personal Information Management Institutions (Amendments to Articles 42-9 and 42-15 of the Enforcement Decree)

- Exclude public institutions from the prohibition on concurrently operating as intermediary specialized institutions and general/specialized institutions, strengthen the designation requirements for public institutions as specialized personal information management institutions, and establish grounds for on-site inspections by the Commission regarding specialized institutions and general recipients.

D. Smooth Operation of the Personal Information Protection Act (Amendments to Articles 13 and 46 of the Enforcement Decree)

- Adjust the scope of data that the Commission can request submission for establishing the basic plan for personal information protection, and establish grounds for intermediary specialized institutions to request relevant data from the Minister of the Interior and Safety to support personal information processors in verifying principals or proxies.