OBS_VALUE: From 2020 the law allows the cross-border transfer of personal data without consent of the data subject if such transfer has been notified to the subject or otherwise disclosed in the data controller’s privacy policies, and the controller implemented necessary safeguards listed in the legal acts, for such transfer. In 2023 amendments to the Personal Information Protection Act (PIPA) were enacted, which in most respects come into effect in September 2023. The amended PIPA permits overseas transfers, without need of obtaining the data subjects’ consents, in any of the following situations: (a) The transfer is by way of entrustment, or for data storage, as “necessary” to perform a contract with the data subject, and details (country, transferee and so on) are disclosed in the privacy policy or by email (or some other to-be-designated possible method); or (b) the overseas recipient to whom the data is transferred has obtained a data protection certification by the Korean data protection authority, the Personal Information Protection Commission (PIPC), and has taken necessary data protection measures; (c) the transfer is to a country deemed by the PIPC to satisfy PIPA levels of data protection, including as to data subjects’ rights and remediation; or (d) There is a treaty or agreement of Korea with the other country that specifically addresses PI transfers between them. 