South Korea Credit Information Act
Korea's Credit Information Use and Protection Act (current text, last amended 10 March 2026, in force 11 September 2026), the special law over PIPA for credit information: licensing of credit rating, corporate credit inquiry, credit investigation, MyData and debt collection businesses; collection with consent and its exceptions, outsourcing, and data combination only through designated data agencies; accuracy, removal of adverse information within five years, security of credit information systems, three-year processing records, a credit information manager and protection officer, and deletion within five years after the relationship ends; fair and transparent credit scoring without unreasonable discrimination; MyData rules including no screen scraping and direct API transmission; individual consent for each provision with required and optional items separated, compatible-purpose and pseudonymised statistics and research exceptions, and purpose limits; rights to transmission (data portability), refusal reasons, explanation and objection for automated evaluation, withdrawal and do-not-contact, access and correction, inquiry alerts, deletion and free credit reports; leak notification and reporting; pseudonymisation safeguards; FSC and PIPC supervision, surcharges up to 3 percent of sales and damages up to five times.
South Korea Credit Information Act is a compliance framework from South Korea with 11 domains and 59 controls that map to 1 other frameworks. The largest domains are Consent, provision and use of personal credit information – South Korea Credit Information Act (9 controls), Data subject rights – South Korea Credit Information Act (9 controls), Collection, processing, outsourcing and prohibited practices – South Korea Credit Information Act (8 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (11)
Accuracy, security, records and retention – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::18 | Accuracy, currency and removal of adverse information |
| south-korea-credit-information-act::19 | Security of credit information systems |
| south-korea-credit-information-act::20-2 | Retention and deletion after the relationship ends |
| south-korea-credit-information-act::20.1-2 | Management standards and processing records |
| south-korea-credit-information-act::20.3-8 | Credit information manager and protection officer |
| south-korea-credit-information-act::21 | Disposal of information on closure |
Collection, processing, outsourcing and prohibited practices – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::15 | Principles for collecting and processing credit information |
| south-korea-credit-information-act::17 | Outsourcing credit information processing |
| south-korea-credit-information-act::17-2 | Combining datasets through a data specialised agency |
| south-korea-credit-information-act::23 | Personal credit information from public bodies |
| south-korea-credit-information-act::40 | Prohibited practices and advertising |
| south-korea-credit-information-act::40-2 | Pseudonymisation and anonymisation |
| south-korea-credit-information-act::41-2 | Checking recruitment agents' data sources |
| south-korea-credit-information-act::42 | Confidentiality and onward provision |
Conduct rules for credit information companies – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::22 | Qualifications of officers and staff |
| south-korea-credit-information-act::22-2 | Reporting use of credit information |
| south-korea-credit-information-act::22-3 | Principles and conduct rules for personal credit rating |
| south-korea-credit-information-act::22-5 | Conduct rules for sole-proprietor credit rating |
| south-korea-credit-information-act::22-6 | Conduct rules for corporate credit inquiry and technology credit rating |
| south-korea-credit-information-act::22-7 | Conduct rules for credit investigation |
Consent, provision and use of personal credit information – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::26-4 | Data specialised agencies: risk management |
| south-korea-credit-information-act::32.1-3 | Individual consent for providing personal credit information |
| south-korea-credit-information-act::32.4-5 | Separating required and optional consents |
| south-korea-credit-information-act::32.6-7 | Provision without consent and prior notice |
| south-korea-credit-information-act::32.8-11 | Business transfers, recipient checks and proof of consent |
| south-korea-credit-information-act::33 | Purpose limitation for use and health information |
| south-korea-credit-information-act::34 | Personal identification information |
| south-korea-credit-information-act::34-2 | Principles for consent to use of information |
| south-korea-credit-information-act::34-3 | Consent rating |
Data subject rights – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::36 | Reasons for refusing a transaction |
| south-korea-credit-information-act::36-2 | Explanation and objection for automated evaluation |
| south-korea-credit-information-act::37 | Withdrawing consent and stopping marketing contact |
| south-korea-credit-information-act::38 | Access and correction |
| south-korea-credit-information-act::38-2 | Notification of credit inquiries |
| south-korea-credit-information-act::38-3 | Deletion on request after the relationship ends |
| south-korea-credit-information-act::39 | Free access to credit scores |
| south-korea-credit-information-act::39-2 | Creditor change information |
| south-korea-credit-information-act::39-3 | Exercising rights through agents and for children |
Debt collection – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::27 | Debt collection staff and delegated collectors |
| south-korea-credit-information-act::27-2 | Outsourcing debt collection only to licensed companies |
| south-korea-credit-information-act::41 | Debt collection company prohibitions |
Leaks and liability – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::39-4 | Notification and reporting of leaks |
| south-korea-credit-information-act::43-3 | Securing damages liability |
Licensing and corporate matters – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::10 | Business transfer, merger, split, suspension and closure |
| south-korea-credit-information-act::11 | Concurrent and ancillary business |
| south-korea-credit-information-act::12 | Protected names |
| south-korea-credit-information-act::13 | Outside positions of full-time officers |
| south-korea-credit-information-act::4 | Licence before carrying on credit information, MyData or debt collection business |
| south-korea-credit-information-act::6.4 | Maintaining licensing requirements |
| south-korea-credit-information-act::8 | Notifying and reporting changes to licensed matters |
| south-korea-credit-information-act::9 | Approval of major shareholders and eligibility of the largest shareholder |
MyData and data transmission – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::22-9.1-3 | MyData operators: fair inducement, conflicts and no credential scraping |
| south-korea-credit-information-act::22-9.4-7 | Data holders: direct secure transmission to MyData operators |
| south-korea-credit-information-act::33-2 | Right to transmission of personal credit information |
Supervision and reporting – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::45 | Supervision, inspection and business reports |
Transparency and notices – South Korea Credit Information Act
| Code | Title |
|---|---|
| south-korea-credit-information-act::31 | Publishing the credit information use system |
| south-korea-credit-information-act::35 | Enquiry into use and provision history |
| south-korea-credit-information-act::35-2 | Explaining possible score decline |
| south-korea-credit-information-act::35-3 | Advance notice before reporting default |
Maps to 1 other framework
Coverage is not the same as your position
This page shows what South Korea Credit Information Act overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is South Korea Credit Information Act and who does it apply to?
South Korea Credit Information Act is a compliance framework from South Korea with 11 domains and 59 controls. Korea's Credit Information Use and Protection Act (current text, last amended 10 March 2026, in force 11 September 2026), the special law over PIPA for credit information: licensing of credit rating, corporate credit inquiry, credit investigation, MyData and debt collection businesses; collection with consent and its exceptions, outsourcing, and data combination only through designated data agencies; accuracy, removal of adverse information within five years, security of credit information systems, three-year processing records, a credit information manager and protection officer, and deletion within five years after the relationship ends; fair and transparent credit scoring without unreasonable discrimination; MyData rules including no screen scraping and direct API transmission; individual consent for each provision with required and optional items separated, compatible-purpose and pseudonymised statistics and research exceptions, and purpose limits; rights to transmission (data portability), refusal reasons, explanation and objection for automated evaluation, withdrawal and do-not-contact, access and correction, inquiry alerts, deletion and free credit reports; leak notification and reporting; pseudonymisation safeguards; FSC and PIPC supervision, surcharges up to 3 percent of sales and damages up to five times. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does South Korea Credit Information Act actually require?
South Korea Credit Information Act has 59 controls organised across 11 domains. The largest domains are Consent, provision and use of personal credit information – South Korea Credit Information Act (9 controls), Data subject rights – South Korea Credit Information Act (9 controls), Collection, processing, outsourcing and prohibited practices – South Korea Credit Information Act (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of South Korea Credit Information Act do I already cover?
South Korea Credit Information Act maps to 1 other compliance frameworks. The top mapping partners are GDPR (23% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement South Korea Credit Information Act?
Start your South Korea Credit Information Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about South Korea Credit Information Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 59 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required