South Korea Credit Information Act
The South Korea Credit Information Use and Protection Act (as amended 2020, effective 2021) regulates the collection, use, and protection of credit information (financial and personal credit data). The 2020 MyData amendments enable individuals to request their financial data be transferred to authorized third-party service providers. Financial Services Commission (FSC) and Financial Supervisory Service (FSS) oversee compliance. Covers credit bureaus, financial institutions, and MyData operators.
South Korea Credit Information Act is a compliance framework from South Korea with 10 domains and 25 controls. The largest domains are Credit Information Act: Governance and Accountability (5 controls), Credit Information Act: Lawful Basis and Consent (5 controls), Credit Information Act: Security, Retention and Logging (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (10)
Consent
| Code | Title |
|---|---|
| KRCRED-2 | Lawful Basis and Consent for Credit Information |
Credit Information Act: Data Subject Rights and MyData
| Code | Title |
|---|---|
| CIA-ACC-06 | Data subject access, correction, and deletion rights |
| CIA-AUTOM-18 | Automated decision making in credit assessment |
| CIA-MYD-05 | MyData service authorisation and operation |
Credit Information Act: Governance and Accountability
| Code | Title |
|---|---|
| CIA-EDU-19 | Training of employees and officers |
| CIA-INSP-20 | FSC and FSS inspection cooperation |
| CIA-OFF-03 | Credit information management and protection officer |
| CIA-PRV-POL-15 | Public disclosure of credit information processing policy |
| CIA-RISK-16 | Risk assessment for personal credit information |
Credit Information Act: Lawful Basis and Consent
| Code | Title |
|---|---|
| CIA-CHILD-17 | Protection of minors credit information |
| CIA-CONS-02 | Consent for provision and use of credit information |
| CIA-LAW-01 | Lawful basis for processing credit information |
| CIA-MKT-12 | Use of credit information for marketing |
| CIA-PSEUDO-04 | Pseudonymised credit information processing |
Credit Information Act: Outsourcing, Transfers and Licensing
| Code | Title |
|---|---|
| CIA-INQ-13 | Credit inquiry company licensing and operation |
| CIA-OUT-10 | Outsourcing of credit information processing |
| CIA-TRANS-11 | Cross border transfer of credit information |
Credit Information Act: Security, Retention and Logging
| Code | Title |
|---|---|
| CIA-BRC-09 | Breach notification to data subjects and FSC |
| CIA-LOG-14 | Access and provision logs |
| CIA-RET-07 | Retention and destruction of credit information |
| CIA-SEC-08 | Technical and physical safeguards |
Enforcement
| Code | Title |
|---|---|
| KRCRED-5 | FSC + PIPC Cooperation, Sanctions |
Rights
| Code | Title |
|---|---|
| KRCRED-3 | Data Subject Rights |
Scope
| Code | Title |
|---|---|
| KRCRED-1 | Scope and Purpose of Credit Information Act |
Security
| Code | Title |
|---|---|
| KRCRED-4 | Security, Cross-Border, Duties of Data Processors |
What is South Korea Credit Information Act and who does it apply to?
South Korea Credit Information Act is a compliance framework from South Korea with 10 domains and 25 controls. The South Korea Credit Information Use and Protection Act (as amended 2020, effective 2021) regulates the collection, use, and protection of credit information (financial and personal credit data). The 2020 MyData amendments enable individuals to request their financial data be transferred to authorized third-party service providers. Financial Services Commission (FSC) and Financial Supervisory Service (FSS) oversee compliance. Covers credit bureaus, financial institutions, and MyData operators. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does South Korea Credit Information Act actually require?
South Korea Credit Information Act has 25 controls organised across 10 domains. The largest domains are Credit Information Act: Governance and Accountability (5 controls), Credit Information Act: Lawful Basis and Consent (5 controls), Credit Information Act: Security, Retention and Logging (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of South Korea Credit Information Act do I already cover?
South Korea Credit Information Act does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement South Korea Credit Information Act?
Start your South Korea Credit Information Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about South Korea Credit Information Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.
Get Started Free →Free forever — no credit card required