What Changed
- Endorsement of a four-year review cycle for the Republic of Korea adequacy decision based on PIPA legislative updates.
- Adoption of final Processor Binding Corporate Rules (BCR-P) recommendations requiring compliance by the 2028 annual update at the latest.
- Selection of AI-driven automated decision-making in candidate recruitment for the 2027 Coordinated Enforcement Framework.
The European Data Protection Board (EDPB) adopted three major regulatory updates during its latest plenary session, directly impacting international data transfer tools, intra-group data processing rules, and supervisory enforcement across the European Union.
First, the EDPB adopted a statement regarding the first review of the Republic of Korea adequacy decision. Following an online review meeting on 17 October 2025 and the European Commission's subsequent report on 23 July 2026 (SWD(2026) 231 final), the EDPB welcomed key amendments to South Korea's Personal Information Protection Act (PIPA). Statutory changes introduced a general right to withdraw consent, rights to request processing suspension, and rights to refuse or request explanations for automated decisions, including those powered by AI systems. Additionally, PIPA Article 28-8 clarified the legal framework for international transfers by providing specific transfer tools as alternatives to consent, while enforcement powers of the Personal Information Protection Commission (PIPC) were strengthened. Consequently, the EDPB agreed with the Commission's proposal to transition to a four-year adequacy review cycle.
Second, the EDPB finalized and adopted recommendations on Processor Binding Corporate Rules (BCR-P). BCR-P serve as a legal tool for groups of undertakings or enterprises to transfer personal data outside Europe to processors within the same corporate group while maintaining data protection standards essentially equivalent to the GDPR. These recommendations are now applicable to all current BCR-P holders as well as new and ongoing applicants. Entities must bring their BCR-P frameworks into alignment during the application process or as part of their 2028 annual update.
Third, the Board selected automated decision-making (ADM), including AI-driven tools in candidate recruitment, as the topic for its sixth Coordinated Enforcement Framework (CEF) action. Scheduled for launch in 2027, the action will evaluate how data protection authorities enforce individuals' rights not to be subject to solely automated decisions and their associated right of access regarding automated candidate screening.
Organizations transferring data between the EU and South Korea, multinational groups utilizing BCR-P transfer mechanisms, and employers deploying automated recruitment software should evaluate their operations against these updated regulatory standards.
Who May Be Affected
Entities conducting data transfers between the EU and South Korea, corporate groups relying on Processor BCRs for intra-group international data transfers, and employers using automated or AI candidate screening tools.
Cross-Border Context
Affects data transfers from the EU to the Republic of Korea under the GDPR adequacy framework and governs transfers outside Europe to group processors under Processor Binding Corporate Rules.
What to check next
- Review the finalized EDPB recommendations and track-changes document for Processor Binding Corporate Rules.
- Monitor national Data Protection Authorities' voluntary sign-ups for the 2027 CEF recruitment enforcement action.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.