What Changed
- EDPB endorsed a 4-year review cycle for South Korea's adequacy decision following statutory PIPA updates on consent, processing suspension, and automated decision rights.
- Final recommendations for Binding Corporate Rules for Processors (BCR-P) were adopted, requiring compliance alignment during application or by the 2028 annual update.
- The 2027 Coordinated Enforcement Framework action will target AI-assisted recruitment tools and candidates' rights regarding automated decision-making.
On 10 November 2026, the European Data Protection Board (EDPB) adopted a statement on the first review of the Republic of Korea’s adequacy decision, released final recommendations on Binding Corporate Rules for Processors (BCR-P), and announced AI-assisted recruitment as the topic for its 2027 Coordinated Enforcement Framework (CEF) action. These developments impact multinational corporate groups, data processors conducting cross-border transfers outside Europe, and employers utilizing automated HR tools.
Regarding the Republic of Korea, the EDPB evaluated recent updates to the Personal Information Protection Act (PIPA). Key statutory modifications include a general right to withdraw consent, a right to request suspension of processing, and a right to object to or seek explanations for automated decisions—including those made via artificial intelligence (AI) systems—that significantly affect data subjects' rights or obligations. PIPA Article 28-8 also clarified international data transfer mechanisms, establishing specific alternatives to consent. Following the European Commission’s report on 23 July 2026 [SWD(2026) 231 final] assessing the 2021 adequacy decision (originally adopted on 17 December 2021), the EDPB endorsed moving South Korea’s adequacy review cycle to every four years.
For cross-border data transfers, the EDPB adopted final recommendations on BCR-P following a public consultation. BCR-P enable corporate groups to transfer personal data outside Europe to intra-group processors while ensuring enforceable rights equivalent to the General Data Protection Regulation (GDPR). The updated recommendations apply immediately to all BCR-P holders, pending applicants, and new applicants. Entities must align their BCR-P frameworks either during the ongoing application process or during their 2028 annual updates.
Finally, the EDPB designated automated decision-making in AI-assisted recruitment as its 2027 CEF theme. The initiative focuses on candidate screening tools, enforcing the right under GDPR not to be subject solely to automated decision-making, alongside the corresponding right of access. Data protection authorities (DPAs) will participate on a voluntary basis, with official enforcement actions launching in 2027.
Who May Be Affected
Multinational corporate groups transferring personal data outside Europe, data processors relying on BCR-P, employers using AI automated candidate screening tools, and data subjects in the EU and South Korea.
Cross-Border Context
Applies to cross-border data flows between the EU and South Korea under the adequacy framework as well as intra-group transfers outside Europe via BCR-P mechanisms.
What to check next
- Review the official EDPB final recommendations document on BCR-P and the tracked-changes version.
- Assess corporate BCR-P frameworks to schedule alignment for the 2028 annual update or active application process.
- Monitor national DPA announcements regarding voluntary participation in the 2027 CEF action on AI recruitment tools.
This article provides general information and does not constitute legal advice. Consult the official text and obtain advice appropriate to your circumstances where needed.