On December 30, 2025, the Financial Services Commission and the Personal Information Protection Commission issued an official interpretation that allows Korean branches of foreign reinsurers to transfer personal credit information to their overseas head office, affiliates, or other third parties, without separate consent from the relevant data subject, for purposes of delegation of functions related to reinsurance contracts. This interpretation, based on Article 28-8 of the Personal Information Protection Act ("PIPA") and Article 17(1) of the Credit Information Use and Protection Act, is significant in that it broadly applied the "delegation for the execution or performance of a contract with a data subject" exception to the consent requirement for overseas transfers of personal information under PIPA. The interpretation recognized reinsurance contracts as contracts for the benefit of the data subjects.
Please note, however, that the delegation of reinsurance related functions to an overseas head office, affiliates or other third parties, would still require the Korean branch to comply with other requirements under applicable laws and regulations, including (i) entering a delegation agreement, including provisions relating to data security, and (ii) conducting information security training, and (iii) submitting a prior report to the Financial Supervisory Service.
This official interpretation resolves the previous legal uncertainty regarding the overseas transfer of personal credit information by Korean branches of foreign reinsurers for purposes of receiving risk analysis, underwriting review or other services relating to reinsurance contracts from overseas head office, affiliate or other third parties.
Related Topics
